An interesting case of rollback vs rollforward from bitcoin.
https://github.com/bitcoin/bips/blob/master/bip-0050.mediawi...
In that case they decided to rollback.
In A push gone wrong in the name of what, exactly?bitcoin
bips
Wikitext2013–2026
bitcoin / bips
bips
Bitcoin Improvement Proposals
104Distinct people
124Mentions
0Explicit recommenders
11KGitHub stars
What to know before exploring
What it is
Bitcoin Improvement Proposals
GitHub
Where it is used
- Ledger Wallet (Ledger Live) — Ledger Wallet uses the BIP32, BIP39 and BIP44 standards to manage seeds and derivation paths for generating keys and addresses. Source
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
- bcoin-org/bcoin · linked in 2 of the same discussions
Mentioned in the same Hacker News threads. That is not proof they are substitutes.
This week on Hacker News
Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 8:01:28 AM UTC.
No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.
Mentions over time
HN mentions by year124 dated mentions
Observed mentions: 2013-12-10 19:15:46 UTC to 2026-09-13 15:23:25 UTC.
* An incomplete calendar period is marked with an outlined bar. Its count is not directly comparable with a full period.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| 2013 | 2013-01-01 00:00:00 UTC | 2014-01-01 00:00:00 UTC | 3 | 0 | 3 |
| 2014 | 2014-01-01 00:00:00 UTC | 2015-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2015 | 2015-01-01 00:00:00 UTC | 2016-01-01 00:00:00 UTC | 8 | 0 | 8 |
| 2016 | 2016-01-01 00:00:00 UTC | 2017-01-01 00:00:00 UTC | 9 | 0 | 9 |
| 2017 | 2017-01-01 00:00:00 UTC | 2018-01-01 00:00:00 UTC | 12 | 1 | 11 |
| 2018 | 2018-01-01 00:00:00 UTC | 2019-01-01 00:00:00 UTC | 10 | 1 | 9 |
| 2019 | 2019-01-01 00:00:00 UTC | 2020-01-01 00:00:00 UTC | 7 | 0 | 7 |
| 2020 | 2020-01-01 00:00:00 UTC | 2021-01-01 00:00:00 UTC | 15 | 0 | 15 |
| 2021 | 2021-01-01 00:00:00 UTC | 2022-01-01 00:00:00 UTC | 17 | 0 | 17 |
| 2022 | 2022-01-01 00:00:00 UTC | 2023-01-01 00:00:00 UTC | 13 | 0 | 13 |
| 2023 | 2023-01-01 00:00:00 UTC | 2024-01-01 00:00:00 UTC | 6 | 0 | 6 |
| 2024 | 2024-01-01 00:00:00 UTC | 2025-01-01 00:00:00 UTC | 7 | 1 | 6 |
| 2025 | 2025-01-01 00:00:00 UTC | 2026-01-01 00:00:00 UTC | 3 | 1 | 2 |
| 2026 (partial) | 2026-01-01 00:00:00 UTC | 2027-01-01 00:00:00 UTC | 4 | 1 | 3 |
From the project README
An excerpt from the repository, fetched Nov 13, 2026.
Read the project’s introduction
People wishing to submit a BIP should first describe their idea to the bitcoindev@googlegroups.com
mailing list to gather feedback on viability and community interest before working on a
formal description. Please open a pull request to this repository only when substantial progress on the draft has been
made, preferably when the draft is nearing completion. Authors do not assign a number to their own proposal.
After a proposal meets the editorial criteria, a BIP Editor will assign a number to it and publish the proposal by
merging the pull request to the repository. Please see BIP 3: Updated BIP Process for the full process.
The BIPs repository serves as a publication medium and archive. Having a BIP published here indicates that the proposal
is in scope and has met other formal criteria for this repository, but does not indicate that it is a good idea, has
community consensus, or that it is about to be adopted. The BIP Editors are expected to be liberal with publishing BIPs
and to try not to be too involved in decision-making on behalf of the community. Beyond the formal criteria, evaluation of
the proposals is left to the audience of the repository. When a proposal is controversial and it cannot be agreed upon
whether it should be published, the conservative option will always be preferred: the proposal will be closed.
Those proposing and opposing changes should consider that ultimately acceptance and adoption rests with the Bitcoin
users (see also: economic majority).
