bitcoin/bips
1
0
Fork 0
mirror of https://github.com/bitcoin/bips.git synced 2026-10-19 19:29:18 +00:00
Code Issues Releases Wiki Activity

bip138: specify empty associated data

Browse Source 
Make the associated-data input explicit in the encryption and decryption
formulas and specify that it is empty, as used by the existing vectors.
This commit is contained in:
Sjors Provoost
2026-09-22 14:52:10 +02:00
committed by Murch
parent 7c7cb232c2
commit 0f8c26b7c2
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
bip-0138.md
View File

@@ -196,7 +196,9 @@ and integrity.[^chacha-default]
hardware acceleration, making it suitable for hardware wallets and embedded devices.
* let $nonce$ = random(96 bits)
* let $ciphertext$ = encrypt($payload$, $secret$, $nonce$)
* let $ciphertext$ = encrypt($payload$, $secret$, $nonce$, $aad$)
The additional authenticated data ($aad$) is empty.
The $nonce$ MUST NOT be all zero. If the random source yields an all-zero nonce,
the encoder MUST generate a new one.
@@ -210,7 +212,7 @@ computes:
* for each `individual_secret_i` generate `reconstructed_secret_i` =
`individual_secret_i` ⊕ `si`
* for each `reconstructed_secret_i` process $payload$ =
decrypt($ciphertext$, $secret$, $nonce$)
decrypt($ciphertext$, $secret$, $nonce$, $aad$)
Decryption will succeed if and only if **p** was one of the keys in the
descriptor/wallet policy.