What is the safest physical to store a private key only to be accessed after death?

Assume that my friend would like to encrypt his Bitcoin private key(s) and safely store them in a secret location. This located would only be identified to heirs after death in his will. Should he put the key:

In a safety deposit box
Buried in a weatherrpoof container somewhere on my property?
In the possession of my attorney?
Somewhere else

Please answer the same question above for my encryption key which I would of course store separately.

As an alternative would a mult-sig solution be helpful? If so how would you design it?

Imagin Ation

Posted 2016-05-27T16:32:02.603

Reputation: 337

Why would your friend put his key on your property or in possession of your attorney, not his own? – Tin Man – 2016-05-27T21:17:03.450

Simple: get a programmable pacemaker, and program it to stop when any of your Bitcoins are taken. That way, any use of your Bitcoins will be after your death. – Nick ODell – 2016-05-27T21:47:16.437

Note: the correct answer to these questions is substantially dependent on the threat model of who is trying to take the bitcoins. A safety deposit box is useless to protect the coins against a government that can legally compel the bank to hand over the contents of the box. – Cort Ammon - Reinstate Monica – 2016-05-28T03:53:22.763

Answers

If you are comfortable with a command line, I have used ssss-split and ssss-combine for sharding encryption keys in a n-of-m scheme. These utilities use Shamir's Secret Sharing Scheme to safely break up secrets for later reassembly.

For example, you could create a 4-of-7 scheme, where you would hide shards in 7 different locations (personal safe, safety deposit box, trusted lawyer, etc...). Any 4 shards could be used to re-create the original secret. It has the property where only having 3 shards gives an attacker no more chance of cracking the secret than if they had 0 shards.

One benefit to this scheme is that up to 3 shards could be lost, and the original secret could still be recovered. The other benefit is that up to 3 shards could be stolen, and the attacker still doesn't have enough to obtain the secret.

One important thing to note, however, is that you still need to make sure that the collection of private keys is not lost, even if it is encrypted. BIP32 wallets are a great place to start (so you only need to shard a single key), but otherwise make sure that you have redundant copies of your encrypted wallet file. The decryption key won't be any use if you lose the data that it decrypts. Again, avoid that trouble by using a BIP32 wallet.

Jestin

Posted 2016-05-27T16:32:02.603

Reputation: 8 339

Armory has a key sharding feature that may be very useful. First, you generate a wallet, then you fund the wallet with what you want to leave to your heirs, then you generate an m of n backup. So, for example, you can generate 7 shards to the 7 people that you're leaving money to. The m would be the number of people that need to agree in order to restore the wallet. A simple majority or super-majority will be good. In our case, 5 or 6. That way, a single person can't hold the funds hostage and a small majority can't just take everything.

There are other alternatives, but this is the most flexible since you can add funds to the wallet by using the watching-only feature later on without having to compromise security or privacy.

Jimmy Song

Posted 2016-05-27T16:32:02.603

Reputation: 7 067

Should point out that much of the information here overlaps a previous answer. Anyhow...

Use BIP 38 to encode the private keys and save the paper wallet among the heirs in advance of a death. Don't share the public address for the BIP 38 wallets. This blinds heirs to the value of the coins they will eventually inherit. Be sure to have instructions for heirs to no loose the information (i.e. BIP 38 wallets and associated SSSS snippets) distributed to them in advance.

Use Shamir's Shared Secret Scheme (SSSS) to spread the password for the BIP 38 encoded wallets. Mechanism like sealed wills and sharing limited SSSS secrets with heirs in advance can be used to bring enough shared secrets together upon a death to reconstitute passwords to decode BIP 38 wallets.

Each heir can have their own unique BIP 38 wallet and all inheritance BIP 38 wallets can share a common password.

skaht

Posted 2016-05-27T16:32:02.603

Reputation: 2 588