path: root/8f/f1cb1e787e7c205b7d247afbf08c981d2a4e80

Return-Path: <roconnor@blockstream.com>
Received: from smtp4.osuosl.org (smtp4.osuosl.org [IPv6:2605:bc80:3010::137])
 by lists.linuxfoundation.org (Postfix) with ESMTP id 62B6AC002B
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Thu, 16 Feb 2023 02:16:19 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
 by smtp4.osuosl.org (Postfix) with ESMTP id 2F7E941802
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Thu, 16 Feb 2023 02:16:19 +0000 (UTC)
DKIM-Filter: OpenDKIM Filter v2.11.0 smtp4.osuosl.org 2F7E941802
Authentication-Results: smtp4.osuosl.org;
 dkim=pass (2048-bit key) header.d=blockstream-com.20210112.gappssmtp.com
 header.i=@blockstream-com.20210112.gappssmtp.com header.a=rsa-sha256
 header.s=20210112 header.b=jSK9pPjA
X-Virus-Scanned: amavisd-new at osuosl.org
X-Spam-Flag: NO
X-Spam-Score: -0.4
X-Spam-Level: 
X-Spam-Status: No, score=-0.4 tagged_above=-999 required=5
 tests=[BAYES_00=-1.9, BITCOIN_SPAM_03=1, DKIM_SIGNED=0.1,
 DKIM_VALID=-0.1, HTML_MESSAGE=0.001, PDS_BTC_ID=0.499,
 RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001]
 autolearn=no autolearn_force=no
Received: from smtp4.osuosl.org ([127.0.0.1])
 by localhost (smtp4.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)
 with ESMTP id GHevLBdeqX-O
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Thu, 16 Feb 2023 02:16:15 +0000 (UTC)
X-Greylist: whitelisted by SQLgrey-1.8.0
DKIM-Filter: OpenDKIM Filter v2.11.0 smtp4.osuosl.org 5B2E641800
Received: from mail-pf1-x433.google.com (mail-pf1-x433.google.com
 [IPv6:2607:f8b0:4864:20::433])
 by smtp4.osuosl.org (Postfix) with ESMTPS id 5B2E641800
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Thu, 16 Feb 2023 02:16:15 +0000 (UTC)
Received: by mail-pf1-x433.google.com with SMTP id n2so543348pfo.3
 for <bitcoin-dev@lists.linuxfoundation.org>;
 Wed, 15 Feb 2023 18:16:15 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=blockstream-com.20210112.gappssmtp.com; s=20210112;
 h=to:subject:message-id:date:from:mime-version:from:to:cc:subject
 :date:message-id:reply-to;
 bh=ATHjnKD8GUmlQ5ywMngKqp7JK6+VwO9R93PxbWXuZUM=;
 b=jSK9pPjAf5KMr50PqTZLK0q4Pc9ZY0zqSgz+ucx/M4cTuqZT7Y0OWx2nEnjQZABB0x
 BkPGr8sD5f0BiyxYHdDXI7q1O2+oql67X2NgPCE90V0lK1vhXUehPiwIornYbdfNq1/j
 PT49tIa3xkY7mZe+vIoxnB6/hXYzHAF8nf9IKyB+ZlBo1j6CDB3Rdh3lhZ/g0JJSN6ey
 pJPGvE3JbZz3rrA0NpGOjU5QqZCZa9TpVLnItQNbHVqyIRnetP5yTs27qBUbN7q/wNVx
 X1dOHeEWTf9MQrqMN7vBpQEPFDj1Cr9+L4VC0higRxOPQy1ZAZvlONw/bs0vkFxVSoid
 QXTA==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
 d=1e100.net; s=20210112;
 h=to:subject:message-id:date:from:mime-version:x-gm-message-state
 :from:to:cc:subject:date:message-id:reply-to;
 bh=ATHjnKD8GUmlQ5ywMngKqp7JK6+VwO9R93PxbWXuZUM=;
 b=j+3IJX0vt+RZcLxKZw4KQMk4697bkkb0l7pZ0NvrWCWW3Ce+XudDupSHYbPEFfRXZ1
 WPr4p64RSRLU1rIDdtLUKJaTBT8WhDAH0X9MKASGC9DfGQexyvRF8w7ZHHPiZDwr/7Tu
 cPs8+k0M2SH7ybUXbAKQXD0ttLXrgghV0biItQ07STvNKN38lN4CTPuxgFN2nmUd1REA
 ouO7HysDnM4nnAEgLPYrVEsguBNFkqO43S2UtTtHjFuEktHX1YbSoudf16d2v3TyzbHx
 rmMBpWsLCC2ZnBrgywDdazZ6fprMa19RB7t5qju0gCA9qrHoVu5a7LzZX5L0s+4qXp/I
 4q5g==
X-Gm-Message-State: AO0yUKXt9g1kYUTDzfEN3Bew/vrVZisiq1jt+sbMONAjrmuiNi6jr5za
 Jc+f2xqSz1+cmIhROJ2J1YGlsc+jN9ZqjEhh+mQOxjcqEsWhOpbG
X-Google-Smtp-Source: AK7set984LFGFlAR5pbcSz+U1Qg4oJAw1aWpNTqGogC2d4h1yrF+zigkGy0lXK4hf1AJvL12V0gQOLxydQ8dmXqC50k=
X-Received: by 2002:a63:3684:0:b0:4fb:5f4b:f5cf with SMTP id
 d126-20020a633684000000b004fb5f4bf5cfmr643824pga.3.1676513773445; Wed, 15 Feb
 2023 18:16:13 -0800 (PST)
MIME-Version: 1.0
From: "Russell O'Connor" <roconnor@blockstream.com>
Date: Wed, 15 Feb 2023 21:16:02 -0500
Message-ID: <CAMZUoKmiwXW50F2onqNUZO8HXQa4+Z=z3s3WyN7-rAMV=KiSgw@mail.gmail.com>
To: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="000000000000ed832605f4c7c775"
X-Mailman-Approved-At: Thu, 16 Feb 2023 08:30:24 +0000
Subject: [bitcoin-dev] Codex32
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>, 
 <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>, 
 <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Thu, 16 Feb 2023 02:16:19 -0000

--000000000000ed832605f4c7c775
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

I've been asked by Dr. Curr and Professor Snead to forward this message to
this mailing list, as it may be of general interest to Bitcoin users.

Dear Colleague:

In 1967, during excavation for the construction of a new shopping center in
Monroeville, Pennsylvania, workers uncovered a vault containing a cache of
ancient scrolls[1].  Most were severely damaged, but those that could be
recovered confirmed the existence of a secret society long suspected to
have
been active in the region around the year 200 BC.

Based on a translation of these documents, we now know that the society,
the
Cult of the Bound Variable, was devoted to the careful study of
computation,
over two millennia before the invention of the digital computer.

While the Monroeville scrolls make reference to computing machines made of
sandstone, most researchers believed this to be a poetic metaphor and that
the
"computers" were in fact the initiates themselves, carrying out the
unimaginably tedious steps of their computations with reed pens on
parchment.

Within the vault, a collection of sandstone wheels marked in a language
consisting of 32 glyphs was found. After 15 years of study, we have
successfully
completed the translation of what is known as "Codex32," a document that
describes the functions of the wheels. It was discovered that the wheels
operate
a system of cryptographic computations that was used by cult members to
safeguard their most valuable secrets.

The Codex32 system allows secrets to be carved into multiple tablets and
scattered to the far corners of the earth. When a sufficient number of
tablets are
brought together the stone wheels are manipulated in a manner to recover th=
e
secrets. This finding may be of particular interest to the Bitcoin
community.

Below we provide a summary of the cult's secret sharing system, which is
graciously hosted at
<
https://github.com/apoelstra/bips/blob/2023-02--volvelles/bip-0000.mediawik=
i
>.
We are requesting a record assignment in the Bibliography of Immemorial
Philosophy (BIP) repository.

Thank you for your consideration.

Dr. Leon O. Curr and Professor Pearlwort Snead
Department of Archaeocryptography
Harry Q. Bovik Institute for the Advancement

[1] http://www.boundvariable.org/task.shtml

-----BEGIN BIP-----

<pre>
  BIP: ????
  Layer: Applications
  Title: codex32
  Author: Leon Olsson Curr and Pearlwort Sneed <pearlwort@wpsoftware.net>
  Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-????
  Status: Draft
  Type: ????
  Created: 2023-02-13
  License: BSD-3-Clause
  Post-History: FIXME
</pre>

=3D=3DIntroduction=3D=3D

=3D=3D=3DAbstract=3D=3D=3D

This document describes a standard for backing up and restoring the master
seed of a
[https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki BIP-0032]
hierarchical deterministic wallet, using Shamir's secret sharing.
It includes an encoding format, a BCH error-correcting checksum, and
algorithms for share generation and secret recovery.
Secret data can be split into up to 31 shares.
A minimum threshold of shares, which can be between 1 and 9, is needed to
recover the secret, whereas without sufficient shares, no information about
the secret is recoverable.

=3D=3D=3DCopyright=3D=3D=3D

This document is licensed under the 3-clause BSD license.

=3D=3D=3DMotivation=3D=3D=3D

BIP-0032 master seed data is the source entropy used to derive all private
keys in an HD wallet.
Safely storing this secret data is the hardest and most important part of
self-custody.
However, there is a tension between security, which demands limiting the
number of backups, and resilience, which demands widely replicated backups.
Encrypting the seed does not change this fundamental tradeoff, since it
leaves essentially the same problem of how to back up the encryption key(s)=
.

To allow users freedom to make this tradeoff, we use Shamir's secret
sharing, which guarantees that any number of shares less than the threshold
leaks no information about the secret.
This approach allows increasing safety by widely distributing the generated
shares, while also providing security against the compromise of one or more
shares (as long as fewer than the threshold have been compromised).

[https://github.com/satoshilabs/slips/blob/master/slip-0039.md SLIP-0039]
has essentially the same motivations as this standard.
However, unlike SLIP-0039, this standard also aims to be simple enough for
hand computation.
Users who demand a higher level of security for particular secrets, or have
a general distrust in digital electronic devices, have the option of using
hand computation to backup and restore secret data in an interoperable
manner.
Note that hand computation is optional, the particular details of hand
computation are outside the scope of this standard, and implementers do not
need to be concerned with this possibility.

[https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki BIP-0039]
serves the same purpose as this standard: encoding master seeds for storage
by users.
However, BIP-0039 has no error-correcting ability, cannot sensibly be
extended to support secret sharing, has no support for versioning or other
metadata, and has many technical design decisions that make implementation
and interoperability difficult (for example, the use of SHA-512 to derive
seeds, or the use of 11-bit words).

=3D=3DSpecification=3D=3D

=3D=3D=3Dcodex32=3D=3D=3D

A codex32 string is similar to a Bech32 string defined in [
https://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki BIP-0173].
It reuses the base32 character set from BIP-0173, and consists of:

* A human-readable part, which is the string "ms" (or "MS").
* A separator, which is always "1".
* A data part which is in turn subdivided into:
** A threshold parameter, which MUST be a single digit between "2" and "9",
or the digit "0".
*** If the threshold parameter is "0" then the share index, defined below,
MUST have a value of "s" (or "S").
** An identifier consisting of 4 Bech32 characters.
** A share index, which is any Bech32 character. Note that a share index
value of "s" (or "S") is special and denotes the unshared secret (see
section "Unshared Secret").
** A payload which is a sequence of up to 74 Bech32 characters. (However,
see '''Long codex32 Strings''' below for an exception to this limit.)
** A checksum which consists of 13 Bech32 characters as described below.

As with Bech32 strings, a codex32 string MUST be entirely uppercase or
entirely lowercase.
The lowercase form is used when determining a character's value for
checksum purposes.
For presentation, lowercase is usually preferable, but uppercase SHOULD be
used for handwritten codex32 strings.

=3D=3D=3DChecksum=3D=3D=3D

The last thirteen characters of the data part form a checksum and contain
no information.
Valid strings MUST pass the criteria for validity specified by the Python3
code snippet below.
The function <code>ms32_verify_checksum</code> must return true when its
argument is the data part as a list of integers representing the characters
converted using the bech32 character table from BIP-0173.

To construct a valid checksum given the data-part characters (excluding the
checksum), the <code>ms32_create_checksum</code> function can be used.

<source lang=3D"python">
MS32_CONST =3D 0x10ce0795c2fd1e62a

def ms32_polymod(values):
    GEN =3D [
        0x19dc500ce73fde210,
        0x1bfae00def77fe529,
        0x1fbd920fffe7bee52,
        0x1739640bdeee3fdad,
        0x07729a039cfc75f5a,
    ]
    residue =3D 0x23181b3
    for v in values:
        b =3D (residue >> 60)
        residue =3D (residue & 0x0fffffffffffffff) << 5 ^ v
        for i in range(5):
            residue ^=3D GEN[i] if ((b >> i) & 1) else 0
    return residue

def ms32_verify_checksum(data):
    if len(data) >=3D 96:                      # See Long codex32 Strings
        return ms32_verify_long_checksum(data)
    if len(data) <=3D 93:
        return ms32_polymod(data) =3D=3D MS32_CONST
    return False

def ms32_create_checksum(data):
    if len(data) > 80:                       # See Long codex32 Strings
        return ms32_create_long_checksum(data)
    values =3D data
    polymod =3D ms32_polymod(values + [0] * 13) ^ MS32_CONST
    return [(polymod >> 5 * (12 - i)) & 31 for i in range(13)]
</source>

=3D=3D=3DError Correction=3D=3D=3D

A codex32 string without a valid checksum MUST NOT be used.
The checksum is designed to be an error correcting code that can correct up
to 4 character substitutions, up to 8 unreadable characters (called
erasures), or up to 13 consecutive erasures.
Implementations SHOULD provide the user with a corrected valid codex32
string if possible.
However, implementations SHOULD NOT automatically proceed with a corrected
codex32 string without user confirmation of the corrected string, either by
prompting the user, or returning a corrected string in an error message and
allowing the user to repeat their action.
We do not specify how an implementation should implement error correction.
However, we recommend that:

* Implementations make suggestions to substitute non-bech32 characters with
bech32 characters in some situations, such as replacing "B" with "8", "O"
with "0", "I" with "l", etc.
* Implementations interpret "?" as an erasure.
* Implementations optionally interpret other non-bech32 characters, or
characters with incorrect case, as erasures.
* If a string with 8 or fewer erasures can have those erasures filled in to
make a valid codex32 string, then the implementation suggests such a string
as a correction.
* If a string consisting of valid Bech32 characters in the proper case can
be made valid by substituting 4 or fewer characters, then the
implementation suggests such a string as a correction.

