This is a very useful BIP, and I am very much looking forward to implementing it in Mycelium, in particular for bip32 wallets.
To me this is not about whether to use SSS instead of multisig transactions. In the end you want to protect a secret (be it a HD master seed or a private key) in such a way that you can recover it in case of partial theft/loss. Whether I'll use the master seed to generate keys that are going to be used for multisig transactions is another discussion IMO.
A few suggestions:
- I think it is very useful to define different prefixes for testnet keys/seeds. As a developer I use the testnet every day, and many of our users use it for trying out new functionality. Mixing up keys meant for testnet and mainnet is bad.
- Please allow M=1. From a usability point of view it makes sense to allow the user to select 1 share if that is what he wants.
I have no strong opinions of whether to use GF(2^8) over Shamir's Secret Sharing, but the simplicity of GF(2^8) is appealing.
- Jan