diff --git a/i2p2www/pages/site/docs/protocol/i2cp.html b/i2p2www/pages/site/docs/protocol/i2cp.html
index 7a30d2a1..e7d65fed 100644
--- a/i2p2www/pages/site/docs/protocol/i2cp.html
+++ b/i2p2www/pages/site/docs/protocol/i2cp.html
@@ -253,7 +253,8 @@ Do not confuse with i2cp.leaseSetPrivateKey which is for LS1.
 <td>&nbsp;
 <td>""
 <td>
-The secret used to blind the leaseset.
+Base 64 encoded UTF-8
+secret used to blind the leaseset.
 See proposal 123.
 </td>
 </tr>
@@ -649,6 +650,21 @@ of sending a MessageStatus and awaiting a ReceiveMessageBegin.
 <td>{% trans %}Gzip outbound data{% endtrans %}</td>
 </tr>
 
+<tr>
+<td>i2cp.leaseSetAuthType
+<td>0.9.41</td>
+<td>0
+<td>0-2
+<td>0
+<td>
+The type of authentication for encrypted LS2.
+0 for no per-client authentication (the default);
+1 for DH per-client authentication;
+2 for PSK per-client authentication.
+See proposal 123.
+</td>
+</tr>
+
 <tr>
 <td>i2cp.leaseSetBlindedType
 <td>0.9.39</td>
@@ -663,16 +679,29 @@ See proposal 123.
 </tr>
 
 <tr>
-<td>i2cp.leaseSetAuthType
-<td>0.9.41</td>
-<td>0
-<td>0-2
-<td>0
+<td>i2cp.leaseSetClient.dh.nnn
+<td>0.9.41/td>
+<td>b64name:b64pubkey
+<td>&nbsp;
+<td>&nbsp;
 <td>
-The type of authentication for encrypted LS2.
-0 for no per-client authentication (the default);
-1 for DH per-client authentication;
-2 for PSK per-client authentication.
+The base 64 of the client name (ignored, UI use only),
+followed by a ':', followed by the base 64 of the public
+key to use for DH per-client auth. nnn starts with 0
+See proposal 123.
+</td>
+</tr>
+
+<tr>
+<td>0.9.41/td>
+<td>b64name:b64privkey
+<td>&nbsp;
+<td>&nbsp;
+<td>
+i2cp.leaseSetClient.psk.nnn
+The base 64 of the client name (ignored, UI use only),
+followed by a ':', followed by the base 64 of the private
+key to use for PSK per-client auth. nnn starts with 0
 See proposal 123.
 </td>
 </tr>
@@ -725,7 +754,8 @@ Do not confuse with i2cp.leaseSetPrivKey which is for LS2.
 <td>&nbsp;
 <td>""
 <td>
-The secret used to blind the leaseset.
+Base 64 encoded UTF-8
+secret used to blind the leaseset.
 See proposal 123.
 </td>
 </tr>
diff --git a/i2p2www/spec/proposals/123-new-netdb-entries.rst b/i2p2www/spec/proposals/123-new-netdb-entries.rst
index 585c0f3f..4dc489da 100644
--- a/i2p2www/spec/proposals/123-new-netdb-entries.rst
+++ b/i2p2www/spec/proposals/123-new-netdb-entries.rst
@@ -5,7 +5,7 @@ New netDB Entries
     :author: zzz, str4d, orignal
     :created: 2016-01-16
     :thread: http://zzz.i2p/topics/2051
-    :lastupdated: 2019-05-22
+    :lastupdated: 2019-05-29
     :status: Open
     :supercedes: 110, 120, 121, 122
 
@@ -1661,7 +1661,8 @@ New options interpreted router-side, sent in SessionConfig Mapping:
                                       Length as inferred from the destination
                                       signing public key type
 
-  i2cp.leaseSetSecret=xxxx    A secret used to encrypt/decrypt the leaseset, default ""
+  i2cp.leaseSetSecret=b64     The base 64 of a secret used to encrypt/decrypt
+                              the leaseset, default ""
 
   i2cp.leaseSetAuthType=nnn   The type of authentication for encrypted LS2.
                               0 for no per-client authentication (the default)
@@ -1696,8 +1697,14 @@ New options interpreted client-side:
 
   i2cp.leaseSetBlindedType=nnn   The sig type of the blinded key for encrypted LS2.
                                  Default depends on the destination sig type.
-                                 See proposal 123.
 
+  i2cp.leaseSetClient.dh.nnn=b64name:b64pubkey   The base 64 of the client name (ignored, UI use only),
+                                                 followed by a ':', followed by the base 64 of the public
+                                                 key to use for DH per-client auth. nnn starts with 0
+
+  i2cp.leaseSetClient.psk.nnn=b64name:b64privkey   The base 64 of the client name (ignored, UI use only),
+                                                   followed by a ':', followed by the base 64 of the private
+                                                   key to use for PSK per-client auth. nnn starts with 0
 
 Session Config
 --------------