=3D=3D=3DUnshared Secret=3D=3D=3D

When the share index of a valid codex32 string (converted to lowercase) is
the letter "s", we call the string a codex32 secret.
The subsequent data characters in a codex32 secret, excluding the final
checksum of 13 characters, is a direct encoding of a BIP-0032 HD master
seed.

The master seed is decoded by converting the data to bytes:

* Translate the characters to 5 bits values using the bech32 character
table from BIP-0173, most significant bit first.
* Re-arrange those bits into groups of 8 bits. Any incomplete group at the
end MUST be 4 bits or less, and is discarded.

Note that unlike the decoding process in BIP-0173, we do NOT require that
the incomplete group be all zeros.

For an unshared secret, the threshold parameter (the first character of the
data part) is ignored (beyond the fact it must be a digit for the codex32
string to be valid).
We recommend using the digit "0" for the threshold parameter in this case.
The 4 character identifier also has no effect beyond aiding users in
distinguishing between multiple different master seeds in cases where they
have more than one.

=3D=3D=3DRecovering Master Seed=3D=3D=3D

When the share index of a valid codex32 string (converted to lowercase) is
not the letter "s", we call the string an codex32 share.
The first character of the data part indicates the threshold of the share,
and it is required to be a non-"0" digit.

In order to recover a master seed, one needs a set of valid codex32 shares
such that:

* All shares have the same threshold value, the same identifier, and the
same length.
* All of the share index values are distinct.
* The number of codex32 shares is exactly equal to the (common) threshold
value.

If all the above conditions are satisfied, the <code>ms32_recover</code>
function will return a codex32 secret when its argument is the list of
codex32 shares with each share represented as a list of integers
representing the characters converted using the bech32 character table from
BIP-0173.

<source lang=3D"python">
bech32_inv =3D [
    0, 1, 20, 24, 10, 8, 12, 29, 5, 11, 4, 9, 6, 28, 26, 31,
    22, 18, 17, 23, 2, 25, 16, 19, 3, 21, 14, 30, 13, 7, 27, 15,
]

def bech32_mul(a, b):
    res =3D 0
    for i in range(5):
        res ^=3D a if ((b >> i) & 1) else 0
        a *=3D 2
        a ^=3D 41 if (32 <=3D a) else 0
    return res

def bech32_lagrange(l, x):
    n =3D 1
    c =3D []
    for i in l:
        n =3D bech32_mul(n, i ^ x)
        m =3D 1
        for j in l:
            m =3D bech32_mul(m, (x if i =3D=3D j else i) ^ j)
        c.append(m)
    return [bech32_mul(n, bech32_inv[i]) for i in c]

def ms32_interpolate(l, x):
    w =3D bech32_lagrange([s[5] for s in l], x)
    res =3D []
    for i in range(len(l[0])):
        n =3D 0
        for j in range(len(l)):
            n ^=3D bech32_mul(w[j], l[j][i])
        res.append(n)
    return res

def ms32_recover(l):
    return ms32_interpolate(l, 16)
</source>

=3D=3D=3DGenerating Shares=3D=3D=3D

If we already have ''t'' valid codex32 strings such that:

* All strings have the same threshold value ''t'', the same identifier, and
the same length
* All of the share index values are distinct

Then we can derive additional shares with the <code>ms32_interpolate</code>
function by passing it a list of exactly ''t'' of these codex32 strings,
together with a fresh share index distinct from all of the existing share
indexes.
The newly derived share will have the provided share index.

Once a user has generated ''n'' codex32 shares, they may discard the
codex32 secret (if it exists).
The ''n'' shares form a ''t'' of ''n'' Shamir's secret sharing scheme of a
codex32 secret.

There are two ways to create an initial set of ''t'' valid codex32 strings,
depending on whether the user already has an existing master seed to split.

=3D=3D=3D=3DFor an existing master seed=3D=3D=3D=3D

Before generating shares for an existing master seed, it first must be
converted into a codex32 secret, as described above.
The conversion process consists of:

* Choosing a threshold value ''t'' between 2 and 9, inclusive
* Choosing a 4 bech32 character identifier
** We do not define how to choose the identifier, beyond noting that it
SHOULD be distinct for every master seed the user may need to disambiguate.
* Setting the share index to "s"
* Setting the payload to a Bech32 encoding of the master seed, padded with
arbitrary bits
* Generating a valid checksum in accordance with the Checksum section

Along with the codex32 secret, the user must generate ''t''-1 other codex32
shares, each with the same threshold value, the same identifier, and a
distinct share index.
The set of share indexes may be chosen arbitrarily.
The payload of each of these codex32 shares is chosen uniformly at random
such that it has the same length as the payload of the codex32 secret.
For each share, a valid checksum must be generated in accordance with the
Checksum section.

The codex32 secret and the ''t''-1 codex32 shares form a set of ''t'' valid
codex32 strings from which additional shares can be derived as described
above.

=3D=3D=3D=3DFor a fresh master seed=3D=3D=3D=3D

In the case that the user wishes to generate a fresh master seed, the user
chooses a threshold value ''t'' and an identifier, then generates ''t''
random codex32 shares, using the generation procedure from the previous
section.
As before, each share must have the same threshold value ''t'', the same
identifier, and a distinct share index.

With this set of ''t'' codex32 shares, new shares can be derived as
discussed above. This process generates a fresh master seed, whose value
can be retrieved by running the recovery process on any ''t'' of these
shares.

=3D=3D=3DLong codex32 Strings=3D=3D=3D

The 13 character checksum design only supports up to 80 data characters.
Excluding the threshold, identifier and index characters, this limits the
payload to 74 characters or 46 bytes.
While this is enough to support the 32-byte advised size of BIP-0032 master
seeds, BIP-0032 allows seeds to be up to 64 bytes in size.
We define a long codex32 string format to support these longer seeds by
defining an alternative checksum.

<source lang=3D"python">
MS32_LONG_CONST =3D 0x43381e570bf4798ab26

def ms32_long_polymod(values):
    GEN =3D [
        0x3d59d273535ea62d897,
        0x7a9becb6361c6c51507,
        0x543f9b7e6c38d8a2a0e,
        0x0c577eaeccf1990d13c,
        0x1887f74f8dc71b10651,
    ]
    residue =3D 0x23181b3
    for v in values:
        b =3D (residue >> 70)
        residue =3D (residue & 0x3fffffffffffffffff) << 5 ^ v
        for i in range(5):
            residue ^=3D GEN[i] if ((b >> i) & 1) else 0
    return residue

def ms32_verify_long_checksum(data):
    return ms32_long_polymod(data) =3D=3D MS32_LONG_CONST

def ms32_create_long_checksum(data):
    values =3D data
    polymod =3D ms32_long_polymod(values + [0] * 15) ^ MS32_LONG_CONST
    return [(polymod >> 5 * (14 - i)) & 31 for i in range(15)]
</source>

A long codex32 string follows the same specification as a regular codex32
string with the following changes.

* The payload is a sequence of between 75 and 103 Bech32 characters.
* The checksum consists of 15 Bech32 characters as defined above.

A codex32 string with a data part of 94 or 95 characters is never legal as
a regular codex32 string is limited to 93 data characters and a long
codex32 string is at least 96 characters.

Generation of long shares and recovery of the master seed from long shares
proceeds in exactly the same way as for regular shares with the
<code>ms32_interpolate</code> function.

The long checksum is designed to be an error correcting code that can
correct up to 4 character substitutions, up to 8 unreadable characters
(called erasures), or up to 15 consecutive erasures.
As with regular checksums we do not specify how an implementation should
implement error correction, and all our recommendations for error
correction of regular codex32 strings also apply to long codex32 strings.

=3D=3DRationale=3D=3D

This scheme is based on the observation that the Lagrange interpolation of
valid codewords in a BCH code will always be a valid codeword.
This means that derived shares will always have valid checksum, and a
sufficient threshold of shares with valid checksums will derive a secret
with a valid checksum.

The header system is also compatible with Lagrange interpolation, meaning
all derived shares will have the same identifier and will have the
appropriate share index.
This fact allows the header data to be covered by the checksum.

The checksum size and identifier size have been chosen so that the encoding
of 128-bit seeds and shares fit within 48 characters.
This is a standard size for many common seed storage formats, which has
been popularized by the 12 four-letter word format of the BIP-0039 mnemonic=
.

The 13 character checksum is adequate to correct 4 errors in up to 93
characters (80 characters of data and 13 characters of the checksum). This
is somewhat better quality than the checksum used in SLIP-0039.

For 256-bit seeds and shares our strings are 74 characters, which fits into
the 96 character format of the 24 four-letter word format of the BIP-0039
mnemonic, with plenty of room to spare.

A longer checksum is needed to support up to 512-bit seeds, the longest
seed length specified in BIP-0032, as the 13 character checksum isn't
adequate for more than 80 data characters.
While we could use the 15 character checksum for both cases, we prefer to
keep the strings as short as possible for the more common cases of 128-bit
and 256-bit master seeds.
We only guarantee to correct 4 characters no matter how long the string is.
Longer strings mean more chances for transcription errors, so shorter
strings are better.

The longest data part using the regular 13 character checksum is 93
characters and corresponds to a 400-bit secret.
At this length, the prefix <code>MS1</code> is not covered by the checksum.
This is acceptable because the checksum scheme itself requires you to know
that the <code>MS1</code> prefix is being used in the first place.
If the prefix is damaged and a user is guessing that the data might be
using this scheme, then the user can enter the available data explicitly
using the suspected <code>MS1</code> prefix.

=3D=3DBackwards Compatibility=3D=3D

codex32 is an alternative to BIP-0039 and SLIP-0039.
It is technically possible to derive the BIP32 master seed from seed words
encoded in one of these schemes, and then to encode this seed in codex32.
For BIP-0039 this process is irreversible, since it involves hashing the
original words.
Furthermore, the resulting seed will be 512 bits long, which may be too
large to be safely and conveniently handled.

SLIP-0039 seed words can be reversibly converted to master seeds, so it is
possible to interconvert between SLIP-0039 and codex32.
However, SLIP-0039 '''shares''' cannot be converted to codex32 shares
because the two schemes use a different underlying field.

The authors of this BIP do not recommend interconversion.
Instead, users who wish to switch to codex32 should generate a fresh seed
and sweep their coins.

=3D=3DReference Implementation=3D=3D

* [https://secretcodex32.com/docs/2023-02-14--bw.ps Reference PostScript
Implementation]
* FIXME add Python implementation
* FIXME add Rust implementation

=3D=3DTest Vectors=3D=3D

=3D=3D=3DTest vector 1=3D=3D=3D

This example shows the codex32 format, when used without splitting the
secret into any shares.
The data part contains 26 Bech32 characters, which corresponds to 130 bits.
We truncate the last two bits in order to obtain a 128-bit master seed.

codex32 secret (Bech32):
<code>ms10testsxxxxxxxxxxxxxxxxxxxxxxxxxx4nzvca9cmczlw</code>

Master secret (hex): <code>318c6318c6318c6318c6318c6318c631</code>

* human-readable part: <code>ms</code>
* separator: <code>1</code>
* k value: <code>0</code> (no secret splitting)
* identifier: <code>test</code>
* share index: <code>s</code> (the secret)
* data: <code>xxxxxxxxxxxxxxxxxxxxxxxxxx</code>
* checksum: <code>4nzvca9cmczlw</code>

=3D=3D=3DTest vector 2=3D=3D=3D

This example shows generating a new master seed using "random" codex32
shares, as well as deriving an additional codex32 share, using ''k''=3D2 an=
d
an identifier of <code>NAME</code>.
Although codex32 strings are canonically all lowercase, it's also valid to
use all uppercase.

Share with index <code>A</code>:
<code>MS12NAMEA320ZYXWVUTSRQPNMLKJHGFEDCAXRPP870HKKQRM</code>

Share with index <code>C</code>:
<code>MS12NAMECACDEFGHJKLMNPQRSTUVWXYZ023FTR2GDZMPY6PN</code>

* Derived share with index <code>D</code>:
<code>MS12NAMEDLL4F8JLH4E5VDVULDLFXU2JHDNLSM97XVENRXEG</code>
* Secret share with index <code>S</code>:
<code>MS12NAMES6XQGUZTTXKEQNJSJZV4JV3NZ5K3KWGSPHUH6EVW</code>
* Master secret (hex): <code>d1808e096b35b209ca12132b264662a5</code>

Note that per BIP-0173, the lowercase form is used when determining a
character's value for checksum purposes.
In particular, given an all uppercase codex32 string, we still use
lowercase <code>ms</code> as the human-readable part during checksum
construction.

=3D=3D=3DTest vector 3=3D=3D=3D

This example shows splitting an existing 128-bit master seed into "random"
codex32 shares, using ''k''=3D3 and an identifier of <code>cash</code>.
We appended two zero bits in order to obtain 26 Bech32 characters (130 bits
of data) from the 128-bit master seed.

Master secret (hex): <code>ffeeddccbbaa99887766554433221100</code>

Secret share with index <code>s</code>:
<code>ms13cashsllhdmn9m42vcsamx24zrxgs3qqjzqud4m0d6nln</code>

Share with index <code>a</code>:
<code>ms13casha320zyxwvutsrqpnmlkjhgfedca2a8d0zehn8a0t</code>

Share with index <code>c</code>:
<code>ms13cashcacdefghjklmnpqrstuvwxyz023949xq35my48dr</code>

* Derived share with index <code>d</code>:
<code>ms13cashd0wsedstcdcts64cd7wvy4m90lm28w4ffupqs7rm</code>
* Derived share with index <code>e</code>:
<code>ms13casheekgpemxzshcrmqhaydlp6yhms3ws7320xyxsar9</code>
* Derived share with index <code>f</code>:
<code>ms13cashf8jh6sdrkpyrsp5ut94pj8ktehhw2hfvyrj48704</code>

Any three of the five shares among <code>acdef</code> can be used to
recover the secret.

Note that the choice to append two zero bits was arbitrary, and any of the
following four secret shares would have been valid choices.
However, each choice would have resulted in a different set of derived
shares.

* <code>ms13cashsllhdmn9m42vcsamx24zrxgs3qqjzqud4m0d6nln</code>
* <code>ms13cashsllhdmn9m42vcsamx24zrxgs3qpte35dvzkjpt0r</code>
* <code>ms13cashsllhdmn9m42vcsamx24zrxgs3qzfatvdwq5692k6</code>
* <code>ms13cashsllhdmn9m42vcsamx24zrxgs3qrsx6ydhed97jx2</code>

=3D=3D=3DTest vector 4=3D=3D=3D

This example shows converting a 256-bit secret into a codex32 secret,
without splitting the secret into any shares.
We appended four zero bits in order to obtain 52 Bech32 characters (260
bits of data) from the 256-bit secret.