Number
Layer
Title
Owner
Type
Status
1
BIP Purpose and Guidelines
Amir Taaki
Process
Closed
2
BIP process, revised
Luke Dashjr
Process
Closed
3
Updated BIP Process
Murch
Process
Deployed
8
Version bits with lock-in by height
Shaolin Fry, Luke Dashjr
Informational
Complete
9
Version bits with timeout and delay
Pieter Wuille, Peter Todd, Greg Maxwell, Rusty Russell
Informational
Deployed
10
Applications
Multi-Sig Transaction Distribution
Alan Reiner
Informational
Closed
11
Applications
M-of-N Standard Transactions
Gavin Andresen
Specification
Deployed
12
Consensus (soft fork)
OP_EVAL
Gavin Andresen
Specification
Closed
13
Applications
Address Format for pay-to-script-hash
Gavin Andresen
Specification
Deployed
14
Peer Services
Protocol Version and User Agent
Amir Taaki, Patrick Strateman
Specification
Deployed
15
Applications
Aliases
Amir Taaki
Specification
Closed
16
Consensus (soft fork)
Pay to Script Hash
Gavin Andresen
Specification
Deployed
17
Consensus (soft fork)
OP_CHECKHASHVERIFY (CHV)
Luke Dashjr
Specification
Closed
18
Consensus (soft fork)
hashScriptCheck
Luke Dashjr
Specification
Complete
19
Applications
M-of-N Standard Transactions (Low SigOp)
Luke Dashjr
Specification
Closed
20
Applications
URI Scheme
Luke Dashjr
Specification
Closed
21
Applications
URI Scheme
Nils Schneider, Matt Corallo
Specification
Closed
22
API/RPC
getblocktemplate - Fundamentals
Luke Dashjr
Specification
Deployed
23
API/RPC
getblocktemplate - Pooled Mining
Luke Dashjr
Specification
Deployed
30
Consensus (soft fork)
Duplicate transactions
Pieter Wuille
Specification
Deployed
31
Peer Services
Pong message
Mike Hearn
Specification
Deployed
32
Applications
Hierarchical Deterministic Wallets
Pieter Wuille
Informational
Deployed
33
Peer Services
Stratized Nodes
Amir Taaki
Specification
Closed
34
Consensus (soft fork)
Block v2, Height in Coinbase
Gavin Andresen
Specification
Deployed
35
Peer Services
mempool message
Jeff Garzik
Specification
Deployed
36
Peer Services
Custom Services
Stefan Thomas
Specification
Closed
37
Peer Services
Connection Bloom filtering
Mike Hearn, Matt Corallo
Specification
Deployed
38
Applications
Passphrase-protected private key
Mike Caldwell, Aaron Voisine
Specification
Deployed
39
Applications
Mnemonic code for generating deterministic keys
Marek Palatinus, Pavol Rusnak, Aaron Voisine, Sean Bowe
Specification
Deployed
40
API/RPC
Stratum wire protocol
Marek Palatinus
Standard
BIP number allocated
41
API/RPC
Stratum mining protocol
Marek Palatinus
Standard
BIP number allocated
42
Consensus (soft fork)
A finite monetary supply for Bitcoin
Pieter Wuille
Specification
Deployed
43
Applications
Purpose Field for Deterministic Wallets
Marek Palatinus, Pavol Rusnak
Specification
Deployed
44
Applications
Multi-Account Hierarchy for Deterministic Wallets
Marek Palatinus, Pavol Rusnak
Specification
Deployed
45
Applications
Structure for Deterministic P2SH Multisignature Wallets
Manuel Araoz, Ryan X. Charles, Matias Alejo Garcia
Specification
Complete
46
Applications
Address Scheme for Timelocked Fidelity Bonds
Chris Belcher, Thebora Kompanioni
Specification
Draft
47
Applications
Reusable Payment Codes for Hierarchical Deterministic Wallets
Justus Ranvier
Specification
Deployed
48
Applications
Multi-Script Hierarchy for Multi-Sig Wallets
Fontaine
Specification
Deployed
49
Applications
Derivation scheme for P2WPKH-nested-in-P2SH based accounts
Daniel Weigl
Specification
Deployed
50
March 2013 Chain Fork Post-Mortem
Gavin Andresen
Informational
Deployed
52
Consensus (hard fork)
Durable, Low Energy Bitcoin PoW
Michael Dubrovsky, Bogdan Penkovsky
Specification
Closed
53
Consensus (soft fork)
Disallow 64-byte transactions
Chris Stewart
Specification
Draft
54
Consensus (soft fork)
Consensus Cleanup
Antoine Poinsot, Matt Corallo
Specification
Complete
60
Peer Services
Fixed Length "version" Message (Relay-Transactions Field)
Amir Taaki
Specification
Closed
61
Peer Services
Reject P2P message
Gavin Andresen
Specification
Deployed
62
Consensus (soft fork)
Dealing with malleability
Pieter Wuille
Specification
Closed
63
Applications
Stealth Addresses
Peter Todd
Standard
BIP number allocated
64
Peer Services
getutxo message
Mike Hearn
Specifi
Read the full README on GitHubWhat Hacker News says
7 sourcesyeah. you obviously don’t get how bitcoin wallets work. you can have more that one address associated with the wallet and you can spend out of multiple addresses. there are also ways to anonymize the addresses (not to mention that you can create as many addresses as you want to begin with).
see:
https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...
https://cryptalker.com/bitcoin-mixer/
In 94k Bitcoin (1B USD) transferred from unknown wallet to unknown walletCryptocurrency wallets use the BIP32 scheme which provides an even neater ability: from a root public key alone you can generate a series of children public keys, no private keys are involved in the calculation. (And whoever posses the root private key can generate the corresponding series of children private keys.) The technical aspects are described in https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi... But that's overkill given the simpler requirements of Find My. Each device stores the private key so they don't need something with the feature set of BIP32.
