Multisig (мультиподпись)

Введение

Multisig (multisignature) — криптографическая и протокольная конструкция, при которой трата средств с общего адреса требует M подписей из N уникальных ключей (обозначение M-of-N). В Bitcoin multisig реализован через script OP_CHECKMULTISIG и с SegWit — через P2WSH/P2SH wrapped scripts. Ethereum использует smart contract wallets (Gnosis Safe и аналоги) с логикой threshold signatures off-chain или on-chain.

Multisig фундаментален для corporate treasury, escrow без custodian, family inheritance planning и снижения single point of failure при хранении crypto assets.

Принцип работы

При создании 2-of-3 multisig генерируются три key pairs. Derivation адреса включает public keys всех участников и threshold M. Transaction создаётся с inputs referencing multisig UTXO; каждый participant подписывает своим private key partial signature; wallet/coordinator aggregates до достижения M valid signatures, затем broadcast.

Partially signed Bitcoin transactions (PSBT, BIP 174) стандартизируют обмен unsigned tx между air-gapped signers и online coordinator — critical workflow для hardware wallets.

Применения

Escrow и P2P

Покупатель, продавец, арбитр — классика 2-of-3. Две согласные стороны release funds без арбитра. Спор — арбитр + одна сторона.

Corporate governance

CFO не может alone drain treasury; требуется CEO + CFO или board quorum. Audit trail on-chain показывает which keys signed.

Personal security

2-of-2: phone + hardware wallet — attacker needs both. 2-of-3 with offline backup key в банковской ячейке — recovery при потере одного device.

Сравнение с Shamir Secret Sharing (SSS)

SSS splits один private key на shares; M shares reconstruct single key — single signature on-chain, не видно threshold on-chain. Multisig — distinct keys, on-chain visible M-of-N policy. SSS лучше для hiding policy; multisig лучше для accountability и no single reconstructed key on one machine.

Риски и operational challenges

Key ceremony: генерация ключей должна быть independent; если один attacker generates all three — game over. Use separate hardware, separate locations.

Coordinator trust: software assembling PSBT может substitute recipient address — verify on each hardware screen.

Arbiter collusion: 2-of-3 useless if arbiter pre-agreed with counterparty.

Blockchain fees: multisig txs larger, higher fees. Taproot может offer privacy и size benefits через MuSig aggregated signatures в некоторых setups.

Recovery: потеря > N-M keys = permanent loss. Document which key where; test small spend annually.

Multisig в разных сетях

Bitcoin: native, mature tooling (Electrum multisig, Coldcard, Keystone). Monero: multisig experimental/complex, fewer consumer wallets. Ethereum: smart contract wallets dominant over native ECDSA multisig on EOA.

Taproot и MuSig — современная эволюция

Bitcoin Taproot (BIP 341) позволяет multisig transactions выглядеть как single-signature on-chain при использовании MuSig2 aggregated signatures — улучшение privacy и снижение fees. Legacy multisig visibly distinct in explorer — fingerprint «this is treasury». Taproot scripts скрывают complexity за single pubkey output until spend.

Migration с legacy multisig на Taproot требует нового адреса и transfer funds — plan downtime и fee budget.

Институциональные решения

Fireblocks, BitGo, Casa — custodial и semi-custodial multisig products для enterprises с policy engine (velocity limits, IP allowlist, role-based approval). Trade-off: convenience vs full self-custody. Understand где private keys physically reside и under what jurisdiction subpoena applies.

Тестирование и runbooks

Документируйте runbook: кто holder каждого key, порядок contact при spend request, maximum response time, escalation если one signer unavailable. Ежегодный fire drill: small test spend involving all parties. Update runbook при personnel change — stale contact = funds locked until enough keys recovered.

Ошибки конфигурации

Identical xpub derivation paths across cosigners без independent generation. Single backup sheet с всеми seeds в одном месте — defeats multisig purpose. Arbiter key stored on same machine as buyer — collusion trivial. Wrong M-of-N parameter in wallet software — verify before deposit.

Связанные термины

Escrow — primary use case. Cold wallet — offline key holder in multisig set. Seed phrase — backup per participant, not shared single phrase for multisig.

Insurance и custody products

Some providers offer multisig with insurance layer — read fine print: events covered (theft vs user error vs key loss). Insurance не replaces proper key ceremony; premiums reflect risk pool assumptions about customer OPSEC quality.

При corporate multisig legal agreements должны specify signing authority: кто authorized initiate tx, SLA response, и что происходит при death или incapacity signer. Smart contracts могут automate timelock release, но human policy documents still required for disputes outside chain scope.

Bitcoin Core, Electrum, Sparrow, Specter — различная поддержка multisig workflows; evaluate PSBT compatibility перед выбором stack. Training всех signers на одном software stack reduces operational errors during time-critical spends.

Threshold signatures research (FROST, etc.) may simplify on-chain footprint в future — follow BIPs но не migrate production funds to experimental schemes без extensive audit.

Document xpubs каждого cosigner in secure vault — recovery при partial key loss requires knowing which extended public keys participated in wallet descriptor.

Заключение

Multisig transforms cryptocurrency from «whoever has key owns coins» to «organizational control with cryptographic enforcement». Complexity rises — key ceremonies, PSBT workflows, arbiter selection — но для any non-trivial sum held long-term multisig should be default consideration. Understand M-of-N math, test recovery, and never trust single coordinator screen without independent verification.