256-bit secret (hex):
<code>ffeeddccbbaa99887766554433221100ffeeddccbbaa99887766554433221100</cod=
e>

* codex32 secret:
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqqtum9pgv9=
9ycma</code>

Note that the choice to append four zero bits was arbitrary, and any of the
following sixteen codex32 secrets would have been valid:

*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqqtum9pgv9=
9ycma</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqpj82dp34u=
6lqtd</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqzsrs4pnh7=
jmpj5</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqrfcpap2w8=
dqezy</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqy5tdvphn6=
znrf0</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyq9dsuypw2r=
agmel</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqx05xupvgp=
4v6qx</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyq8k0h5p43c=
2hzsk</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqgum7hplmj=
tr8ks</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqf9q0lpxzt=
5clxq</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyq28y48pyqf=
uu7le</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqt7ly0paes=
r8x0f</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqvrvg7pqyd=
v5uyz</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqd6hekpea5=
n0y5j</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqwcnrwpmlk=
mt9dt</code>
*
<code>ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyq0pgjxpzx0=
ysaam</code>

=3D=3D=3DTest vector 5=3D=3D=3D

This example shows generating a new 512-bit master seed using "random"
codex32 characters and appending a checksum.
The payload contains 103 Bech32 characters, which corresponds to 515 bits.
The last three bits are discarded when converting to a 512-bit master seed.

This is an example of a '''Long codex32 String'''.

* Secret share with index <code>S</code>:
<code>MS100C8VSM32ZXFGUHPCHTLUPZRY9X8GF2TVDW0S3JN54KHCE6MUA7LQPZYGSFJD6AN07=
4RXVCEMLH8WU3TK925ACDEFGHJKLMNPQRSTUVWXY06FHPV80UNDVARHRAK</code>
* Master secret (hex):
<code>dc5423251cb87175ff8110c8531d0952d8d73e1194e95b5f19d6f9df7c01111104c9b=
aecdfea8cccc677fb9ddc8aec5553b86e528bcadfdcc201c17c638c47e9</code>

=3D=3DAppendix=3D=3D

=3D=3D=3DMathematical Companion=3D=3D=3D

Below we use the Bech32 character set to denote values in GF[32].
In Bech32, the letter <code>Q</code> denotes zero and the letter
<code>P</code> denotes one.
The digits <code>0</code> and <code>2</code> through <code>9</code> do
''not'' denote their numeric values.
They are simply elements of GF[32].

The generating polynomial for our BCH code is as follows.

We extend GF[32] to GF[1024] by adjoining a primitive cube root of unity,
<code>=CE=B6</code>, satisfying <code>=CE=B6^2 =3D =CE=B6 + P</code>.

We select <code>=CE=B2 :=3D G =CE=B6</code> which has order 93, and constru=
ct the
product <code>(x - =CE=B2^i)</code> for <code>i</code> in <code>{17, 20, 46=
, 49,
52, 77, 78, 79, 80, 81, 82, 83, 84}</code>.
The resulting polynomial is our generating polynomial for our 13 character
checksum:

    x^13 + E x^12 + M x^11 + 3 x^10 + G x^9 + Q x^8 + E x^7 + E x^6 + E x^5
+ L x^4 + M x^3 + C x^2 + S x + S

For our long checksum, we select <code>=CE=B3 :=3D E + X =CE=B6</code>, whi=
ch has order
1023, and construct the product <code>(x - =CE=B3^i)</code> for <code>i</co=
de>
in <code>{32, 64, 96, 895, 927, 959, 991, 1019, 1020, 1021, 1022, 1023,
1024, 1025, 1026}</code>.
The resulting polynomial is our generating polynomial for our 15 character
checksum for long strings:

    x^15 + 0 x^14 + 2 x^13 + E x^12 + 6 x^11 + F x^10 + E x^9 + 4 x^8 + X
x^7 + H x^6 + 4 x^5 + X x^4 + 9 x^3 + K x^2 + Y x^1 + H

(Reminder: the character <code>0</code> does ''not'' denote the zero of the
field.)

