Bech32 weakness and impact on bip-taproot addresses



Summary:

The Bitcoin development community is discussing the modification of the Bech32 SegWit address format for version 1 and above. The proposed change would involve length prefixing the witness program, with one byte dedicated to the witness version. If the witness version is non-zero, an additional byte would represent the length of the witness program. The witness program would then be converted to base32 and translated into characters using a table. With 17 different segwit versions and 32 characters in the bech32 alphabet, there are 15 unused characters that can be assigned new meanings.To avoid potential issues with older software mis-sending modified v1 addresses to the wrong witness program, it may be sensible to define a new human-readable-prefix for length prefixed bitcoin witness programs. One suggestion is "btc1". Alternatively, the current version 0 address format could be used indefinitely, with the requirement that SegWit vN (N >= 1) output witness programs adhere to the data-part value encoded as follows: legacy witness version, which must always be 0; actual witness version, which must be non-zero; padding length of 0 or 1; and witness program length followed by the variable-length witness program.A potential proposal involving padding bytes was deemed ridiculous by ZmnSCPxj, who initiated the discussion on the mailing list.


Updated on: 2023-06-13T22:06:52.529165+00:00