From 0f8c26b7c20bab5a58f098ac81f1bb86974c5934 Mon Sep 17 00:00:00 2001 From: Sjors Provoost Date: Tue, 22 Sep 2026 14:52:10 +0200 Subject: [PATCH] bip138: specify empty associated data Make the associated-data input explicit in the encryption and decryption formulas and specify that it is empty, as used by the existing vectors. --- bip-0138.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/bip-0138.md b/bip-0138.md index 90ae803e..d5b2ab5a 100644 --- a/bip-0138.md +++ b/bip-0138.md @@ -196,7 +196,9 @@ and integrity.[^chacha-default] hardware acceleration, making it suitable for hardware wallets and embedded devices. * let $nonce$ = random(96 bits) -* let $ciphertext$ = encrypt($payload$, $secret$, $nonce$) +* let $ciphertext$ = encrypt($payload$, $secret$, $nonce$, $aad$) + +The additional authenticated data ($aad$) is empty. The $nonce$ MUST NOT be all zero. If the random source yields an all-zero nonce, the encoder MUST generate a new one. @@ -210,7 +212,7 @@ computes: * for each `individual_secret_i` generate `reconstructed_secret_i` = `individual_secret_i` ⊕ `si` * for each `reconstructed_secret_i` process $payload$ = -decrypt($ciphertext$, $secret$, $nonce$) +decrypt($ciphertext$, $secret$, $nonce$, $aad$) Decryption will succeed if and only if **p** was one of the keys in the descriptor/wallet policy.