-----END BIP-----

--000000000000ed832605f4c7c775
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div id=3D"gmail-magicdomid2" class=3D"gmail-ace-line"><sp=
an class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">I&#=
39;ve been asked by Dr. Curr and Professor Snead to forward this message to=
=C2=A0</span></div><div id=3D"gmail-magicdomid498" class=3D"gmail-ace-line"=
><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd"=
>this mailing list, as it may be of general interest to Bitcoin users.=C2=
=A0</span></div><div id=3D"gmail-magicdomid4" class=3D"gmail-ace-line"><br>=
</div><div id=3D"gmail-magicdomid5" class=3D"gmail-ace-line"><span class=3D=
"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Dear Colleague=
:=C2=A0</span></div><div id=3D"gmail-magicdomid6" class=3D"gmail-ace-line">=
<br></div><div id=3D"gmail-magicdomid7" class=3D"gmail-ace-line"><span clas=
s=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">In 1967, d=
uring excavation for the construction of a new shopping center in=C2=A0</sp=
an></div><div id=3D"gmail-magicdomid8" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Monroeville=
, Pennsylvania, workers uncovered a vault containing a cache of=C2=A0</span=
></div><div id=3D"gmail-magicdomid9" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">ancient scr=
olls[1].=C2=A0 Most were severely damaged, but those that could be=C2=A0</s=
pan></div><div id=3D"gmail-magicdomid10" class=3D"gmail-ace-line"><span cla=
ss=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">recovered=
 confirmed the existence of a secret society long suspected to have=C2=A0</=
span></div><div id=3D"gmail-magicdomid11" class=3D"gmail-ace-line"><span cl=
ass=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">been act=
ive in the region around the year 200 BC.=C2=A0</span></div><div id=3D"gmai=
l-magicdomid12" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdo=
mid13" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz9=
0zz81zz90zwz83zdz82zz78zz65zmd">Based on a translation of these documents, =
we now know that the society, the=C2=A0</span></div><div id=3D"gmail-magicd=
omid14" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">Cult of the Bound Variable, was devoted to=
 the careful study of computation,=C2=A0</span></div><div id=3D"gmail-magic=
domid15" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65z=
z90zz81zz90zwz83zdz82zz78zz65zmd">over two millennia before the invention o=
f the digital computer.=C2=A0</span></div><div id=3D"gmail-magicdomid16" cl=
ass=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid17" class=3D"gm=
ail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz8=
2zz78zz65zmd">While the Monroeville scrolls make reference to computing mac=
hines made of=C2=A0</span></div><div id=3D"gmail-magicdomid18" class=3D"gma=
il-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82=
zz78zz65zmd">sandstone, most researchers believed this to be a poetic metap=
hor and that the=C2=A0</span></div><div id=3D"gmail-magicdomid19" class=3D"=
gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zd=
z82zz78zz65zmd">&quot;computers&quot; were in fact the initiates themselves=
, carrying out the=C2=A0</span></div><div id=3D"gmail-magicdomid20" class=
=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz=
83zdz82zz78zz65zmd">unimaginably tedious steps of their computations with r=
eed pens on parchment.=C2=A0</span></div><div id=3D"gmail-magicdomid506" cl=
ass=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid510" class=3D"g=
mail-ace-line"><span class=3D"gmail-author-a-u1z69z5z85zz87zz87zmz79z5tz90z=
7z88zcc">Within the vault,</span><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd"> a collection of sandstone wheels marked i=
n a language=C2=A0</span></div><div id=3D"gmail-magicdomid515" class=3D"gma=
il-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82=
zz78zz65zmd">consisting of 32 glyphs was found. After 15 years of study, we=
 have </span><span class=3D"gmail-author-a-u1z69z5z85zz87zz87zmz79z5tz90z7z=
88zcc">successfully</span></div><div id=3D"gmail-magicdomid517" class=3D"gm=
ail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz8=
2zz78zz65zmd">completed the translation of what is known as &quot;Codex32</=
span><span class=3D"gmail-author-a-u1z69z5z85zz87zz87zmz79z5tz90z7z88zcc">,=
</span><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz=
65zmd">&quot; a document that</span></div><div id=3D"gmail-magicdomid522" c=
lass=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz9=
0zwz83zdz82zz78zz65zmd">describes the functions of the wheels. </span><span=
 class=3D"gmail-author-a-u1z69z5z85zz87zz87zmz79z5tz90z7z88zcc">It was disc=
overed that the</span><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90z=
wz83zdz82zz78zz65zmd"> wheels operate</span></div><div id=3D"gmail-magicdom=
id525" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz9=
0zz81zz90zwz83zdz82zz78zz65zmd">a system of cryptographic computations that=
 was</span><span class=3D"gmail-author-a-u1z69z5z85zz87zz87zmz79z5tz90z7z88=
zcc"> </span><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82=
zz78zz65zmd">used by cult members to</span></div><div class=3D"gmail-ace-li=
ne"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65z=
md">safeguard their most valuable secrets.</span></div><div id=3D"gmail-mag=
icdomid27" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid53=
5" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz8=
1zz90zwz83zdz82zz78zz65zmd">The </span><span class=3D"gmail-author-a-u1z69z=
5z85zz87zz87zmz79z5tz90z7z88zcc">C</span><span class=3D"gmail-author-a-ogz6=
5zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">odex32 system allows secrets to be=
 carved into multiple tablets and</span></div><div id=3D"gmail-magicdomid29=
" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81=
zz90zwz83zdz82zz78zz65zmd">scattered to the far corners of the earth. When =
a sufficient number of tablets are</span></div><div id=3D"gmail-magicdomid5=
39" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz=
81zz90zwz83zdz82zz78zz65zmd">brought together the stone wheels are manipula=
ted in a manner to recover the</span></div><div id=3D"gmail-magicdomid541" =
class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz=
90zwz83zdz82zz78zz65zmd">secrets. </span><span class=3D"gmail-author-a-u1z6=
9z5z85zz87zz87zmz79z5tz90z7z88zcc">This finding may be of particular intere=
st to the Bitcoin community.</span></div><div id=3D"gmail-magicdomid31" cla=
ss=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid32" class=3D"gma=
il-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82=
zz78zz65zmd">Below we provide a summary of the cult&#39;s secret sharing sy=
stem, which is</span></div><div class=3D"gmail-ace-line"><span class=3D"gma=
il-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">graciously hosted =
at</span></div><div id=3D"gmail-magicdomid33" class=3D"gmail-ace-line"><spa=
n class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">&lt;=
</span><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz=
65zmd gmail-url"><a href=3D"https://github.com/apoelstra/bips/blob/2023-02-=
-volvelles/bip-0000.mediawiki" rel=3D"noreferrer noopener">https://github.c=
om/apoelstra/bips/blob/2023-02--volvelles/bip-0000.mediawiki</a></span><spa=
n class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">&gt;=
.</span></div><div id=3D"gmail-magicdomid34" class=3D"gmail-ace-line"><span=
 class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">We ar=
e requesting a record assignment in the Bibliography of Immemorial</span></=
div><div id=3D"gmail-magicdomid35" class=3D"gmail-ace-line"><span class=3D"=
gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Philosophy (BIP=
) repository.=C2=A0</span></div><div id=3D"gmail-magicdomid36" class=3D"gma=
il-ace-line"><br></div><div id=3D"gmail-magicdomid37" class=3D"gmail-ace-li=
ne"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65z=
md">Thank you for your consideration.</span></div><div id=3D"gmail-magicdom=
id38" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid39" cla=
ss=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90z=
wz83zdz82zz78zz65zmd">Dr. Leon O. Curr and Professor Pearlwort Snead=C2=A0<=
/span></div><div id=3D"gmail-magicdomid40" class=3D"gmail-ace-line"><span c=
lass=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Departm=
ent of Archaeocryptography=C2=A0</span></div><div id=3D"gmail-magicdomid41"=
 class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81z=
z90zwz83zdz82zz78zz65zmd">Harry Q. Bovik Institute for the Advancement=C2=
=A0</span></div><div id=3D"gmail-magicdomid42" class=3D"gmail-ace-line"><br=
></div><div id=3D"gmail-magicdomid43" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">[1] </span>=
<span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd g=
mail-url"><a href=3D"http://www.boundvariable.org/task.shtml" rel=3D"norefe=
rrer noopener">http://www.boundvariable.org/task.shtml</a></span></div><div=
 id=3D"gmail-magicdomid44" class=3D"gmail-ace-line"><br></div><div id=3D"gm=
ail-magicdomid45" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-og=
z65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">-----BEGIN BIP-----</span></div>=
<div id=3D"gmail-magicdomid46" class=3D"gmail-ace-line"><br></div><div id=
=3D"gmail-magicdomid47" class=3D"gmail-ace-line"><span class=3D"gmail-autho=
r-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">&lt;pre&gt;</span></div><d=
iv id=3D"gmail-magicdomid48" class=3D"gmail-ace-line"><span class=3D"gmail-=
author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0 BIP: ????</spa=
n></div><div id=3D"gmail-magicdomid49" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0 Laye=
r: Applications</span></div><div id=3D"gmail-magicdomid50" class=3D"gmail-a=
ce-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78=
zz65zmd">=C2=A0 Title: codex32</span></div><div id=3D"gmail-magicdomid51" c=
lass=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz9=
0zwz83zdz82zz78zz65zmd">=C2=A0 Author: Leon Olsson Curr and Pearlwort Sneed=
 &lt;<a href=3D"mailto:pearlwort@wpsoftware.net">pearlwort@wpsoftware.net</=
a>&gt;</span></div><div id=3D"gmail-magicdomid52" class=3D"gmail-ace-line">=
<span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=
=C2=A0 Comments-URI: </span><span class=3D"gmail-author-a-ogz65zvz65zz90zz8=
1zz90zwz83zdz82zz78zz65zmd gmail-url"><a href=3D"https://github.com/bitcoin=
/bips/wiki/Comments:BIP-????" rel=3D"noreferrer noopener">https://github.co=
m/bitcoin/bips/wiki/Comments:BIP-????</a></span></div><div id=3D"gmail-magi=
cdomid53" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65=
zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0 Status: Draft</span></div><div id=
=3D"gmail-magicdomid54" class=3D"gmail-ace-line"><span class=3D"gmail-autho=
r-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0 Type: ????</span></=
div><div id=3D"gmail-magicdomid55" class=3D"gmail-ace-line"><span class=3D"=
gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0 Created:=
 2023-02-13</span></div><div id=3D"gmail-magicdomid56" class=3D"gmail-ace-l=
ine"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65=
zmd">=C2=A0 License: BSD-3-Clause</span></div><div id=3D"gmail-magicdomid57=
" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81=
zz90zwz83zdz82zz78zz65zmd">=C2=A0 Post-History: FIXME</span></div><div id=
=3D"gmail-magicdomid58" class=3D"gmail-ace-line"><span class=3D"gmail-autho=
r-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">&lt;/pre&gt;</span></div><=
div id=3D"gmail-magicdomid59" class=3D"gmail-ace-line"><br></div><div id=3D=
"gmail-magicdomid60" class=3D"gmail-ace-line"><span class=3D"gmail-author-a=
-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3DIntroduction=3D=3D</spa=
n></div><div id=3D"gmail-magicdomid61" class=3D"gmail-ace-line"><br></div><=
div id=3D"gmail-magicdomid62" class=3D"gmail-ace-line"><span class=3D"gmail=
-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DAbstract=3D=
=3D=3D</span></div><div id=3D"gmail-magicdomid63" class=3D"gmail-ace-line">=
<br></div><div id=3D"gmail-magicdomid64" class=3D"gmail-ace-line"><span cla=
ss=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">This docu=
ment describes a standard for backing up and restoring the master seed of a=
</span></div><div id=3D"gmail-magicdomid65" class=3D"gmail-ace-line"><span =
class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">[</spa=
n><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
 gmail-url"><a href=3D"https://github.com/bitcoin/bips/blob/master/bip-0032=
.mediawiki" rel=3D"noreferrer noopener">https://github.com/bitcoin/bips/blo=
b/master/bip-0032.mediawiki</a></span><span class=3D"gmail-author-a-ogz65zv=
z65zz90zz81zz90zwz83zdz82zz78zz65zmd"> BIP-0032] hierarchical deterministic=
 wallet, using Shamir&#39;s secret sharing.</span></div><div id=3D"gmail-ma=
gicdomid66" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz=
65zz90zz81zz90zwz83zdz82zz78zz65zmd">It includes an encoding format, a BCH =
error-correcting checksum, and algorithms for share generation and secret r=
ecovery.</span></div><div id=3D"gmail-magicdomid67" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">Secret data can be split into up to 31 shares.</span></div><div id=3D"gma=
il-magicdomid68" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz=
65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">A minimum threshold of shares, wh=
ich can be between 1 and 9, is needed to recover the secret, whereas withou=
t sufficient shares, no information about the secret is recoverable.</span>=
</div><div id=3D"gmail-magicdomid69" class=3D"gmail-ace-line"><br></div><di=
v id=3D"gmail-magicdomid70" class=3D"gmail-ace-line"><span class=3D"gmail-a=
uthor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DCopyright=3D=
=3D=3D</span></div><div id=3D"gmail-magicdomid71" class=3D"gmail-ace-line">=
<br></div><div id=3D"gmail-magicdomid72" class=3D"gmail-ace-line"><span cla=
ss=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">This docu=
ment is licensed under the 3-clause BSD license.</span></div><div id=3D"gma=
il-magicdomid73" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicd=
omid74" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DMotivation=3D=3D=3D</span></div><=
div id=3D"gmail-magicdomid75" class=3D"gmail-ace-line"><br></div><div id=3D=
"gmail-magicdomid76" class=3D"gmail-ace-line"><span class=3D"gmail-author-a=
-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">BIP-0032 master seed data is =
the source entropy used to derive all private keys in an HD wallet.</span><=
/div><div id=3D"gmail-magicdomid77" class=3D"gmail-ace-line"><span class=3D=
"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Safely storing=
 this secret data is the hardest and most important part of self-custody.</=
span></div><div id=3D"gmail-magicdomid78" class=3D"gmail-ace-line"><span cl=
ass=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">However,=
 there is a tension between security, which demands limiting the number of =
backups, and resilience, which demands widely replicated backups.</span></d=
iv><div id=3D"gmail-magicdomid79" class=3D"gmail-ace-line"><span class=3D"g=
mail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Encrypting the s=
eed does not change this fundamental tradeoff, since it leaves essentially =
the same problem of how to back up the encryption key(s).</span></div><div =
id=3D"gmail-magicdomid80" class=3D"gmail-ace-line"><br></div><div id=3D"gma=
il-magicdomid81" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz=
65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">To allow users freedom to make th=
is tradeoff, we use Shamir&#39;s secret sharing, which guarantees that any =
number of shares less than the threshold leaks no information about the sec=
ret.</span></div><div id=3D"gmail-magicdomid82" class=3D"gmail-ace-line"><s=
pan class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Th=
is approach allows increasing safety by widely distributing the generated s=
hares, while also providing security against the compromise of one or more =
shares (as long as fewer than the threshold have been compromised).</span><=
/div><div id=3D"gmail-magicdomid83" class=3D"gmail-ace-line"><br></div><div=
 id=3D"gmail-magicdomid84" class=3D"gmail-ace-line"><span class=3D"gmail-au=
thor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">[</span><span class=3D"=
gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd gmail-url"><a hr=
ef=3D"https://github.com/satoshilabs/slips/blob/master/slip-0039.md" rel=3D=
"noreferrer noopener">https://github.com/satoshilabs/slips/blob/master/slip=
-0039.md</a></span><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz8=
3zdz82zz78zz65zmd"> SLIP-0039] has essentially the same motivations as this=
 standard.</span></div><div id=3D"gmail-magicdomid85" class=3D"gmail-ace-li=
ne"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65z=
md">However, unlike SLIP-0039, this standard also aims to be simple enough =
for hand computation.</span></div><div id=3D"gmail-magicdomid86" class=3D"g=
mail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz=
82zz78zz65zmd">Users who demand a higher level of security for particular s=
ecrets, or have a general distrust in digital electronic devices, have the =
option of using hand computation to backup and restore secret data in an in=
teroperable manner.</span></div><div id=3D"gmail-magicdomid87" class=3D"gma=
il-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82=
zz78zz65zmd">Note that hand computation is optional, the particular details=
 of hand computation are outside the scope of this standard, and implemente=
rs do not need to be concerned with this possibility.</span></div><div id=
=3D"gmail-magicdomid88" class=3D"gmail-ace-line"><br></div><div id=3D"gmail=
-magicdomid89" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65=
zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">[</span><span class=3D"gmail-author=
-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd gmail-url"><a href=3D"https:=
//github.com/bitcoin/bips/blob/master/bip-0039.mediawiki" rel=3D"noreferrer=
 noopener">https://github.com/bitcoin/bips/blob/master/bip-0039.mediawiki</=
a></span><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78=
zz65zmd"> BIP-0039] serves the same purpose as this standard: encoding mast=
er seeds for storage by users.</span></div><div id=3D"gmail-magicdomid90" c=
