Family and business wallets

Simple

A family or business wallet is a separate XRP wallet that a group shares, like a joint account. It comes from your same recovery phrase, so restoring your phrase brings it back. Create one in XRP tools, at the Expert level.

You choose who must agree before money leaves it: for example, two of three family members. One person asks to send, and the others approve on their own phones with their fingerprint or passcode.

A request can be shared as a message or QR code, swapped by Bluetooth when you're together, or posted for your co-signers to pick up in their own Kalda.

Co-signers only need Kalda with an XRP address; they don't need any XRP. The shared wallet can also hold and convert RLUSD, lock XRP and make scheduled payments, each with the group's approval.

Detailed

Multi-signing

The XRP Ledger lets an account attach a signer list: up to 32 other accounts, each with a weight, plus a quorum, the total weight needed. A transaction from that account is valid only if it carries signatures whose weights add up to the quorum. Signers don't need funded accounts of their own.

An account can also switch off its own key, so the signer list becomes the only way to spend. Then no single phone, not even the one that created the wallet, can move the funds alone. Changing the signer list, or switching the key back on, is itself a transaction that needs the quorum.

Approving

Each co-signer signs the very same transaction, and the signatures are combined. A signature covers every field, so an approval for one payment can't be reused for another, and nobody can change the amount or recipient once others have signed. Each transaction also has an expiry and a sequence number, so a request stops being valid once it expires or the wallet makes a different transaction first.

Requests can travel any way that's convenient: as text, as a QR code, over Bluetooth Low Energy between nearby phones, or through the XRP Ledger itself. Whatever the route, the ledger accepts the transaction only with enough valid signatures. Anything posted on the ledger is public and permanent.

Costs

Each extra signature adds a little to the network fee: a multi-signed transaction pays the base fee once for each signer plus one, still a fraction of a cent. The signer list holds one owner reserve (0.2 XRP) on top of the 1 XRP base reserve. Closing the wallet works like closing any XRP account: everything goes to another active account, and the network keeps 0.2 XRP.

In depth

Digital signatures

A digital signature proves that the holder of a private key approved one exact message. The signer combines a hash of the message with their private key; anyone with the public key can check the result but can't produce a new valid signature. Change a single bit of the message and the signature no longer verifies.

Weighted thresholds

A k-of-n scheme needs any k of n parties to agree. Weighted multi-signing generalises it: each signer i has a weight wᵢ, and a group S of signers is enough when:

Σ wᵢ  (i ∈ S)  ≥  quorum

With weights 2, 1 and 1 and a quorum of 2, the first person alone, or the other two together, can approve. Choosing weights and quorum trades safety (how many people would have to collude to steal) against availability (how many must be reachable to spend).

Multi-signing versus secret sharing

Multi-signing keeps every key separate and lets the network count the signatures, so who approved is visible on the ledger. Threshold signatures and Shamir secret sharing instead split one key, so the result looks like a single ordinary signature. Shamir hides a secret as the constant term of a random polynomial over a finite field: any k points on it recover the secret by interpolation, while k − 1 points reveal nothing.

Replay protection

Each XRP Ledger account has a sequence number. A transaction is valid only with the account's next number, and only until its expiry ledger, so a signed transaction can run at most once, and a pending approval goes stale as soon as the account moves on.