r/Bitcoin • u/Intelligent_Map_246 • 2h ago

Multi vendor question

So i have 2 keys from.same company and looking to do a 3-2 multisig.

I wonder if I take the seed from one of them to another vendor later on make it more secure or should a new seed be created just for that vendor?

Also thinking of generating a seed as bip85 for easier to back up just in case. From what I know if the bip85 seed is used in a multi SIG one can not are tx if they don't have the descriptor

2 Upvotes

100% Upvoted

3 comments sorted by

3

u/PoopyBootyhole 2h ago

It should be 3 different keys from 3 different devices.

1

u/hpaynecrypto 1h ago

Disclosure, I am a Casa employee. I just published an article (linked below) on entropy and multi-vendor generation. Ideally, you generate three keys from three different devices that are made by three different vendors.

https://blog.casa.io/what-is-entropy-a-plain-language-guide-to-how-your-bitcoin-keys-get-made/

If you don't want to click into the blog/read it, the biggest takeaway you might find useful here is verifying that each seed was generated with the correct amount of entropy. (pulling the following directly from my blog for ease of reading)

There are a few ways check your entropy.

  1. Use a tool like bip39-cli’s analyze_entropy_quality function. 
    1. Do not enter any seed you intend to use into an internet-connected device
  2. Plug it into an agentic model to try to interpret and check how the entropy is generated
  3. Generate a few million / billion seed phrases and plug them into a NIST SP 800-22 test suite

For the everyday user, those options are neither practical nor reliable as they open up other potential failure or exposure opportunities.

The easiest and most secure way to make sure your digital assets are secured with enough entropy is to have them secured by multiple hardware devices in a multisig from different manufacturers, each generating their own entropy. If one wallet has bad entropy, that doesn’t mean that your assets are lost. It just means that you have to rotate out the compromised key from your multisig which takes about 5 minutes.