lass=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz9=
0zwz83zdz82zz78zz65zmd">However, BIP-0039 has no error-correcting ability, =
cannot sensibly be extended to support secret sharing, has no support for v=
ersioning or other metadata, and has many technical design decisions that m=
ake implementation and interoperability difficult (for example, the use of =
SHA-512 to derive seeds, or the use of 11-bit words).</span></div><div id=
=3D"gmail-magicdomid91" class=3D"gmail-ace-line"><br></div><div id=3D"gmail=
-magicdomid92" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65=
zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3DSpecification=3D=3D</span></d=
iv><div id=3D"gmail-magicdomid93" class=3D"gmail-ace-line"><br></div><div i=
d=3D"gmail-magicdomid94" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3Dcodex32=3D=3D=3D=
</span></div><div id=3D"gmail-magicdomid95" class=3D"gmail-ace-line"><br></=
div><div id=3D"gmail-magicdomid96" class=3D"gmail-ace-line"><span class=3D"=
gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">A codex32 strin=
g is similar to a Bech32 string defined in [</span><span class=3D"gmail-aut=
hor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd gmail-url"><a href=3D"htt=
ps://github.com/bitcoin/bips/blob/master/bip-0173.mediawiki" rel=3D"norefer=
rer noopener">https://github.com/bitcoin/bips/blob/master/bip-0173.mediawik=
i</a></span><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82z=
z78zz65zmd"> BIP-0173].</span></div><div id=3D"gmail-magicdomid97" class=3D=
"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83z=
dz82zz78zz65zmd">It reuses the base32 character set from BIP-0173, and cons=
ists of:</span></div><div id=3D"gmail-magicdomid98" class=3D"gmail-ace-line=
"><br></div><div id=3D"gmail-magicdomid99" class=3D"gmail-ace-line"><span c=
lass=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* A hum=
an-readable part, which is the string &quot;ms&quot; (or &quot;MS&quot;).</=
span></div><div id=3D"gmail-magicdomid100" class=3D"gmail-ace-line"><span c=
lass=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* A sep=
arator, which is always &quot;1&quot;.</span></div><div id=3D"gmail-magicdo=
mid101" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">* A data part which is in turn subdivided =
into:</span></div><div id=3D"gmail-magicdomid102" class=3D"gmail-ace-line">=
<span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=
** A threshold parameter, which MUST be a single digit between &quot;2&quot=
; and &quot;9&quot;, or the digit &quot;0&quot;.</span></div><div id=3D"gma=
il-magicdomid103" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-og=
z65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">*** If the threshold parameter i=
s &quot;0&quot; then the share index, defined below, MUST have a value of &=
quot;s&quot; (or &quot;S&quot;).</span></div><div id=3D"gmail-magicdomid104=
" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81=
zz90zwz83zdz82zz78zz65zmd">** An identifier consisting of 4 Bech32 characte=
rs.</span></div><div id=3D"gmail-magicdomid105" class=3D"gmail-ace-line"><s=
pan class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">**=
 A share index, which is any Bech32 character. Note that a share index valu=
e of &quot;s&quot; (or &quot;S&quot;) is special and denotes the unshared s=
ecret (see section &quot;Unshared Secret&quot;).</span></div><div id=3D"gma=
il-magicdomid106" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-og=
z65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">** A payload which is a sequence=
 of up to 74 Bech32 characters. (However, see &#39;&#39;&#39;Long codex32 S=
trings&#39;&#39;&#39; below for an exception to this limit.)</span></div><d=
iv id=3D"gmail-magicdomid107" class=3D"gmail-ace-line"><span class=3D"gmail=
-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">** A checksum which =
consists of 13 Bech32 characters as described below.</span></div><div id=3D=
"gmail-magicdomid108" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-m=
agicdomid109" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65z=
vz65zz90zz81zz90zwz83zdz82zz78zz65zmd">As with Bech32 strings, a codex32 st=
ring MUST be entirely uppercase or entirely lowercase.</span></div><div id=
=3D"gmail-magicdomid110" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The lowercase form is use=
d when determining a character&#39;s value for checksum purposes.</span></d=
iv><div id=3D"gmail-magicdomid111" class=3D"gmail-ace-line"><span class=3D"=
gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">For presentatio=
n, lowercase is usually preferable, but uppercase SHOULD be used for handwr=
itten codex32 strings.</span></div><div id=3D"gmail-magicdomid112" class=3D=
"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid113" class=3D"gmail-a=
ce-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78=
zz65zmd">=3D=3D=3DChecksum=3D=3D=3D</span></div><div id=3D"gmail-magicdomid=
114" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid115" cla=
ss=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90z=
wz83zdz82zz78zz65zmd">The last thirteen characters of the data part form a =
checksum and contain no information.</span></div><div id=3D"gmail-magicdomi=
d116" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90=
zz81zz90zwz83zdz82zz78zz65zmd">Valid strings MUST pass the criteria for val=
idity specified by the Python3 code snippet below.</span></div><div id=3D"g=
mail-magicdomid117" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-=
ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The function &lt;code&gt;ms32_=
verify_checksum&lt;/code&gt; must return true when its argument is the data=
 part as a list of integers representing the characters converted using the=
 bech32 character table from BIP-0173.</span></div><div id=3D"gmail-magicdo=
mid118" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid119" =
class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz=
90zwz83zdz82zz78zz65zmd">To construct a valid checksum given the data-part =
characters (excluding the checksum), the &lt;code&gt;ms32_create_checksum&l=
t;/code&gt; function can be used.</span></div><div id=3D"gmail-magicdomid12=
0" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid121" class=
=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz=
83zdz82zz78zz65zmd">&lt;source lang=3D&quot;python&quot;&gt;</span></div><d=
iv id=3D"gmail-magicdomid122" class=3D"gmail-ace-line"><span class=3D"gmail=
-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">MS32_CONST =3D 0x10c=
e0795c2fd1e62a</span></div><div id=3D"gmail-magicdomid123" class=3D"gmail-a=
ce-line"><br></div><div id=3D"gmail-magicdomid124" class=3D"gmail-ace-line"=
><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd"=
>def ms32_polymod(values):</span></div><div id=3D"gmail-magicdomid125" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 GEN =3D [</span></div><div id=3D"gm=
ail-magicdomid126" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-o=
gz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 0x19dc500ce73fde210,</span></div><div id=3D"gmail-magicdomid12=
7" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz8=
1zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 0x1b=
fae00def77fe529,</span></div><div id=3D"gmail-magicdomid128" class=3D"gmail=
-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz=
78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 0x1fbd920fffe7bee52,<=
/span></div><div id=3D"gmail-magicdomid129" class=3D"gmail-ace-line"><span =
class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 0x1739640bdeee3fdad,</span></div><div =
id=3D"gmail-magicdomid130" class=3D"gmail-ace-line"><span class=3D"gmail-au=
thor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 0x07729a039cfc75f5a,</span></div><div id=3D"gmail-mag=
icdomid131" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz=
65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 ]</span></div><div =
id=3D"gmail-magicdomid132" class=3D"gmail-ace-line"><span class=3D"gmail-au=
thor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 resi=
due =3D 0x23181b3</span></div><div id=3D"gmail-magicdomid133" class=3D"gmai=
l-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82z=
z78zz65zmd">=C2=A0=C2=A0=C2=A0 for v in values:</span></div><div id=3D"gmai=
l-magicdomid134" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz=
65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 b =3D (residue &gt;&gt; 60)</span></div><div id=3D"gmail-magicdom=
id135" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz9=
0zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 =
residue =3D (residue &amp; 0x0fffffffffffffff) &lt;&lt; 5 ^ v</span></div><=
div id=3D"gmail-magicdomid136" class=3D"gmail-ace-line"><span class=3D"gmai=
l-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0 for i in range(5):</span></div><div id=3D"gmail-ma=
gicdomid137" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zv=
z65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 residue ^=3D GEN[i] if ((b &gt;&gt; i) &amp;=
 1) else 0</span></div><div id=3D"gmail-magicdomid138" class=3D"gmail-ace-l=
ine"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65=
zmd">=C2=A0=C2=A0=C2=A0 return residue</span></div><div id=3D"gmail-magicdo=
mid139" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid140" =
class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz=
90zwz83zdz82zz78zz65zmd">def ms32_verify_checksum(data):</span></div><div i=
d=3D"gmail-magicdomid141" class=3D"gmail-ace-line"><span class=3D"gmail-aut=
hor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 if le=
n(data) &gt;=3D 96:=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 # =
See Long codex32 Strings</span></div><div id=3D"gmail-magicdomid142" class=
=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz=
83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 return ms32_=
verify_long_checksum(data)</span></div><div id=3D"gmail-magicdomid143" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 if len(data) &lt;=3D 93:</span></di=
v><div id=3D"gmail-magicdomid144" class=3D"gmail-ace-line"><span class=3D"g=
mail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0 return ms32_polymod(data) =3D=3D MS32_CONST</sp=
an></div><div id=3D"gmail-magicdomid145" class=3D"gmail-ace-line"><span cla=
ss=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=
=A0=C2=A0 return False</span></div><div id=3D"gmail-magicdomid146" class=3D=
"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid147" class=3D"gmail-a=
ce-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78=
zz65zmd">def ms32_create_checksum(data):</span></div><div id=3D"gmail-magic=
domid148" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65=
zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 if len(data) &gt; 80:=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 # See Long codex3=
2 Strings</span></div><div id=3D"gmail-magicdomid149" class=3D"gmail-ace-li=
ne"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65z=
md">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 return ms32_create_long_chec=
ksum(data)</span></div><div id=3D"gmail-magicdomid150" class=3D"gmail-ace-l=
ine"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65=
zmd">=C2=A0=C2=A0=C2=A0 values =3D data</span></div><div id=3D"gmail-magicd=
omid151" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65z=
z90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 polymod =3D ms32_polym=
od(values + [0] * 13) ^ MS32_CONST</span></div><div id=3D"gmail-magicdomid1=
52" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz=
81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 return [(polymod &gt;&gt; 5=
 * (12 - i)) &amp; 31 for i in range(13)]</span></div><div id=3D"gmail-magi=
cdomid153" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz6=
5zz90zz81zz90zwz83zdz82zz78zz65zmd">&lt;/source&gt;</span></div><div id=3D"=
gmail-magicdomid154" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-ma=
gicdomid155" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zv=
z65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DError Correction=3D=3D=3D</s=
pan></div><div id=3D"gmail-magicdomid156" class=3D"gmail-ace-line"><br></di=
v><div id=3D"gmail-magicdomid157" class=3D"gmail-ace-line"><span class=3D"g=
mail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">A codex32 string=
 without a valid checksum MUST NOT be used.</span></div><div id=3D"gmail-ma=
gicdomid158" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zv=
z65zz90zz81zz90zwz83zdz82zz78zz65zmd">The checksum is designed to be an err=
or correcting code that can correct up to 4 character substitutions, up to =
8 unreadable characters (called erasures), or up to 13 consecutive erasures=
.</span></div><div id=3D"gmail-magicdomid159" class=3D"gmail-ace-line"><spa=
n class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Impl=
ementations SHOULD provide the user with a corrected valid codex32 string i=
f possible.</span></div><div id=3D"gmail-magicdomid160" class=3D"gmail-ace-=
line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz6=
5zmd">However, implementations SHOULD NOT automatically proceed with a corr=
ected codex32 string without user confirmation of the corrected string, eit=
her by prompting the user, or returning a corrected string in an error mess=
age and allowing the user to repeat their action.</span></div><div id=3D"gm=
ail-magicdomid161" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-o=
gz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">We do not specify how an implem=
entation should implement error correction. However, we recommend that:</sp=
an></div><div id=3D"gmail-magicdomid162" class=3D"gmail-ace-line"><br></div=
><div id=3D"gmail-magicdomid163" class=3D"gmail-ace-line"><span class=3D"gm=
ail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Implementations=
 make suggestions to substitute non-bech32 characters with bech32 character=
s in some situations, such as replacing &quot;B&quot; with &quot;8&quot;, &=
quot;O&quot; with &quot;0&quot;, &quot;I&quot; with &quot;l&quot;, etc.</sp=
an></div><div id=3D"gmail-magicdomid164" class=3D"gmail-ace-line"><span cla=
ss=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Impleme=
ntations interpret &quot;?&quot; as an erasure.</span></div><div id=3D"gmai=
l-magicdomid165" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz=
65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Implementations optionally inte=
rpret other non-bech32 characters, or characters with incorrect case, as er=
asures.</span></div><div id=3D"gmail-magicdomid166" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">* If a string with 8 or fewer erasures can have those erasures filled in =
to make a valid codex32 string, then the implementation suggests such a str=
ing as a correction.</span></div><div id=3D"gmail-magicdomid167" class=3D"g=
mail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz=
82zz78zz65zmd">* If a string consisting of valid Bech32 characters in the p=
roper case can be made valid by substituting 4 or fewer characters, then th=
e implementation suggests such a string as a correction.</span></div><div i=
d=3D"gmail-magicdomid168" class=3D"gmail-ace-line"><br></div><div id=3D"gma=
il-magicdomid169" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-og=
z65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DUnshared Secret=3D=3D=
=3D</span></div><div id=3D"gmail-magicdomid170" class=3D"gmail-ace-line"><b=
r></div><div id=3D"gmail-magicdomid171" class=3D"gmail-ace-line"><span clas=
s=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">When the s=
hare index of a valid codex32 string (converted to lowercase) is the letter=
 &quot;s&quot;, we call the string a codex32 secret.</span></div><div id=3D=
"gmail-magicdomid172" class=3D"gmail-ace-line"><span class=3D"gmail-author-=
a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The subsequent data characte=
rs in a codex32 secret, excluding the final checksum of 13 characters, is a=
 direct encoding of a BIP-0032 HD master seed.</span></div><div id=3D"gmail=
-magicdomid173" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdo=
mid174" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">The master seed is decoded by converting t=
he data to bytes:</span></div><div id=3D"gmail-magicdomid175" class=3D"gmai=
l-ace-line"><br></div><div id=3D"gmail-magicdomid176" class=3D"gmail-ace-li=
ne"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65z=
md">* Translate the characters to 5 bits values using the bech32 character =
table from BIP-0173, most significant bit first.</span></div><div id=3D"gma=
il-magicdomid177" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-og=
z65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Re-arrange those bits into gro=
ups of 8 bits. Any incomplete group at the end MUST be 4 bits or less, and =
is discarded.</span></div><div id=3D"gmail-magicdomid178" class=3D"gmail-ac=
e-line"><br></div><div id=3D"gmail-magicdomid179" class=3D"gmail-ace-line">=
<span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=
Note that unlike the decoding process in BIP-0173, we do NOT require that t=
he incomplete group be all zeros.</span></div><div id=3D"gmail-magicdomid18=
0" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid181" class=
=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz=
83zdz82zz78zz65zmd">For an unshared secret, the threshold parameter (the fi=
rst character of the data part) is ignored (beyond the fact it must be a di=
git for the codex32 string to be valid).</span></div><div id=3D"gmail-magic=
domid182" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65=
zz90zz81zz90zwz83zdz82zz78zz65zmd">We recommend using the digit &quot;0&quo=
t; for the threshold parameter in this case.</span></div><div id=3D"gmail-m=
agicdomid183" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65z=
vz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The 4 character identifier also has =
no effect beyond aiding users in distinguishing between multiple different =
master seeds in cases where they have more than one.</span></div><div id=3D=
"gmail-magicdomid184" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-m=
agicdomid185" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65z=
vz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DRecovering Master Seed=3D=
=3D=3D</span></div><div id=3D"gmail-magicdomid186" class=3D"gmail-ace-line"=
