bitcoin/bips
1
0
Fork 0
mirror of https://github.com/bitcoin/bips.git synced 2026-10-19 19:29:18 +00:00
Code Issues Releases Wiki Activity

bip138: address review

Browse Source
This commit is contained in:
pythcoiner
2026-08-07 09:32:01 -04:00
parent 65b4c38a02
commit 0fbc187b99
1 changed files with 20 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

27
bip-0138.md
View File

@@ -112,15 +112,28 @@ hash construction from [BIP340](bip-0340.mediawiki#design).
Because $s$ and $s_i$ use distinct domain-separation tags, $s \neq s_i$ and
therefore $c_i$ is never the all-zero string.
**Note:** To prevent attackers from decrypting the backup using publicly known
keys, explicitly exclude any public keys with x coordinate
Keys published on chain are already kept out of $\{p_1, \dots, p_n\}$ by the
[Descriptor key requirements](#descriptor-key-requirements).
Implementations MUST exclude the key with x coordinate
`50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0` (the BIP341 NUMS
point, used as a taproot internal key in some applications). Additionally, exclude any
other publicly known keys.
point). Applications MAY exclude any further key they know to be public.
Applications that exclude additional keys SHOULD document this, although decryption
using these keys will simply fail. This does not affect decryption with the remaining
keys.
Applications that exclude keys beyond the NUMS point SHOULD document which keys they
exclude, so that users know which keys cannot open the backup. A cosigner holding an
excluded key will simply fail to decrypt, while the cosigners holding the keys that
remain in $\{p_1, \dots, p_n\}$ can still decrypt the backup.
**Note:** A key is *publicly known* when a third party can learn it without the wallet
owner disclosing it. There is no registry of such keys. In practice they come from two
sources: the blockchain, and well-known constants.
**Warning:** An xpub can be known to a third party without ever appearing on chain.
Some single-signature wallets, such as the Ledger and Trezor desktop apps, send the
BIP44/49/84/86 account xpub to a server, the server then derive every key from
that xpub. For a single-signature descriptor this leaks little the server does not
already know, but reusing such an xpub as a key of a multisig descriptor lets that
server decrypt every backup of the multisig. Users SHOULD build a multisig from
accounts whose xpub was never sent to such a server.
### Descriptor key requirements