Bech32 weakness and impact on bip-taproot addresses



Summary:

On the Bitcoin development mailing list, Russell O'Connor proposed amending BIP173 to restrict "bc" and "tb" segwit address formats to require witness programs of size 20, 23, 26, 29, 32, 36, or 40. Witness programs of other sizes between 2 and 40 would still be legal in accordance with BIP141 but would be unaddressable using these prefixes. The proposal comes after reviewing a gist by Pieter Wuille regarding the detection of insertion errors, which showed that insertions of five characters or more are safe. Therefore, witness programs of lengths 20, 23, 26, 29, 32, 36, and 40 (or 39) could safely be allowed. These correspond to Bech32 addresses of length 42, 47, 52, 57, 62, 68, and 74 (or 73). Shorter addresses were deemed to have insufficient entropy to secure anything and may be excluded from the segwit address format. The maximum witness program size allowed by BIP 141 is 40 bytes, so it is sensible to choose to allow 40-byte witness programs to be addressable. Another address format would be needed to support other witness sizes if the need ever arises.


Updated on: 2023-06-13T22:08:14.623000+00:00