><br></div><div id=3D"gmail-magicdomid187" class=3D"gmail-ace-line"><span c=
lass=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">When th=
e share index of a valid codex32 string (converted to lowercase) is not the=
 letter &quot;s&quot;, we call the string an codex32 share.</span></div><di=
v id=3D"gmail-magicdomid188" class=3D"gmail-ace-line"><span class=3D"gmail-=
author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The first character o=
f the data part indicates the threshold of the share, and it is required to=
 be a non-&quot;0&quot; digit.</span></div><div id=3D"gmail-magicdomid189" =
class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid190" class=3D=
"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83z=
dz82zz78zz65zmd">In order to recover a master seed, one needs a set of vali=
d codex32 shares such that:</span></div><div id=3D"gmail-magicdomid191" cla=
ss=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid192" class=3D"gm=
ail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz8=
2zz78zz65zmd">* All shares have the same threshold value, the same identifi=
er, and the same length.</span></div><div id=3D"gmail-magicdomid193" class=
=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz=
83zdz82zz78zz65zmd">* All of the share index values are distinct.</span></d=
iv><div id=3D"gmail-magicdomid194" class=3D"gmail-ace-line"><span class=3D"=
gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* The number of=
 codex32 shares is exactly equal to the (common) threshold value.</span></d=
iv><div id=3D"gmail-magicdomid195" class=3D"gmail-ace-line"><br></div><div =
id=3D"gmail-magicdomid196" class=3D"gmail-ace-line"><span class=3D"gmail-au=
thor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">If all the above condit=
ions are satisfied, the &lt;code&gt;ms32_recover&lt;/code&gt; function will=
 return a codex32 secret when its argument is the list of codex32 shares wi=
th each share represented as a list of integers representing the characters=
 converted using the bech32 character table from BIP-0173.</span></div><div=
 id=3D"gmail-magicdomid197" class=3D"gmail-ace-line"><br></div><div id=3D"g=
mail-magicdomid198" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-=
ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">&lt;source lang=3D&quot;python=
&quot;&gt;</span></div><div id=3D"gmail-magicdomid199" class=3D"gmail-ace-l=
ine"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65=
zmd">bech32_inv =3D [</span></div><div id=3D"gmail-magicdomid200" class=3D"=
gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zd=
z82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 0, 1, 20, 24, 10, 8, 12, 29, 5, 11, 4, 9=
, 6, 28, 26, 31,</span></div><div id=3D"gmail-magicdomid201" class=3D"gmail=
-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz=
78zz65zmd">=C2=A0=C2=A0=C2=A0 22, 18, 17, 23, 2, 25, 16, 19, 3, 21, 14, 30,=
 13, 7, 27, 15,</span></div><div id=3D"gmail-magicdomid202" class=3D"gmail-=
ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz7=
8zz65zmd">]</span></div><div id=3D"gmail-magicdomid203" class=3D"gmail-ace-=
line"><br></div><div id=3D"gmail-magicdomid204" class=3D"gmail-ace-line"><s=
pan class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">de=
f bech32_mul(a, b):</span></div><div id=3D"gmail-magicdomid205" class=3D"gm=
ail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz8=
2zz78zz65zmd">=C2=A0=C2=A0=C2=A0 res =3D 0</span></div><div id=3D"gmail-mag=
icdomid206" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz=
65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 for i in range(5):<=
/span></div><div id=3D"gmail-magicdomid207" class=3D"gmail-ace-line"><span =
class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 res ^=3D a if ((b &gt;&gt; i) &amp; 1)=
 else 0</span></div><div id=3D"gmail-magicdomid208" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 a *=3D 2</span></div><div id=
=3D"gmail-magicdomid209" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 a ^=3D 41 if (32 &lt;=3D a) else 0</span></div><div id=
=3D"gmail-magicdomid210" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 return=
 res</span></div><div id=3D"gmail-magicdomid211" class=3D"gmail-ace-line"><=
br></div><div id=3D"gmail-magicdomid212" class=3D"gmail-ace-line"><span cla=
ss=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">def bech3=
2_lagrange(l, x):</span></div><div id=3D"gmail-magicdomid213" class=3D"gmai=
l-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82z=
z78zz65zmd">=C2=A0=C2=A0=C2=A0 n =3D 1</span></div><div id=3D"gmail-magicdo=
mid214" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 c =3D []</span></div><d=
iv id=3D"gmail-magicdomid215" class=3D"gmail-ace-line"><span class=3D"gmail=
-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 f=
or i in l:</span></div><div id=3D"gmail-magicdomid216" class=3D"gmail-ace-l=
ine"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65=
zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 n =3D bech32_mul(n, i ^ x)<=
/span></div><div id=3D"gmail-magicdomid217" class=3D"gmail-ace-line"><span =
class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 m =3D 1</span></div><div id=3D"gmail-m=
agicdomid218" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65z=
vz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 for j in l:</span></div><div id=3D"gmail-magicdomid219" class=3D"gma=
il-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82=
zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 m =3D bech32_mul(m, (x if i =3D=3D j else i) ^ j)</span></div><div i=
d=3D"gmail-magicdomid220" class=3D"gmail-ace-line"><span class=3D"gmail-aut=
hor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 c.append(m)</span></div><div id=3D"gmail-magicdomid221" =
class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz=
90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 return [bech32_mul(n, bech32_in=
v[i]) for i in c]</span></div><div id=3D"gmail-magicdomid222" class=3D"gmai=
l-ace-line"><br></div><div id=3D"gmail-magicdomid223" class=3D"gmail-ace-li=
ne"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65z=
md">def ms32_interpolate(l, x):</span></div><div id=3D"gmail-magicdomid224"=
 class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81z=
z90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 w =3D bech32_lagrange([s[5] fo=
r s in l], x)</span></div><div id=3D"gmail-magicdomid225" class=3D"gmail-ac=
e-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78z=
z65zmd">=C2=A0=C2=A0=C2=A0 res =3D []</span></div><div id=3D"gmail-magicdom=
id226" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz9=
0zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 for i in range(len(l[0])=
):</span></div><div id=3D"gmail-magicdomid227" class=3D"gmail-ace-line"><sp=
an class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 n =3D 0</span></div><div id=3D"gmai=
l-magicdomid228" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz=
65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0 for j in range(len(l)):</span></div><div id=3D"gmail-magicdomid22=
9" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz8=
1zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 n ^=3D bech32_mul(w[j], l[j][i])</span></div><div id=
=3D"gmail-magicdomid230" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0=C2=A0 res.append(n)</span></div><div id=3D"gmail-magicdomid231=
" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81=
zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 return res</span></div><div i=
d=3D"gmail-magicdomid232" class=3D"gmail-ace-line"><br></div><div id=3D"gma=
il-magicdomid233" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-og=
z65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">def ms32_recover(l):</span></div=
><div id=3D"gmail-magicdomid234" class=3D"gmail-ace-line"><span class=3D"gm=
ail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=
=A0 return ms32_interpolate(l, 16)</span></div><div id=3D"gmail-magicdomid2=
35" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz=
81zz90zwz83zdz82zz78zz65zmd">&lt;/source&gt;</span></div><div id=3D"gmail-m=
agicdomid236" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomi=
d237" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90=
zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DGenerating Shares=3D=3D=3D</span></=
div><div id=3D"gmail-magicdomid238" class=3D"gmail-ace-line"><br></div><div=
 id=3D"gmail-magicdomid239" class=3D"gmail-ace-line"><span class=3D"gmail-a=
uthor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">If we already have &#3=
9;&#39;t&#39;&#39; valid codex32 strings such that:</span></div><div id=3D"=
gmail-magicdomid240" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-ma=
gicdomid241" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zv=
z65zz90zz81zz90zwz83zdz82zz78zz65zmd">* All strings have the same threshold=
 value &#39;&#39;t&#39;&#39;, the same identifier, and the same length</spa=
n></div><div id=3D"gmail-magicdomid242" class=3D"gmail-ace-line"><span clas=
s=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* All of t=
he share index values are distinct</span></div><div id=3D"gmail-magicdomid2=
43" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid244" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">Then we can derive additional shares with the &lt;code=
&gt;ms32_interpolate&lt;/code&gt; function by passing it a list of exactly =
&#39;&#39;t&#39;&#39; of these codex32 strings, together with a fresh share=
 index distinct from all of the existing share indexes.</span></div><div id=
=3D"gmail-magicdomid245" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The newly derived share w=
ill have the provided share index.</span></div><div id=3D"gmail-magicdomid2=
46" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid247" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">Once a user has generated &#39;&#39;n&#39;&#39; codex3=
2 shares, they may discard the codex32 secret (if it exists).</span></div><=
div id=3D"gmail-magicdomid248" class=3D"gmail-ace-line"><span class=3D"gmai=
l-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The &#39;&#39;n&#39=
;&#39; shares form a &#39;&#39;t&#39;&#39; of &#39;&#39;n&#39;&#39; Shamir&=
#39;s secret sharing scheme of a codex32 secret.</span></div><div id=3D"gma=
il-magicdomid249" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magic=
domid250" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65=
zz90zz81zz90zwz83zdz82zz78zz65zmd">There are two ways to create an initial =
set of &#39;&#39;t&#39;&#39; valid codex32 strings, depending on whether th=
e user already has an existing master seed to split.</span></div><div id=3D=
"gmail-magicdomid251" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-m=
agicdomid252" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65z=
vz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3D=3DFor an existing master s=
eed=3D=3D=3D=3D</span></div><div id=3D"gmail-magicdomid253" class=3D"gmail-=
ace-line"><br></div><div id=3D"gmail-magicdomid254" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">Before generating shares for an existing master seed, it first must be co=
nverted into a codex32 secret, as described above.</span></div><div id=3D"g=
mail-magicdomid255" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-=
ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The conversion process consist=
s of:</span></div><div id=3D"gmail-magicdomid256" class=3D"gmail-ace-line">=
<br></div><div id=3D"gmail-magicdomid257" class=3D"gmail-ace-line"><span cl=
ass=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Choosi=
ng a threshold value &#39;&#39;t&#39;&#39; between 2 and 9, inclusive</span=
></div><div id=3D"gmail-magicdomid258" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Choosing =
a 4 bech32 character identifier</span></div><div id=3D"gmail-magicdomid259"=
 class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81z=
z90zwz83zdz82zz78zz65zmd">** We do not define how to choose the identifier,=
 beyond noting that it SHOULD be distinct for every master seed the user ma=
y need to disambiguate.</span></div><div id=3D"gmail-magicdomid260" class=
=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz=
83zdz82zz78zz65zmd">* Setting the share index to &quot;s&quot;</span></div>=
<div id=3D"gmail-magicdomid261" class=3D"gmail-ace-line"><span class=3D"gma=
il-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Setting the payl=
oad to a Bech32 encoding of the master seed, padded with arbitrary bits</sp=
an></div><div id=3D"gmail-magicdomid262" class=3D"gmail-ace-line"><span cla=
ss=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Generat=
ing a valid checksum in accordance with the Checksum section</span></div><d=
iv id=3D"gmail-magicdomid263" class=3D"gmail-ace-line"><br></div><div id=3D=
"gmail-magicdomid264" class=3D"gmail-ace-line"><span class=3D"gmail-author-=
a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Along with the codex32 secre=
t, the user must generate &#39;&#39;t&#39;&#39;-1 other codex32 shares, eac=
h with the same threshold value, the same identifier, and a distinct share =
index.</span></div><div id=3D"gmail-magicdomid265" class=3D"gmail-ace-line"=
><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd"=
>The set of share indexes may be chosen arbitrarily.</span></div><div id=3D=
"gmail-magicdomid266" class=3D"gmail-ace-line"><span class=3D"gmail-author-=
a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The payload of each of these=
 codex32 shares is chosen uniformly at random such that it has the same len=
gth as the payload of the codex32 secret.</span></div><div id=3D"gmail-magi=
cdomid267" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz6=
5zz90zz81zz90zwz83zdz82zz78zz65zmd">For each share, a valid checksum must b=
e generated in accordance with the Checksum section.</span></div><div id=3D=
"gmail-magicdomid268" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-m=
agicdomid269" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65z=
vz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The codex32 secret and the &#39;&#39=
;t&#39;&#39;-1 codex32 shares form a set of &#39;&#39;t&#39;&#39; valid cod=
ex32 strings from which additional shares can be derived as described above=
.</span></div><div id=3D"gmail-magicdomid270" class=3D"gmail-ace-line"><br>=
</div><div id=3D"gmail-magicdomid271" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3D=
=3DFor a fresh master seed=3D=3D=3D=3D</span></div><div id=3D"gmail-magicdo=
mid272" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid273" =
class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz=
90zwz83zdz82zz78zz65zmd">In the case that the user wishes to generate a fre=
sh master seed, the user chooses a threshold value &#39;&#39;t&#39;&#39; an=
d an identifier, then generates &#39;&#39;t&#39;&#39; random codex32 shares=
, using the generation procedure from the previous section.</span></div><di=
v id=3D"gmail-magicdomid274" class=3D"gmail-ace-line"><span class=3D"gmail-=
author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">As before, each share=
 must have the same threshold value &#39;&#39;t&#39;&#39;, the same identif=
ier, and a distinct share index.</span></div><div id=3D"gmail-magicdomid275=
" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid276" class=
=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz=
83zdz82zz78zz65zmd">With this set of &#39;&#39;t&#39;&#39; codex32 shares, =
new shares can be derived as discussed above. This process generates a fres=
h master seed, whose value can be retrieved by running the recovery process=
 on any &#39;&#39;t&#39;&#39; of these shares.</span></div><div id=3D"gmail=
-magicdomid277" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdo=
mid278" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DLong codex32 Strings=3D=3D=3D</sp=
an></div><div id=3D"gmail-magicdomid279" class=3D"gmail-ace-line"><br></div=
><div id=3D"gmail-magicdomid280" class=3D"gmail-ace-line"><span class=3D"gm=
ail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The 13 character =
checksum design only supports up to 80 data characters.</span></div><div id=
=3D"gmail-magicdomid281" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Excluding the threshold, =
identifier and index characters, this limits the payload to 74 characters o=
r 46 bytes.</span></div><div id=3D"gmail-magicdomid282" class=3D"gmail-ace-=
line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz6=
5zmd">While this is enough to support the 32-byte advised size of BIP-0032 =
master seeds, BIP-0032 allows seeds to be up to 64 bytes in size.</span></d=
iv><div id=3D"gmail-magicdomid283" class=3D"gmail-ace-line"><span class=3D"=
gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">We define a lon=
g codex32 string format to support these longer seeds by defining an altern=
ative checksum.</span></div><div id=3D"gmail-magicdomid284" class=3D"gmail-=
ace-line"><br></div><div id=3D"gmail-magicdomid285" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">&lt;source lang=3D&quot;python&quot;&gt;</span></div><div id=3D"gmail-mag=
icdomid286" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz=
65zz90zz81zz90zwz83zdz82zz78zz65zmd">MS32_LONG_CONST =3D 0x43381e570bf4798a=
b26</span></div><div id=3D"gmail-magicdomid287" class=3D"gmail-ace-line"><b=
r></div><div id=3D"gmail-magicdomid288" class=3D"gmail-ace-line"><span clas=
s=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">def ms32_l=
ong_polymod(values):</span></div><div id=3D"gmail-magicdomid289" class=3D"g=
mail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz=
82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 GEN =3D [</span></div><div id=3D"gmail-ma=
gicdomid290" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zv=
z65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0 0x3d59d273535ea62d897,</span></div><div id=3D"gmail-magicdomid291" c=
lass=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz9=
0zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 0x7a9bec=
b6361c6c51507,</span></div><div id=3D"gmail-magicdomid292" class=3D"gmail-a=
ce-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78=
zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 0x543f9b7e6c38d8a2a0e,<=
/span></div><div id=3D"gmail-magicdomid293" class=3D"gmail-ace-line"><span =
class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=
