I'm trying to implement a protocol in which two parties generate a private/public keypair, where both know the public key, but each party has only one part of the private key and cannot derive the full private key without having the other part.

Can this be achieved by using existing distributed key generation protocols? I've found this, could the two parties retrieve a single private key corresponding to the shared public key with their combined shares?

  • $\begingroup$ What do you want to be able to do with the keys? Are you looking for public-key encryption? Public-key signature? Something else? Most of these distributed key generation problems are complicated and never implemented in practice; can you get by with just using two different keys, e.g. requiring a signature from both keys on a document? $\endgroup$ – Squeamish Ossifrage Aug 5 at 2:30
  • $\begingroup$ The goal is to generate a cryptocurrency address from which it is only possible to spend the funds when the two parties agree. I guess I could use a smart contract, but I'm trying to achieve it off-chain. $\endgroup$ – Joris Oudejans Aug 5 at 8:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.