bitcoin/bips
1
0
Fork 0
mirror of https://github.com/bitcoin/bips.git synced 2026-10-19 19:29:18 +00:00
Code Issues Releases Wiki Activity

bip138: exclude roots exposed by another expression

Browse Source 
A root selected through a derived xpub can also appear bare or as a
literal key. Once a spend reveals it, anyone could decrypt the backup.
Exclude such cases.
This commit is contained in:
Sjors Provoost
2026-09-22 14:52:10 +02:00
committed by Murch
parent bde776ecb8
commit 299442b7de
2 changed files with 34 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
bip-0138.md
View File

@@ -114,8 +114,8 @@ hash construction from [BIP340](bip-0340.mediawiki#design).
Because $s$ and $s_i$ use distinct domain-separation tags, $s \neq s_i$ and Because $s$ and $s_i$ use distinct domain-separation tags, $s \neq s_i$ and
therefore $c_i$ is never the all-zero string. therefore $c_i$ is never the all-zero string.
Keys published on chain are already kept out of $\{p_1, \dots, p_n\}$ by the The [Descriptor key requirements](#descriptor-key-requirements) exclude
[Descriptor key requirements](#descriptor-key-requirements). keys exposed by literal or bare-xpub expressions in the backed-up scripts.
Implementations MUST exclude the key with x coordinate Implementations MUST exclude the key with x coordinate
`50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0` (the BIP341 NUMS `50929b74c1a04954b78b4b6035e97a5e078a5a0f28ec96d547bfee9ace803ac0` (the BIP341 NUMS
point). Applications MAY exclude any further key they know to be public. point). Applications MAY exclude any further key they know to be public.
@@ -172,14 +172,19 @@ does not reveal the individual participant keys. For encryption, use each
participant's xpub root rather than the aggregate key. Literal public-key participant's xpub root rather than the aggregate key. Literal public-key
participants remain excluded. participants remain excluded.
A candidate root MUST be excluded if its x-coordinate matches a literal key
or a bare xpub root used outside `musig()` in any descriptor or resolved
policy in the payload. For example,
`wsh(or_i(pk(X/0/*),pk(X)))` exposes the root of xpub `X` on spending, so that
root must be excluded even though `X/0/*` is otherwise eligible.
Implementations: Implementations:
- MUST exclude every other form (literal pubkeys, bare xpubs outside `musig()`, - MUST exclude every other form (literal pubkeys, bare xpubs outside `musig()`,
...) from $\{p_1, \dots, p_n\}$. ...) from $\{p_1, \dots, p_n\}$.
- MUST refuse to encode a backup if the resulting set is empty. - MUST refuse to encode a backup if the resulting set is empty.
- MUST make the user aware of each excluded expression, since the - MUST make the user aware of each excluded expression and candidate root,
cosigner holding that key will be unable to decrypt the backup with since its holder may be unable to decrypt the backup with that key.
their key.
### Key Normalization ### Key Normalization

24
bip-0138/test_vectors/recipient_keys.json
View File

@@ -103,5 +103,29 @@
"8b42cd4776376c82791b494155151f56c2d7b471e0c7a526a7ce60dd872e3867", "8b42cd4776376c82791b494155151f56c2d7b471e0c7a526a7ce60dd872e3867",
"ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b51708" "ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b51708"
] ]
},
{
"description": "Root used both bare and derived is excluded",
"descriptors": [
"wsh(or_i(pk(tpubDEPBvXvhta3pjVaKokqC3eeMQnszj9ehFaA2zD5nSdkaccwGAizu8jVB2NeSpvmP2P52MBoZvNCixqXRJnTyXx51FQzARR63tjxQSyP3Btw/0/*),pk(tpubDEPBvXvhta3pjVaKokqC3eeMQnszj9ehFaA2zD5nSdkaccwGAizu8jVB2NeSpvmP2P52MBoZvNCixqXRJnTyXx51FQzARR63tjxQSyP3Btw)))"
],
"expected_keys": null
},
{
"description": "Xpub root (03ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b51708) excluded by an opposite-parity literal in another descriptor set",
"descriptors": [
"tr(tpubDEPBvXvhta3pjVaKokqC3eeMQnszj9ehFaA2zD5nSdkaccwGAizu8jVB2NeSpvmP2P52MBoZvNCixqXRJnTyXx51FQzARR63tjxQSyP3Btw/*)",
"wpkh(02ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b51708)"
],
"expected_keys": null
},
{
"description": "MuSig participant exposed in a script leaf",
"descriptors": [
"tr(musig(tpubDC5FSnBiZDMmhiuCmWAYsLwgLYrrT9rAqvTySfuCCrgsWz8wxMXUS9Tb9iVMvcRbvFcAHGkMD5Kx8koh4GquNGNTfohfk7pgjhaPCdXpoba,tpubDEPBvXvhta3pjVaKokqC3eeMQnszj9ehFaA2zD5nSdkaccwGAizu8jVB2NeSpvmP2P52MBoZvNCixqXRJnTyXx51FQzARR63tjxQSyP3Btw)/0/*,pk(tpubDC5FSnBiZDMmhiuCmWAYsLwgLYrrT9rAqvTySfuCCrgsWz8wxMXUS9Tb9iVMvcRbvFcAHGkMD5Kx8koh4GquNGNTfohfk7pgjhaPCdXpoba))"
],
"expected_keys": [
"ebd252ca0877aae09b9d058219682775aa3cbcd049c12f07832f2cf6a3b51708"
]
} }
] ]