=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 0x0c577eaeccf1990d13c,</span></div><di=
v id=3D"gmail-magicdomid294" class=3D"gmail-ace-line"><span class=3D"gmail-=
author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0 0x1887f74f8dc71b10651,</span></div><div id=3D"gmail-m=
agicdomid295" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65z=
vz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 ]</span></div><di=
v id=3D"gmail-magicdomid296" class=3D"gmail-ace-line"><span class=3D"gmail-=
author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 re=
sidue =3D 0x23181b3</span></div><div id=3D"gmail-magicdomid297" class=3D"gm=
ail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz8=
2zz78zz65zmd">=C2=A0=C2=A0=C2=A0 for v in values:</span></div><div id=3D"gm=
ail-magicdomid298" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-o=
gz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=
=C2=A0=C2=A0 b =3D (residue &gt;&gt; 70)</span></div><div id=3D"gmail-magic=
domid299" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65=
zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0 residue =3D (residue &amp; 0x3fffffffffffffffff) &lt;&lt; 5 ^ v</span><=
/div><div id=3D"gmail-magicdomid300" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 for i in range(5):</span></div><div id=3D=
"gmail-magicdomid301" class=3D"gmail-ace-line"><span class=3D"gmail-author-=
a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0=C2=A0=C2=
=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0=C2=A0 residue ^=3D GEN[i] if ((b &gt;&gt;=
 i) &amp; 1) else 0</span></div><div id=3D"gmail-magicdomid302" class=3D"gm=
ail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz8=
2zz78zz65zmd">=C2=A0=C2=A0=C2=A0 return residue</span></div><div id=3D"gmai=
l-magicdomid303" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicd=
omid304" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65z=
z90zz81zz90zwz83zdz82zz78zz65zmd">def ms32_verify_long_checksum(data):</spa=
n></div><div id=3D"gmail-magicdomid305" class=3D"gmail-ace-line"><span clas=
s=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=
=A0=C2=A0 return ms32_long_polymod(data) =3D=3D MS32_LONG_CONST</span></div=
><div id=3D"gmail-magicdomid306" class=3D"gmail-ace-line"><br></div><div id=
=3D"gmail-magicdomid307" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">def ms32_create_long_chec=
ksum(data):</span></div><div id=3D"gmail-magicdomid308" class=3D"gmail-ace-=
line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz6=
5zmd">=C2=A0=C2=A0=C2=A0 values =3D data</span></div><div id=3D"gmail-magic=
domid309" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65=
zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 polymod =3D ms32_long=
_polymod(values + [0] * 15) ^ MS32_LONG_CONST</span></div><div id=3D"gmail-=
magicdomid310" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65=
zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 return [(polymod=
 &gt;&gt; 5 * (14 - i)) &amp; 31 for i in range(15)]</span></div><div id=3D=
"gmail-magicdomid311" class=3D"gmail-ace-line"><span class=3D"gmail-author-=
a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">&lt;/source&gt;</span></div>=
<div id=3D"gmail-magicdomid312" class=3D"gmail-ace-line"><br></div><div id=
=3D"gmail-magicdomid313" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">A long codex32 string fol=
lows the same specification as a regular codex32 string with the following =
changes.</span></div><div id=3D"gmail-magicdomid314" class=3D"gmail-ace-lin=
e"><br></div><div id=3D"gmail-magicdomid315" class=3D"gmail-ace-line"><span=
 class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* The=
 payload is a sequence of between 75 and 103 Bech32 characters.</span></div=
><div id=3D"gmail-magicdomid316" class=3D"gmail-ace-line"><span class=3D"gm=
ail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* The checksum co=
nsists of 15 Bech32 characters as defined above.</span></div><div id=3D"gma=
il-magicdomid317" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magic=
domid318" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65=
zz90zz81zz90zwz83zdz82zz78zz65zmd">A codex32 string with a data part of 94 =
or 95 characters is never legal as a regular codex32 string is limited to 9=
3 data characters and a long codex32 string is at least 96 characters.</spa=
n></div><div id=3D"gmail-magicdomid319" class=3D"gmail-ace-line"><br></div>=
<div id=3D"gmail-magicdomid320" class=3D"gmail-ace-line"><span class=3D"gma=
il-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Generation of long=
 shares and recovery of the master seed from long shares proceeds in exactl=
y the same way as for regular shares with the &lt;code&gt;ms32_interpolate&=
lt;/code&gt; function.</span></div><div id=3D"gmail-magicdomid321" class=3D=
"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid322" class=3D"gmail-a=
ce-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78=
zz65zmd">The long checksum is designed to be an error correcting code that =
can correct up to 4 character substitutions, up to 8 unreadable characters =
(called erasures), or up to 15 consecutive erasures.</span></div><div id=3D=
"gmail-magicdomid323" class=3D"gmail-ace-line"><span class=3D"gmail-author-=
a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">As with regular checksums we=
 do not specify how an implementation should implement error correction, an=
d all our recommendations for error correction of regular codex32 strings a=
lso apply to long codex32 strings.</span></div><div id=3D"gmail-magicdomid3=
24" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid325" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">=3D=3DRationale=3D=3D</span></div><div id=3D"gmail-mag=
icdomid326" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid3=
27" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz=
81zz90zwz83zdz82zz78zz65zmd">This scheme is based on the observation that t=
he Lagrange interpolation of valid codewords in a BCH code will always be a=
 valid codeword.</span></div><div id=3D"gmail-magicdomid328" class=3D"gmail=
-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz=
78zz65zmd">This means that derived shares will always have valid checksum, =
and a sufficient threshold of shares with valid checksums will derive a sec=
ret with a valid checksum.</span></div><div id=3D"gmail-magicdomid329" clas=
s=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid330" class=3D"gma=
il-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82=
zz78zz65zmd">The header system is also compatible with Lagrange interpolati=
on, meaning all derived shares will have the same identifier and will have =
the appropriate share index.</span></div><div id=3D"gmail-magicdomid331" cl=
ass=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90=
zwz83zdz82zz78zz65zmd">This fact allows the header data to be covered by th=
e checksum.</span></div><div id=3D"gmail-magicdomid332" class=3D"gmail-ace-=
line"><br></div><div id=3D"gmail-magicdomid333" class=3D"gmail-ace-line"><s=
pan class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Th=
e checksum size and identifier size have been chosen so that the encoding o=
f 128-bit seeds and shares fit within 48 characters.</span></div><div id=3D=
"gmail-magicdomid334" class=3D"gmail-ace-line"><span class=3D"gmail-author-=
a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">This is a standard size for =
many common seed storage formats, which has been popularized by the 12 four=
-letter word format of the BIP-0039 mnemonic.</span></div><div id=3D"gmail-=
magicdomid335" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdom=
id336" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz9=
0zz81zz90zwz83zdz82zz78zz65zmd">The 13 character checksum is adequate to co=
rrect 4 errors in up to 93 characters (80 characters of data and 13 charact=
ers of the checksum). This is somewhat better quality than the checksum use=
d in SLIP-0039.</span></div><div id=3D"gmail-magicdomid337" class=3D"gmail-=
ace-line"><br></div><div id=3D"gmail-magicdomid338" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">For 256-bit seeds and shares our strings are 74 characters, which fits in=
to the 96 character format of the 24 four-letter word format of the BIP-003=
9 mnemonic, with plenty of room to spare.</span></div><div id=3D"gmail-magi=
cdomid339" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid34=
0" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz8=
1zz90zwz83zdz82zz78zz65zmd">A longer checksum is needed to support up to 51=
2-bit seeds, the longest seed length specified in BIP-0032, as the 13 chara=
cter checksum isn&#39;t adequate for more than 80 data characters.</span></=
div><div id=3D"gmail-magicdomid341" class=3D"gmail-ace-line"><span class=3D=
"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">While we could=
 use the 15 character checksum for both cases, we prefer to keep the string=
s as short as possible for the more common cases of 128-bit and 256-bit mas=
ter seeds.</span></div><div id=3D"gmail-magicdomid342" class=3D"gmail-ace-l=
ine"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65=
zmd">We only guarantee to correct 4 characters no matter how long the strin=
g is.</span></div><div id=3D"gmail-magicdomid343" class=3D"gmail-ace-line">=
<span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=
Longer strings mean more chances for transcription errors, so shorter strin=
gs are better.</span></div><div id=3D"gmail-magicdomid344" class=3D"gmail-a=
ce-line"><br></div><div id=3D"gmail-magicdomid345" class=3D"gmail-ace-line"=
><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd"=
>The longest data part using the regular 13 character checksum is 93 charac=
ters and corresponds to a 400-bit secret.</span></div><div id=3D"gmail-magi=
cdomid346" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz6=
5zz90zz81zz90zwz83zdz82zz78zz65zmd">At this length, the prefix &lt;code&gt;=
MS1&lt;/code&gt; is not covered by the checksum.</span></div><div id=3D"gma=
il-magicdomid347" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-og=
z65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">This is acceptable because the c=
hecksum scheme itself requires you to know that the &lt;code&gt;MS1&lt;/cod=
e&gt; prefix is being used in the first place.</span></div><div id=3D"gmail=
-magicdomid348" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz6=
5zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">If the prefix is damaged and a use=
r is guessing that the data might be using this scheme, then the user can e=
nter the available data explicitly using the suspected &lt;code&gt;MS1&lt;/=
code&gt; prefix.</span></div><div id=3D"gmail-magicdomid349" class=3D"gmail=
-ace-line"><br></div><div id=3D"gmail-magicdomid350" class=3D"gmail-ace-lin=
e"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zm=
d">=3D=3DBackwards Compatibility=3D=3D</span></div><div id=3D"gmail-magicdo=
mid351" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid352" =
class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz=
90zwz83zdz82zz78zz65zmd">codex32 is an alternative to BIP-0039 and SLIP-003=
9.</span></div><div id=3D"gmail-magicdomid353" class=3D"gmail-ace-line"><sp=
an class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">It =
is technically possible to derive the BIP32 master seed from seed words enc=
oded in one of these schemes, and then to encode this seed in codex32.</spa=
n></div><div id=3D"gmail-magicdomid354" class=3D"gmail-ace-line"><span clas=
s=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">For BIP-00=
39 this process is irreversible, since it involves hashing the original wor=
ds.</span></div><div id=3D"gmail-magicdomid355" class=3D"gmail-ace-line"><s=
pan class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Fu=
rthermore, the resulting seed will be 512 bits long, which may be too large=
 to be safely and conveniently handled.</span></div><div id=3D"gmail-magicd=
omid356" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid357"=
 class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81z=
z90zwz83zdz82zz78zz65zmd">SLIP-0039 seed words can be reversibly converted =
to master seeds, so it is possible to interconvert between SLIP-0039 and co=
dex32.</span></div><div id=3D"gmail-magicdomid358" class=3D"gmail-ace-line"=
><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd"=
>However, SLIP-0039 &#39;&#39;&#39;shares&#39;&#39;&#39; cannot be converte=
d to codex32 shares because the two schemes use a different underlying fiel=
d.</span></div><div id=3D"gmail-magicdomid359" class=3D"gmail-ace-line"><br=
></div><div id=3D"gmail-magicdomid360" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The authors=
 of this BIP do not recommend interconversion.</span></div><div id=3D"gmail=
-magicdomid361" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz6=
5zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Instead, users who wish to switch =
to codex32 should generate a fresh seed and sweep their coins.</span></div>=
<div id=3D"gmail-magicdomid362" class=3D"gmail-ace-line"><br></div><div id=
=3D"gmail-magicdomid363" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3DReference Implement=
ation=3D=3D</span></div><div id=3D"gmail-magicdomid364" class=3D"gmail-ace-=
line"><br></div><div id=3D"gmail-magicdomid365" class=3D"gmail-ace-line"><s=
pan class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* =
[</span><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78z=
z65zmd gmail-url"><a href=3D"https://secretcodex32.com/docs/2023-02-14--bw.=
ps" rel=3D"noreferrer noopener">https://secretcodex32.com/docs/2023-02-14--=
bw.ps</a></span><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zd=
z82zz78zz65zmd"> Reference PostScript Implementation]</span></div><div id=
=3D"gmail-magicdomid366" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* FIXME add Python implem=
entation</span></div><div id=3D"gmail-magicdomid367" class=3D"gmail-ace-lin=
e"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zm=
d">* FIXME add Rust implementation</span></div><div id=3D"gmail-magicdomid3=
68" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid369" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">=3D=3DTest Vectors=3D=3D</span></div><div id=3D"gmail-=
magicdomid370" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdom=
id371" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz9=
0zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DTest vector 1=3D=3D=3D</span></div=
><div id=3D"gmail-magicdomid372" class=3D"gmail-ace-line"><br></div><div id=
=3D"gmail-magicdomid373" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">This example shows the co=
dex32 format, when used without splitting the secret into any shares.</span=
></div><div id=3D"gmail-magicdomid374" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The data pa=
rt contains 26 Bech32 characters, which corresponds to 130 bits. We truncat=
e the last two bits in order to obtain a 128-bit master seed.</span></div><=
div id=3D"gmail-magicdomid375" class=3D"gmail-ace-line"><br></div><div id=
=3D"gmail-magicdomid376" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">codex32 secret (Bech32): =
&lt;code&gt;ms10testsxxxxxxxxxxxxxxxxxxxxxxxxxx4nzvca9cmczlw&lt;/code&gt;</=
span></div><div id=3D"gmail-magicdomid377" class=3D"gmail-ace-line"><br></d=
iv><div id=3D"gmail-magicdomid378" class=3D"gmail-ace-line"><span class=3D"=
gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Master secret (=
hex): &lt;code&gt;318c6318c6318c6318c6318c6318c631&lt;/code&gt;</span></div=
><div id=3D"gmail-magicdomid379" class=3D"gmail-ace-line"><br></div><div id=
=3D"gmail-magicdomid380" class=3D"gmail-ace-line"><span class=3D"gmail-auth=
or-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* human-readable part: &l=
t;code&gt;ms&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid381" class=
=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz=
83zdz82zz78zz65zmd">* separator: &lt;code&gt;1&lt;/code&gt;</span></div><di=
v id=3D"gmail-magicdomid382" class=3D"gmail-ace-line"><span class=3D"gmail-=
author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* k value: &lt;code&g=
t;0&lt;/code&gt; (no secret splitting)</span></div><div id=3D"gmail-magicdo=
mid383" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">* identifier: &lt;code&gt;test&lt;/code&gt=
;</span></div><div id=3D"gmail-magicdomid384" class=3D"gmail-ace-line"><spa=
n class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* sh=
are index: &lt;code&gt;s&lt;/code&gt; (the secret)</span></div><div id=3D"g=
mail-magicdomid385" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-=
ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* data: &lt;code&gt;xxxxxxxxxx=
xxxxxxxxxxxxxxxx&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid386" c=
lass=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz9=
0zwz83zdz82zz78zz65zmd">* checksum: &lt;code&gt;4nzvca9cmczlw&lt;/code&gt;<=
/span></div><div id=3D"gmail-magicdomid387" class=3D"gmail-ace-line"><br></=
div><div id=3D"gmail-magicdomid388" class=3D"gmail-ace-line"><span class=3D=
"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DTest =
vector 2=3D=3D=3D</span></div><div id=3D"gmail-magicdomid389" class=3D"gmai=
l-ace-line"><br></div><div id=3D"gmail-magicdomid390" class=3D"gmail-ace-li=
ne"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65z=
md">This example shows generating a new master seed using &quot;random&quot=
; codex32 shares, as well as deriving an additional codex32 share, using &#=
39;&#39;k&#39;&#39;=3D2 and an identifier of &lt;code&gt;NAME&lt;/code&gt;.=
</span></div><div id=3D"gmail-magicdomid391" class=3D"gmail-ace-line"><span=
 class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Altho=
ugh codex32 strings are canonically all lowercase, it&#39;s also valid to u=
se all uppercase.</span></div><div id=3D"gmail-magicdomid392" class=3D"gmai=
l-ace-line"><br></div><div id=3D"gmail-magicdomid393" class=3D"gmail-ace-li=
ne"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65z=
md">Share with index &lt;code&gt;A&lt;/code&gt;: &lt;code&gt;MS12NAMEA320ZY=
XWVUTSRQPNMLKJHGFEDCAXRPP870HKKQRM&lt;/code&gt;</span></div><div id=3D"gmai=
l-magicdomid394" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicd=
omid395" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65z=
z90zz81zz90zwz83zdz82zz78zz65zmd">Share with index &lt;code&gt;C&lt;/code&g=
