BRC-78

Serialization Format for Portable Encrypted Messages

An encrypted message is only portable if the recipient can work out how to decrypt it from the message itself. This defines a self-describing container so an encrypted message can be stored or forwarded and still be opened later.

Ty Everett15 Dec 2023changed 26 Mar 20242 min read

Why: Two parties who want to exchange encrypted messages need a way to derive matching keys and format the result without first agreeing on a shared protocol identifier.
What: BRC-78 is a serialization format for encrypted peer-to-peer messages that combines BRC-42 key derivation and BRC-43 invoice numbers into one portable, self-describing byte layout.
How: A sender picks a random 256-bit key ID, builds a BRC-43 invoice number from it with security level 2 and protocol ID "message encryption", derives child keys via BRC-42, computes an ECDH shared secret, encrypts with AES-256-GCM (IV prepended), and serializes version, sender ID, recipient ID, key ID and ciphertext into

What this lets you do

Encrypt a message for a specific recipient's identity key without agreeing on a shared protocol first
Derive one-time encryption keys per message using a random key ID
Decrypt a received message by deriving the matching private key from the sender's public key
Package sender ID, recipient ID, key ID and ciphertext into one portable byte format
Send encrypted messages peer-to-peer without a pre-shared protocol identifier

Written by claude-sonnet-5 from the specification text. Where the two differ, the original is correct.

Reference for an AI

Everything an assistant needs to answer questions about BRC-78 accurately, including what it depends on.

The specification

Read the original

Abstract

This document describes a protocol for a portable message encryption and description scheme. It follows the BRC-42 key derivation and BRC-43 invoice number standards to protect the confidentiality of message content, without requiring the added complexity of agreeing on a specific BRC-43 protocol for the parties to use.

Motivation

Message encryption is a fundamental requirement as it ensures the privacy and confidentiality of the content transmitted between parties. The current standards like Electrum ECIES don't provide a comprehensive solution for message encryption by integrating with BRC-42 and BRC-43. This document aims to enhance security by developing a protocol for message encryption and decryption, utilising the BRC-43 invoice numbers. The protocol facilitaes a way to exchange encrypted data in a general way.

Specification

The protocol employs the BRC-2 encryption process and makes use of the BRC-42 key derivation and BRC-43 invoice numbering scheme.

The encryption procedure follows these steps:

The sender employs BRC-43 with security level 2, protocol ID message encryption, and a randomly generated 256-bit key ID to compute the invoice number to facilitate BRC-42 key derivation. We specify the key ID is in base64 format when added to the invoice number.
The sender derives their own child private key and the child public key of the recipient using BRC-42 key derivation.
The sender then computes an ECDH shared secret between the two child keys which is used in symmetric encryption with AES-256-GCM.
With a random initialization vector, the message is encrypted and the vector is prepended to the ciphertext.

For decryption:

The recipient computes their own private key and the public key of the sender using BRC-42 key derivation.
The recipient computes the same Shared Secret and uses it along with the received initialization vector to decrypt the ciphertext.