diff --git a/bip-0138.md b/bip-0138.md
index 8c84f8de..0c036146 100644
--- a/bip-0138.md
+++ b/bip-0138.md
@@ -276,6 +276,12 @@ The `INDIVIDUAL_SECRETS` section follows this format:
 Note: the individual secrets vector should not contain duplicates. Implementations
 MAY deduplicate secrets during encoding or parsing.
 
+Encoders SHOULD append random decoy `INDIVIDUAL_SECRET` entries to hide the exact
+number of real decryption keys. The total count SHOULD be rounded up to the
+smallest bucket greater than or equal to the real count, starting at 5 and doubling
+for each following bucket: 5, 10, 20, and so on. Decoders do not distinguish real
+entries from decoys; they try each entry until one decrypts the payload.
+
 #### Encryption
 
 `ENCRYPTION`: 1-byte unsigned integer identifying the encryption algorithm.