t;: &lt;code&gt;MS12NAMECACDEFGHJKLMNPQRSTUVWXYZ023FTR2GDZMPY6PN&lt;/code&g=
t;</span></div><div id=3D"gmail-magicdomid396" class=3D"gmail-ace-line"><br=
></div><div id=3D"gmail-magicdomid397" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Derived s=
hare with index &lt;code&gt;D&lt;/code&gt;: &lt;code&gt;MS12NAMEDLL4F8JLH4E=
5VDVULDLFXU2JHDNLSM97XVENRXEG&lt;/code&gt;</span></div><div id=3D"gmail-mag=
icdomid398" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz=
65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Secret share with index &lt;code&gt;=
S&lt;/code&gt;: &lt;code&gt;MS12NAMES6XQGUZTTXKEQNJSJZV4JV3NZ5K3KWGSPHUH6EV=
W&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid399" class=3D"gmail-a=
ce-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78=
zz65zmd">* Master secret (hex): &lt;code&gt;d1808e096b35b209ca12132b264662a=
5&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid400" class=3D"gmail-a=
ce-line"><br></div><div id=3D"gmail-magicdomid401" class=3D"gmail-ace-line"=
><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd"=
>Note that per BIP-0173, the lowercase form is used when determining a char=
acter&#39;s value for checksum purposes.</span></div><div id=3D"gmail-magic=
domid402" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65=
zz90zz81zz90zwz83zdz82zz78zz65zmd">In particular, given an all uppercase co=
dex32 string, we still use lowercase &lt;code&gt;ms&lt;/code&gt; as the hum=
an-readable part during checksum construction.</span></div><div id=3D"gmail=
-magicdomid403" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdo=
mid404" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DTest vector 3=3D=3D=3D</span></di=
v><div id=3D"gmail-magicdomid405" class=3D"gmail-ace-line"><br></div><div i=
d=3D"gmail-magicdomid406" class=3D"gmail-ace-line"><span class=3D"gmail-aut=
hor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">This example shows split=
ting an existing 128-bit master seed into &quot;random&quot; codex32 shares=
, using &#39;&#39;k&#39;&#39;=3D3 and an identifier of &lt;code&gt;cash&lt;=
/code&gt;.</span></div><div id=3D"gmail-magicdomid407" class=3D"gmail-ace-l=
ine"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65=
zmd">We appended two zero bits in order to obtain 26 Bech32 characters (130=
 bits of data) from the 128-bit master seed.</span></div><div id=3D"gmail-m=
agicdomid408" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomi=
d409" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90=
zz81zz90zwz83zdz82zz78zz65zmd">Master secret (hex): &lt;code&gt;ffeeddccbba=
a99887766554433221100&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid4=
10" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid411" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">Secret share with index &lt;code&gt;s&lt;/code&gt;: &l=
t;code&gt;ms13cashsllhdmn9m42vcsamx24zrxgs3qqjzqud4m0d6nln&lt;/code&gt;</sp=
an></div><div id=3D"gmail-magicdomid412" class=3D"gmail-ace-line"><br></div=
><div id=3D"gmail-magicdomid413" class=3D"gmail-ace-line"><span class=3D"gm=
ail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Share with index =
&lt;code&gt;a&lt;/code&gt;: &lt;code&gt;ms13casha320zyxwvutsrqpnmlkjhgfedca=
2a8d0zehn8a0t&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid414" clas=
s=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid415" class=3D"gma=
il-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82=
zz78zz65zmd">Share with index &lt;code&gt;c&lt;/code&gt;: &lt;code&gt;ms13c=
ashcacdefghjklmnpqrstuvwxyz023949xq35my48dr&lt;/code&gt;</span></div><div i=
d=3D"gmail-magicdomid416" class=3D"gmail-ace-line"><br></div><div id=3D"gma=
il-magicdomid417" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-og=
z65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Derived share with index &lt;c=
ode&gt;d&lt;/code&gt;: &lt;code&gt;ms13cashd0wsedstcdcts64cd7wvy4m90lm28w4f=
fupqs7rm&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid418" class=3D"=
gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zd=
z82zz78zz65zmd">* Derived share with index &lt;code&gt;e&lt;/code&gt;: &lt;=
code&gt;ms13casheekgpemxzshcrmqhaydlp6yhms3ws7320xyxsar9&lt;/code&gt;</span=
></div><div id=3D"gmail-magicdomid419" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Derived s=
hare with index &lt;code&gt;f&lt;/code&gt;: &lt;code&gt;ms13cashf8jh6sdrkpy=
rsp5ut94pj8ktehhw2hfvyrj48704&lt;/code&gt;</span></div><div id=3D"gmail-mag=
icdomid420" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid4=
21" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz=
81zz90zwz83zdz82zz78zz65zmd">Any three of the five shares among &lt;code&gt=
;acdef&lt;/code&gt; can be used to recover the secret.</span></div><div id=
=3D"gmail-magicdomid422" class=3D"gmail-ace-line"><br></div><div id=3D"gmai=
l-magicdomid423" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz=
65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">Note that the choice to append tw=
o zero bits was arbitrary, and any of the following four secret shares woul=
d have been valid choices.</span></div><div id=3D"gmail-magicdomid424" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">However, each choice would have resulted in a differen=
t set of derived shares.</span></div><div id=3D"gmail-magicdomid425" class=
=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid426" class=3D"gmai=
l-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82z=
z78zz65zmd">* &lt;code&gt;ms13cashsllhdmn9m42vcsamx24zrxgs3qqjzqud4m0d6nln&=
lt;/code&gt;</span></div><div id=3D"gmail-magicdomid427" class=3D"gmail-ace=
-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz=
65zmd">* &lt;code&gt;ms13cashsllhdmn9m42vcsamx24zrxgs3qpte35dvzkjpt0r&lt;/c=
ode&gt;</span></div><div id=3D"gmail-magicdomid428" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">* &lt;code&gt;ms13cashsllhdmn9m42vcsamx24zrxgs3qzfatvdwq5692k6&lt;/code&g=
t;</span></div><div id=3D"gmail-magicdomid429" class=3D"gmail-ace-line"><sp=
an class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* &=
lt;code&gt;ms13cashsllhdmn9m42vcsamx24zrxgs3qrsx6ydhed97jx2&lt;/code&gt;</s=
pan></div><div id=3D"gmail-magicdomid430" class=3D"gmail-ace-line"><br></di=
v><div id=3D"gmail-magicdomid431" class=3D"gmail-ace-line"><span class=3D"g=
mail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DTest ve=
ctor 4=3D=3D=3D</span></div><div id=3D"gmail-magicdomid432" class=3D"gmail-=
ace-line"><br></div><div id=3D"gmail-magicdomid433" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">This example shows converting a 256-bit secret into a codex32 secret, wit=
hout splitting the secret into any shares.</span></div><div id=3D"gmail-mag=
icdomid434" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz=
65zz90zz81zz90zwz83zdz82zz78zz65zmd">We appended four zero bits in order to=
 obtain 52 Bech32 characters (260 bits of data) from the 256-bit secret.</s=
pan></div><div id=3D"gmail-magicdomid435" class=3D"gmail-ace-line"><br></di=
v><div id=3D"gmail-magicdomid436" class=3D"gmail-ace-line"><span class=3D"g=
mail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">256-bit secret (=
hex): &lt;code&gt;ffeeddccbbaa99887766554433221100ffeeddccbbaa9988776655443=
3221100&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid437" class=3D"g=
mail-ace-line"><br></div><div id=3D"gmail-magicdomid438" class=3D"gmail-ace=
-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz=
65zmd">* codex32 secret: &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7a=
hwvhw4fnzrhve25gvezzyqqtum9pgv99ycma&lt;/code&gt;</span></div><div id=3D"gm=
ail-magicdomid439" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magi=
cdomid440" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz6=
5zz90zz81zz90zwz83zdz82zz78zz65zmd">Note that the choice to append four zer=
o bits was arbitrary, and any of the following sixteen codex32 secrets woul=
d have been valid:</span></div><div id=3D"gmail-magicdomid441" class=3D"gma=
il-ace-line"><br></div><div id=3D"gmail-magicdomid442" class=3D"gmail-ace-l=
ine"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65=
zmd">* &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gve=
zzyqqtum9pgv99ycma&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid443"=
 class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81z=
z90zwz83zdz82zz78zz65zmd">* &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qr=
l7ahwvhw4fnzrhve25gvezzyqpj82dp34u6lqtd&lt;/code&gt;</span></div><div id=3D=
"gmail-magicdomid444" class=3D"gmail-ace-line"><span class=3D"gmail-author-=
a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* &lt;code&gt;ms10leetsllhdm=
n9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqzsrs4pnh7jmpj5&lt;/code&gt;</=
span></div><div id=3D"gmail-magicdomid445" class=3D"gmail-ace-line"><span c=
lass=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* &lt;c=
ode&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqrfcpap2w=
8dqezy&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid446" class=3D"gm=
ail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz8=
2zz78zz65zmd">* &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnz=
rhve25gvezzyqy5tdvphn6znrf0&lt;/code&gt;</span></div><div id=3D"gmail-magic=
domid447" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65=
zz90zz81zz90zwz83zdz82zz78zz65zmd">* &lt;code&gt;ms10leetsllhdmn9m42vcsamx2=
4zrxgs3qrl7ahwvhw4fnzrhve25gvezzyq9dsuypw2ragmel&lt;/code&gt;</span></div><=
div id=3D"gmail-magicdomid448" class=3D"gmail-ace-line"><span class=3D"gmai=
l-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* &lt;code&gt;ms10l=
eetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqx05xupvgp4v6qx&lt;/c=
ode&gt;</span></div><div id=3D"gmail-magicdomid449" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">* &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzy=
q8k0h5p43c2hzsk&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid450" cl=
ass=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90=
zwz83zdz82zz78zz65zmd">* &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7a=
hwvhw4fnzrhve25gvezzyqgum7hplmjtr8ks&lt;/code&gt;</span></div><div id=3D"gm=
ail-magicdomid451" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-o=
gz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* &lt;code&gt;ms10leetsllhdmn9m=
42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqf9q0lpxzt5clxq&lt;/code&gt;</spa=
n></div><div id=3D"gmail-magicdomid452" class=3D"gmail-ace-line"><span clas=
s=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* &lt;code=
&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyq28y48pyqfuu=
7le&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid453" class=3D"gmail=
-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz=
78zz65zmd">* &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhv=
e25gvezzyqt7ly0paesr8x0f&lt;/code&gt;</span></div><div id=3D"gmail-magicdom=
id454" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz9=
0zz81zz90zwz83zdz82zz78zz65zmd">* &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zr=
xgs3qrl7ahwvhw4fnzrhve25gvezzyqvrvg7pqydv5uyz&lt;/code&gt;</span></div><div=
 id=3D"gmail-magicdomid455" class=3D"gmail-ace-line"><span class=3D"gmail-a=
uthor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* &lt;code&gt;ms10leet=
sllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqd6hekpea5n0y5j&lt;/code=
&gt;</span></div><div id=3D"gmail-magicdomid456" class=3D"gmail-ace-line"><=
span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">*=
 &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwvhw4fnzrhve25gvezzyqwc=
nrwpmlkmt9dt&lt;/code&gt;</span></div><div id=3D"gmail-magicdomid457" class=
=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz=
83zdz82zz78zz65zmd">* &lt;code&gt;ms10leetsllhdmn9m42vcsamx24zrxgs3qrl7ahwv=
hw4fnzrhve25gvezzyq0pgjxpzx0ysaam&lt;/code&gt;</span></div><div id=3D"gmail=
-magicdomid458" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdo=
mid459" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DTest vector 5=3D=3D=3D</span></di=
v><div id=3D"gmail-magicdomid460" class=3D"gmail-ace-line"><br></div><div i=
d=3D"gmail-magicdomid461" class=3D"gmail-ace-line"><span class=3D"gmail-aut=
hor-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">This example shows gener=
ating a new 512-bit master seed using &quot;random&quot; codex32 characters=
 and appending a checksum.</span></div><div id=3D"gmail-magicdomid462" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">The payload contains 103 Bech32 characters, which corr=
esponds to 515 bits. The last three bits are discarded when converting to a=
 512-bit master seed.</span></div><div id=3D"gmail-magicdomid463" class=3D"=
gmail-ace-line"><br></div><div id=3D"gmail-magicdomid464" class=3D"gmail-ac=
e-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78z=
z65zmd">This is an example of a &#39;&#39;&#39;Long codex32 String&#39;&#39=
;&#39;.</span></div><div id=3D"gmail-magicdomid465" class=3D"gmail-ace-line=
"><br></div><div id=3D"gmail-magicdomid466" class=3D"gmail-ace-line"><span =
class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Secr=
et share with index &lt;code&gt;S&lt;/code&gt;: &lt;code&gt;MS100C8VSM32ZXF=
GUHPCHTLUPZRY9X8GF2TVDW0S3JN54KHCE6MUA7LQPZYGSFJD6AN074RXVCEMLH8WU3TK925ACD=
EFGHJKLMNPQRSTUVWXY06FHPV80UNDVARHRAK&lt;/code&gt;</span></div><div id=3D"g=
mail-magicdomid467" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-=
ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">* Master secret (hex): &lt;cod=
e&gt;dc5423251cb87175ff8110c8531d0952d8d73e1194e95b5f19d6f9df7c01111104c9ba=
ecdfea8cccc677fb9ddc8aec5553b86e528bcadfdcc201c17c638c47e9&lt;/code&gt;</sp=
an></div><div id=3D"gmail-magicdomid468" class=3D"gmail-ace-line"><br></div=
><div id=3D"gmail-magicdomid469" class=3D"gmail-ace-line"><span class=3D"gm=
ail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3DAppendix=3D=
=3D</span></div><div id=3D"gmail-magicdomid470" class=3D"gmail-ace-line"><b=
r></div><div id=3D"gmail-magicdomid471" class=3D"gmail-ace-line"><span clas=
s=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=3D=3D=3DM=
athematical Companion=3D=3D=3D</span></div><div id=3D"gmail-magicdomid472" =
class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid473" class=3D=
"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83z=
dz82zz78zz65zmd">Below we use the Bech32 character set to denote values in =
GF[32].</span></div><div id=3D"gmail-magicdomid474" class=3D"gmail-ace-line=
"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd=
">In Bech32, the letter &lt;code&gt;Q&lt;/code&gt; denotes zero and the let=
ter &lt;code&gt;P&lt;/code&gt; denotes one.</span></div><div id=3D"gmail-ma=
gicdomid475" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zv=
z65zz90zz81zz90zwz83zdz82zz78zz65zmd">The digits &lt;code&gt;0&lt;/code&gt;=
 and &lt;code&gt;2&lt;/code&gt; through &lt;code&gt;9&lt;/code&gt; do &#39;=
&#39;not&#39;&#39; denote their numeric values.</span></div><div id=3D"gmai=
l-magicdomid476" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz=
65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">They are simply elements of GF[32=
].</span></div><div id=3D"gmail-magicdomid477" class=3D"gmail-ace-line"><br=
></div><div id=3D"gmail-magicdomid478" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The generat=
ing polynomial for our BCH code is as follows.</span></div><div id=3D"gmail=
-magicdomid479" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdo=
mid480" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz=
90zz81zz90zwz83zdz82zz78zz65zmd">We extend GF[32] to GF[1024] by adjoining =
a primitive cube root of unity, &lt;code&gt;=CE=B6&lt;/code&gt;, satisfying=
 &lt;code&gt;=CE=B6^2 =3D =CE=B6 + P&lt;/code&gt;.</span></div><div id=3D"g=
mail-magicdomid481" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-mag=
icdomid482" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz=
65zz90zz81zz90zwz83zdz82zz78zz65zmd">We select &lt;code&gt;=CE=B2 :=3D G =
=CE=B6&lt;/code&gt; which has order 93, and construct the product &lt;code&=
gt;(x - =CE=B2^i)&lt;/code&gt; for &lt;code&gt;i&lt;/code&gt; in &lt;code&g=
t;{17, 20, 46, 49, 52, 77, 78, 79, 80, 81, 82, 83, 84}&lt;/code&gt;.</span>=
</div><div id=3D"gmail-magicdomid483" class=3D"gmail-ace-line"><span class=
=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">The resulti=
ng polynomial is our generating polynomial for our 13 character checksum:</=
span></div><div id=3D"gmail-magicdomid484" class=3D"gmail-ace-line"><br></d=
iv><div id=3D"gmail-magicdomid485" class=3D"gmail-ace-line"><span class=3D"=
gmail-author-a-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=
=A0 x^13 + E x^12 + M x^11 + 3 x^10 + G x^9 + Q x^8 + E x^7 + E x^6 + E x^5=
 + L x^4 + M x^3 + C x^2 + S x + S</span></div><div id=3D"gmail-magicdomid4=
86" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid487" clas=
s=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90zw=
z83zdz82zz78zz65zmd">For our long checksum, we select &lt;code&gt;=CE=B3 :=
=3D E + X =CE=B6&lt;/code&gt;, which has order 1023, and construct the prod=
uct &lt;code&gt;(x - =CE=B3^i)&lt;/code&gt; for &lt;code&gt;i&lt;/code&gt; =
in &lt;code&gt;{32, 64, 96, 895, 927, 959, 991, 1019, 1020, 1021, 1022, 102=
3, 1024, 1025, 1026}&lt;/code&gt;.</span></div><div id=3D"gmail-magicdomid4=
88" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz=
81zz90zwz83zdz82zz78zz65zmd">The resulting polynomial is our generating pol=
ynomial for our 15 character checksum for long strings:</span></div><div id=
=3D"gmail-magicdomid489" class=3D"gmail-ace-line"><br></div><div id=3D"gmai=
l-magicdomid490" class=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz=
65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">=C2=A0=C2=A0=C2=A0 x^15 + 0 x^14 =
+ 2 x^13 + E x^12 + 6 x^11 + F x^10 + E x^9 + 4 x^8 + X x^7 + H x^6 + 4 x^5=
 + X x^4 + 9 x^3 + K x^2 + Y x^1 + H</span></div><div id=3D"gmail-magicdomi=
d491" class=3D"gmail-ace-line"><br></div><div id=3D"gmail-magicdomid492" cl=
ass=3D"gmail-ace-line"><span class=3D"gmail-author-a-ogz65zvz65zz90zz81zz90=
zwz83zdz82zz78zz65zmd">(Reminder: the character &lt;code&gt;0&lt;/code&gt; =
does &#39;&#39;not&#39;&#39; denote the zero of the field.)</span></div><di=
v id=3D"gmail-magicdomid493" class=3D"gmail-ace-line"><br></div><div id=3D"=
gmail-magicdomid494" class=3D"gmail-ace-line"><span class=3D"gmail-author-a=
-ogz65zvz65zz90zz81zz90zwz83zdz82zz78zz65zmd">-----END BIP-----</span></div=
></div>

--000000000000ed832605f4c7c775--