<p>The math in the <a href="https://en.wikipedia.org/wiki/BCH_code" rel="nofollow noreferrer">wikipedia article</a> is primarily concerned with generating a BCH code-- which is something that was done for the design of Bech32 but obviously isn't part of the implementation itself-- and with correcting errors which isn't done with Bech32.  The article's section on encoding is blank, which is too bad because that is the one thing that's done in the Bech32 code. Even bech32 validation just works by re-encoding and checking if the new encoding matches.</p>

<p>Bech32 is a BCH code constructed with a characteristic-2 field. This allows its symbols to be an integer number of bit's long (5 in the case of bech32).  In this kind of field the numbers are treated as coefficients of a binary polynomial, addition is accomplished via xor, and multiplication is accomplished by shifted xors reduced mod a polynomial. As a result the workings look pretty different from what you'd expect from an algebraic description.</p>

<p>A fancy bech32 decoder that finds the error positions also ends up not looking too much like the algebraic decoder in wikipedia, because bech32 has performance better than guaranteed by the fact that it is a BCH code but to exploit that you must go beyond the plain algebraic decoder.  When we designed bech32 we also found a non-BCH cyclic code that had somewhat better error detection-- and would have used the same encode/validation code with different constants-- but preferred to stick with the BCH code since proving a lower bound on its performance is much simpler and there are more options for constructing fancy decoders since BCH codes can be decoded algebraically (as described in Wikipedia).</p>

<p>The <a href="https://github.com/bitcoin/bitcoin/blob/e1ed37edaedc85b8c3468bd9a726046344036243/src/bech32.cpp#L39" rel="nofollow noreferrer">implementation in the Bitcoin code</a> of bech32 has an extensive description of the mathematics of it and how the mathematics relates to the implementation.</p>

CC BY-SA 4.0
2018-10-10T13:15:23.437Z
2018-10-10T13:49:33.983Z
2018-10-10T13:49:33.983Z
G. Maxwell
<p>My understanding is that some research went into picking an optimal generator polynomial for the BCH code and then it was <a href="https://github.com/sipa/bech32/blob/master/ref/python/segwit_addr.py#L29" rel="nofollow noreferrer">hardcoded</a> into the bech32 standard.</p>

<p>More info in <a href="https://www.youtube.com/watch?v=NqiN9VFE4CU" rel="nofollow noreferrer">this</a> talk by Pieter Wuille</p>

CC BY-SA 3.0
2018-05-01T13:14:06.897Z
I don't see "polynomial" anywhere in the Bech32 checksum code. I see "polymod", which is different...
priestc
CC BY-SA 4.0
2018-06-27T07:47:25.233Z
Polynomials in the bech32 implementation are represented by simple integers. Generally 30-bit integers are used, where each bit corresponds to one coefficient of the polynomial. The reference code in Bitcoin Core has a lot of comments explaining the relation between the mathematical objects and their representation in code.
Pieter Wuille
CC BY-SA 3.0
2018-05-01T12:39:36.353Z
2018-05-01T12:39:36.353Z
Mike D
<p>The Bech32 BIP declares that Bech32 is "based on BCH codes". But if you look at the wikipedia page on BCH codes, you see a lot of mathematical equations, but none of those equations seems to be similar to the code that calculates a bech32 checksum.</p>

<p>Can someone explain what parts of BCH codes that bech32 is based on?</p>

CC BY-SA 4.0
2019-09-02T08:21:41.323Z
Potentially useful link (disclaimer: written by me): https://medium.com/@MeshCollider/some-of-the-math-behind-bech32-addresses-cf03c7496285
meshcollider
<bech32-address>
How is Bech32 based on BCH codes?
priestc
# How is Bech32 based on BCH codes?

(Asked by: username_0 on 2018-05-01)

The Bech32 BIP declares that Bech32 is "based on BCH codes". But if you look at the wikipedia page on BCH codes, you see a lot of mathematical equations, but none of those equations seems to be similar to the code that calculates a bech32 checksum.

Can someone explain what parts of BCH codes that bech32 is based on?

**Tags:** bech32-address

> **Comments:**
> **username_1**: Potentially useful link (disclaimer: written by me): https://medium.com/@MeshCollider/some-of-the-math-behind-bech32-addresses-cf03c7496285  

---

## 2 answers

### Answer by username_2 on 2018-10-10. Score: 1

The math in the [wikipedia article](https://en.wikipedia.org/wiki/BCH_code) is primarily concerned with generating a BCH code-- which is something that was done for the design of Bech32 but obviously isn't part of the implementation itself-- and with correcting errors which isn't done with Bech32. The article's section on encoding is blank, which is too bad because that is the one thing that's done in the Bech32 code. Even bech32 validation just works by re-encoding and checking if the new encoding matches.

Bech32 is a BCH code constructed with a characteristic-2 field. This allows its symbols to be an integer number of bit's long (5 in the case of bech32). In this kind of field the numbers are treated as coefficients of a binary polynomial, addition is accomplished via xor, and multiplication is accomplished by shifted xors reduced mod a polynomial. As a result the workings look pretty different from what you'd expect from an algebraic description.

A fancy bech32 decoder that finds the error positions also ends up not looking too much like the algebraic decoder in wikipedia, because bech32 has performance better than guaranteed by the fact that it is a BCH code but to exploit that you must go beyond the plain algebraic decoder. When we designed bech32 we also found a non-BCH cyclic code that had somewhat better error detection-- and would have used the same encode/validation code with different constants-- but preferred to stick with the BCH code since proving a lower bound on its performance is much simpler and there are more options for constructing fancy decoders since BCH codes can be decoded algebraically (as described in Wikipedia).

The [implementation in the Bitcoin code](https://github.com/bitcoin/bitcoin/blob/e1ed37edaedc85b8c3468bd9a726046344036243/src/bech32.cpp#L39) of bech32 has an extensive description of the mathematics of it and how the mathematics relates to the implementation.


---

### Answer by username_3 on 2018-05-01. Score: 0

My understanding is that some research went into picking an optimal generator polynomial for the BCH code and then it was [hardcoded](https://github.com/sipa/bech32/blob/master/ref/python/segwit_addr.py#L29) into the bech32 standard.

More info in [this](https://www.youtube.com/watch?v=NqiN9VFE4CU) talk by username_4 username_4

> **Comments:**
> **username_0**: I don't see "polynomial" anywhere in the Bech32 checksum code. I see "polymod", which is different...  
> **username_4**: Polynomials in the bech32 implementation are represented by simple integers. Generally 30-bit integers are used, where each bit corresponds to one coefficient of the polynomial. The reference code in Bitcoin Core has a lot of comments explaining the relation between the mathematical objects and their representation in code.  

---