In The clever cryptography behind Apple’s “Find My” featureYou can derive a new public key from someone's ECC public key, and they can derive the corresponding private key by applying the same transformation. It's somewhat magical! I wouldn't be surprised if Apple is using a scheme based on this instead of ElGamal, they already use ECC extensively.
https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...
In How does Apple privately find offline devices?It's possible to rule out some (but not necessarily all) cross-protocol attacks with a simple and cheap tweak. I have not proved that this rules out everything, but it appears to be no weaker than the scheme sans tweak, and proofs shouldn't be too hard.
The high-level idea is to derive a new encryption key from the recipient's signing key, such that only the recipient knows the secret. This is similar to HD wallets[1] and some recent work by Dauterman et al.[2]. It's easy to show, following the work of Morita et al.[3], that EdDSA is secure against (certain) related-key attacks. This means that, even if an adversary has a signing oracle for the derived key, it cannot forge signatures under the original key.
Alas, this is incomparable with giving the adversary a decryption oracle for the derived key, which means it's worth thinking about w
Read the rest
hether it's possible to prove some extra properties. It's also worth thinking about the other direction: does a signing oracle for the original key let an attacker break the encryption scheme? Again, I haven't proved these things, but it seems like it ought to be possible.
Here's the idea in detail. First, definitions:
- q = 2^252 + 0x14def9dea2f79cd65812631a5cf5d3ed, the order of the Curve25519 group [1]
- (SK, PK) = (s, s * G) is an Ed25519 key pair (base point is G, * is elliptic curve scalar multiplication)
- <PK> is some well-known encoding of PK as a bitstring
- a || b is the concatenation of a and b
- ID is some fixed string that identifies this ciphersuite, say, "age_ssh_ed25519_encrypt_v1"
- I2OSP and OS2IP are standard conversions between integers and byte strings as defined in RFC8017 [5]
Now, to encrypt to the derived key, do the following:
1. Let t = OS2IP(SHA256(ID || I2OSP(0, 1) || <PK>) || SHA256(ID || I2OSP(1, 1) || <PK>)) mod q. In other words, t is a (nearly) uniformly random element of Zq obtained by hashing the recipient's public key.
2. Let PK' = t * PK, where * represents elliptic curve scalar multiplication.
3. Encrypt your message to PK' rather than to PK.
Finally, to decrypt, the recipient does the following:
1. Compute t exactly as above.
2. Let s' = s * t, where s = SK is the secret key.
3. Decrypt the message using s' as the secret key.
Note that in this scheme, everyone who encrypts to the recipient who owns (SK, PK) uses the same key. It's possible to derive a per-message key instead: choose a random nonce, hash it along with <PK> in the first step, and send it along with the message. Alternatively, you could derive a per-sender key by hashing both the sender's and recipient's keys. It's not obvious to me that per-message/per-sender keys improve security at all, and it's plausible that they somehow weaken it (since letting the attacker set the input to the hash allows it to choose among polynomially many PK'). So unless you decide that per-message keys are necessary for security, I wouldn't bother.
[1] https://github.com/bitcoin/bips/blob/master/bip-0032.mediawi...
[2] https://arxiv.org/abs/1810.04660
[3] https://eprint.iacr.org/2015/1135
[4] https://cr.yp.to/ecdh.html
[5] https://tools.ietf.org/html/rfc8017
First you mention Nakamoto consensus, then you mention "existing consensus code". Are you including Bitcoin script when you say consensus? It seems like a huge task to formally model the whole consensus system, including OP_CODESEPARATOR. How would you replicate something like the BIP-0050 problem?
https://github.com/bitcoin/bips/blob/master/bip-0050.mediawi...
In Why Don't People Use Formal Methods?It can't, as per the BIP39 spec[0], the mnemonic is run through PBKDF2 to generate the seed that is actually used.
So even knowing one or two of the input words doesn't tell you anything about the actual seed.
[0] https://github.com/bitcoin/bips/blob/master/bip-0039.mediawi...
In Show HN: Doge Seed – Dank mnemonic seed phrases