4

I've been trying to figure out a way for a bitcoin wallet keypair to be created between two or more people without either/any one of them holding the private key afterwards.

Instead, I want the buyer to hold a PGP-encrypted file that has the private key inside it.

The buyer is never, ever, to see that private key... It's the seller's wallet that is encrypted... But the seller can't have the private key yet either, just a public key, and the PGP key to open the PGP-protected file.

I thought about a 3rd man in the middle creating the wallet and putting it there, but then the 3rd guy could cash out the wallet himself later...

So is there a trustless way to put the keypair into a PGP file and send that file to the buyer and the PGP key to the seller?

Enjoy the puzzle!

Dex Bitcoin
  • 51
  • 4
  • It sounds like your goal is to have a Bitcoin address generated by two parties that can only be spent out of by having those two parties cooperate. Is that correct? – Nick ODell May 30 '13 at 06:18
  • 2
    Are you sure m-of-n transactions aren't instead what you need? – o0'. May 30 '13 at 12:55
  • @Nick: Yes, or more specifically, can only be spent, by only the vendor, when the buyer sends the pgp encrypted wallet to the vendor. (Redemption) – Dex Bitcoin May 31 '13 at 04:18
  • @Lorhoris: I'm pretty sure M-of-n aren't going to help this need. I definitely want the end product to be a file encrypted in something like PGP, where the person holding it can't get inside and the other person can get inside, (and be the first one to access the wallet) but doesn't possess it in any way. – Dex Bitcoin May 31 '13 at 04:21

2 Answers2

3

You are attempting to answer the question you are asking in the question. Let me get to the root of what you are asking.

From what I understand, you would like to create a 2 party escrow - buyer sends money in a way that can't be retrieved unless both parties are satisfied.

This can be done in two ways in Bitcoin - one through the use of multisignature transactions, other - through split-key addresses.

The first approach is to send the money to 2-of-2 multisignature combination of addresses - one held by the buyer, and another - by the seller. When they reach consensus, they create a transaction, each signs it and money is transferred. The disadvantage of this approach is that if they don't reach consensus, there is no way to settle the money dispute. If you would introduce some third party acting like an escrow and create 2-of-3 multisignature address, then you would need a consensus of any 2 involved parties. If the buyer and seller agree on a consensus, escrow service does not get involved and everyone is satisfied. If they can't reach consensus, escrow steps in and mediates the solution with the parties forcing a compromise - it can always break a stalemate by cooperating with one party.

The second approach is for both parties to settle on a public key each by themselves, and then combine it through multiplication or addition, creating a split-key address. They both know the public key and associated address, but none of them know the private key. If they agree on an output, the buyer sends the seller their private key and the seller can create a transaction crediting themselves, or if the seller wishes to return the money to the buyer, they can give them their private key. This approach has a few problems:

  • One can't be using the same private keys in multiple transactions, as they get shared with third parties
  • The person that will receive the second private key can dictate any division of money - nothing can stop them
  • There is no possibility of creating a 2-of-3 escrow

So all in all, use multisignature transactions.

ThePiachu
  • 42,931
  • 25
  • 138
  • 347
  • 2-on-2 multisig is fine, I'm satisfied for this file to never be opened, ever, in fact; but the problem becomes in the creation of the file. -How do we generate the keypair and stuff them inside the PGP wrapper without either user ever getting the chance to see the private key? – Dex Bitcoin May 31 '13 at 04:23
  • @DexBitcoin What is the point of the PGP? – ThePiachu May 31 '13 at 04:54
  • To make the wallet into an encrypted file that can change hands without allowing anyone to see the private key inside it. – Dex Bitcoin Jun 01 '13 at 04:29
  • 1
    @DexBitcoin With traditional encryption, the person encrypting the file would need to have known its content, so it's not useful for your problem. – ThePiachu Jun 01 '13 at 11:40
0

This can be done in general with fully homomorphic encryption. (It wouldn't be a "PGP file" per se but an encrypted message with the specific scheme.) It's not very practical currently though.

But it looks like what you are really trying to do is an arrangement where A and B each have a piece of information, without any of them having seen the other, so that both pieces are needed in order to spend specific bitcoins. In this case, ECDSA addition of keys will work, as will a multi-signature transaction.

Meni Rosenfeld
  • 19,650
  • 35
  • 70