Bitcoin’s BIP138 wallet-backup proposal was merged into the Bitcoin Enchancment Proposals repository on Sept. 21, however the specification stays Draft. It goals to protect info {that a} seed phrase could not restore in a fancy pockets. The tradeoff is {that a} third social gathering might learn that info if it already holds an eligible prolonged public key, or xpub, and obtains a duplicate of the encrypted backup.
A multisignature pockets requires multiple signer. Its descriptor information the general public keys and spending guidelines that inform pockets software program find out how to reconstruct the account and discover its cash. A seed phrase can regenerate one signer’s non-public keys, however shedding the descriptor can nonetheless go away a multisig or miniscript script inconceivable to reconstruct from that seed alone.
The proposal describes one other failure: a pockets designed to outlive the lack of one seed might also lose that signer’s public key. The remaining signers can then lack a chunk of the script wanted to recuperate the cash. These are dangers for wallets whose spending setup will depend on info past a seed, not a declare that each Bitcoin pockets wants this backup.
BIP138’s reply is an encrypted file holding descriptors, pockets insurance policies or different non-seed metadata. Personal key materials have to be eliminated earlier than encryption. A holder of an eligible xpub from the backed-up pockets can decrypt a duplicate with out the pockets’s seed. That reveals public keys and script construction wanted for restoration, whereas the xpub alone doesn’t give the holder the non-public keys required to signal.
The draft units limits on who can decrypt. Public keys that seem immediately in a script, and xpub roots that could possibly be uncovered by spending, are excluded as restoration keys. If a cosigner’s secret is excluded, that individual can’t use it to open the file. These limits maintain an on-chain public key from turning into a key to the off-chain backup.
The privateness warning considerations an xpub disclosed earlier than the multisig pockets was made. If a wallet-service server already is aware of an account xpub and that very same xpub is reused as an eligible multisig key, the server might decrypt the backup if it will get a duplicate. It might study the pockets metadata inside, although this could not itself give it spending authority. The BIP describes a conditional publicity, not a reported breach.
A public Rust implementation with command-line construct directions exists. The BIP says Liana, a Bitcoin pockets, makes use of an earlier backup format that’s incompatible with the present BIP138 file. The proposal’s merge subsequently establishes a broadcast draft, not a Bitcoin community change or a assure that at this time’s wallets can create and restore this format.
