Bitcoin’s BIP138 wallet-backup proposal was merged into the Bitcoin Enchancment Proposals repository on Sept. 21, however the specification stays Draft. It goals to protect data {that a} seed phrase might not restore in a posh pockets. The tradeoff is {that a} third get together may learn that data if it already holds an eligible prolonged public key, or xpub, and obtains a replica of the encrypted backup.
A multisignature pockets requires multiple signer. Its descriptor data the general public keys and spending guidelines that inform pockets software program how one can reconstruct the account and discover its cash. A seed phrase can regenerate one signer’s non-public keys, however shedding the descriptor can nonetheless go away a multisig or miniscript script unimaginable to reconstruct from that seed alone.
The proposal describes one other failure: a pockets designed to outlive the lack of one seed may lose that signer’s public key. The remaining signers can then lack a bit of the script wanted to get well the cash. These are dangers for wallets whose spending setup is determined by data past a seed, not a declare that each Bitcoin pockets wants this backup.
BIP138’s reply is an encrypted file holding descriptors, pockets insurance policies or different non-seed metadata. Personal key materials should be eliminated earlier than encryption. A holder of an eligible xpub from the backed-up pockets can decrypt a replica with out the pockets’s seed. That reveals public keys and script construction wanted for restoration, whereas the xpub alone doesn’t give the holder the non-public keys required to signal.
The draft units limits on who can decrypt. Public keys that seem straight in a script, and xpub roots that might be uncovered by spending, are excluded as restoration keys. If a cosigner’s secret is excluded, that particular person can not use it to open the file. These limits hold an on-chain public key from changing into a key to the off-chain backup.
The privateness warning issues an xpub disclosed earlier than the multisig pockets was made. If a wallet-service server already is aware of an account xpub and that very same xpub is reused as an eligible multisig key, the server may decrypt the backup if it will get a replica. It may study the pockets metadata inside, although this may not itself give it spending authority. The BIP describes a conditional publicity, not a reported breach.
A public Rust implementation with command-line construct directions exists. The BIP says Liana, a Bitcoin pockets, makes use of an earlier backup format that’s incompatible with the present BIP138 file. The proposal’s merge due to this fact establishes a broadcast draft, not a Bitcoin community change or a assure that at present’s wallets can create and restore this format.
