Reduce scope of BIP173 to native segwit v0

bip-0173.mediawiki

@@ -1,7 +1,7 @@
 <pre>
   BIP: 173
   Layer: Applications
-  Title: Base32 address format for native v0-16 witness outputs
+  Title: Base32 address format for native v0 witness outputs
   Author: Pieter Wuille <pieter.wuille@gmail.com>
           Greg Maxwell <greg@xiph.org>
   Comments-Summary: No comments yet.
@@ -11,13 +11,14 @@
   Created: 2017-03-20
   License: BSD-2-Clause
   Replaces: 142
+  Extended-by: 350
 </pre>
 
 ==Introduction==
 
 ===Abstract===
 
-This document proposes a checksummed base32 format, "Bech32", and a standard for native segregated witness output addresses using it.
+This document proposes a checksummed base32 format, "Bech32", and a standard for native segregated witness v0 output addresses using it.
 
 ===Copyright===
 
@@ -194,6 +195,11 @@ For presentation, lowercase is usually preferable, but inside QR codes uppercase
 ''[http://www.thonky.com/qr-code-tutorial/alphanumeric-mode-encoding alphanumeric mode]'', which is 45% more compact than the normal
 ''[http://www.thonky.com/qr-code-tutorial/byte-mode-encoding byte mode]''.
 
+'''<span id="Limitations">Limitations</span>'''
+
+Due to an oversight in the design of Bech32, this checksum scheme is not always robust against [https://gist.github.com/sipa/a9845b37c1b298a7301c33a04090b2eb the insertion and deletion of fewer than 5 consecutive characters].
+This address scheme is therefore only used for native segwit v0 outputs, native segwit v1 outputs use the bech32m scheme specified in BIP-350.
+
 ===Segwit address format===
 
 A segwit address<ref>'''Why not make an address format that is generic for all scriptPubKeys?'''
@@ -209,20 +215,22 @@ implementations' assumptions about lengths), but still be visually
 distinct.</ref> for testnet.
 * The data-part values:
 ** 1 character (representing 5 bits of data): the witness version
-** A conversion of the 2-to-40-byte witness program (as defined by [https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki BIP141]) to base32:
+** The 20-byte or 32-byte witness program (as defined by [https://github.com/bitcoin/bips/blob/master/bip-0141.mediawiki BIP141]) to base32:
 *** Start with the bits of the witness program, most significant bit per byte first.
 *** Re-arrange those bits into groups of 5, and pad with zeroes at the end if needed.
 *** Translate those bits to characters using the table above.
 
+While, in general, witness programs may be between 2 and 40 bytes, only witness programs of 20 or 32 bytes are addressable by this address format.
+
 '''Decoding'''
 
 Software interpreting a segwit address:
 * MUST verify that the human-readable part is "bc" for mainnet and "tb" for testnet.
-* MUST verify that the first decoded data value (the witness version) is between 0 and 16, inclusive.
+* MUST verify that the first decoded data value (the witness version) is 0<ref>'''Why was BIP173 reduced in scope to version 0?''' Originally, BIP173 was scoped to apply to all native segwit versions, 0–16. After the discovery of the length extension vulnerability, BIP173 was reduced to only applying to version zero. The superseding BIP350 applies to v1–16.</ref>
 * Convert the rest of the data to bytes:
 ** Translate the values to 5 bits, most significant bit first.
 ** Re-arrange those bits into groups of 8 bits. Any incomplete group at the end MUST be 4 bits or less, MUST be all zeroes, and is discarded.
-** There MUST be between 2 and 40 groups, which are interpreted as the bytes of the witness program.
+** There MUST be 20 or 32 groups, which are interpreted as the bytes of the witness program.
 
 Decoders SHOULD enforce known-length restrictions on witness programs.
 For example, BIP141 specifies ''If the version byte is 0, but the witness