Since 977300d timestamps.json is a single JSON object whose children are
nested recursively in extensions arrays, with valid and comment only on the
leaves, but the README still described a flat array of objects with a
header_chain entry.
The example says the skipped hashes are 0x00..., 0x66... and 0x22...,
and traversal-example.dot has 0x22... as the SKIP branch of D, but the
base64 proof ended with 32 bytes of 0x44, which is one of the VERIFY
hashes. Re-encode the proof with 0x22... as the last hash. The length
(101 bytes) and the tree serialization are unchanged.
bip-0375/deps/dleq.py is adapted from the BIP-374 reference code but
predates the change that treats the challenge e as a scalar (#2262).
Reduce the challenge hash mod n and reject proofs with e >= n, so the
copy used by the BIP-375 validator matches the current BIP-374
reference.
A root selected through a derived xpub can also appear bare or as a
literal key. Once a spend reveals it, anyone could decrypt the backup.
Exclude such cases.
MuSig aggregation hides participant keys, so account xpubs do not need
individual trailing derivation.
Specify that encryption uses participant roots rather than the aggregate key.
Add MuSig2 test vectors: one for a bare aggregate and one for aggregate
derivation.
Rename keys_types.json to recipient_keys.json and generalize the format
to support multiple descriptors and multiple recipient keys:
- "key": a single key-expression string becomes "descriptors": an array
of complete descriptor strings.
- "expected": an x-only key string becomes "expected_keys": an array
containing that key; null remains null.
Convert the nine existing cases by wrapping each key expression in tr(),
except the uncompressed literal uses pk(), since tr() does not accept it.
Each case has one descriptor.
Specify that parsing stops immediately. Add a vector with an item followed
by a terminator and ignored bytes.
Clarify that TYPE 0x00 also doesn't require TYPE_LENGTH.
The six taproot input fields say "Finalizers should remove this field
after PSBT_IN_FINAL_SCRIPTWITNESS is constructed", and so does the
output field PSBT_OUT_TAP_BIP32_DERIVATION. An output has no
PSBT_IN_FINAL_SCRIPTWITNESS, the clause names no input, and its two
neighbours in the output table carry no such clause. Drop it; Bitcoin
Core does not clear output fields on finalization.
BIP 174 tells the Input Finalizer to clear all other data except the
UTXO and unknown fields from a finalized input. It was written when the
unsigned transaction was a global field. PSBTv2 moves the data that
defines the input into the input map, and a finalizer that follows the
sentence literally removes it: without PSBT_IN_PREVIOUS_TXID or
PSBT_IN_OUTPUT_INDEX the result is invalid, and without
PSBT_IN_SEQUENCE and the locktime fields the Transaction Extractor
builds a different transaction.
BIP 370 amends Creator, Updater, Signer and Transaction Extractor for
PSBTv2, adds the Constructor, and says nothing about the Input
Finalizer. Add the section: the five fields are kept. Bitcoin Core
does this today: at 19b0ff2fa0, PSBTInput::Serialize in src/psbt.h
writes them for every PSBTv2 input, finalized or not.
Record this branch's clarifications and test vectors under draft document
version 0.1.1. Keep the initial-publication entry in the shared first commit.
Make change_descriptor explicitly optional for non-multipath descriptors.
Add a receive-only document vector with no change descriptor or optional
metadata; the existing vectors cover a receive/change pair and multipath.
create_outputs and scanning declare expected with a default of None but
dereference it unconditionally (expected.get(...)), so calling either
without it raises AttributeError, although the parameter is documented
optional. Guard the expected-value checks with `if expected is not None:`.
The self-test, which always passes expected, is unaffected.
