diff --git a/protocol/protocol.tex b/protocol/protocol.tex
index 85db07e3..571698f8 100644
--- a/protocol/protocol.tex
+++ b/protocol/protocol.tex
@@ -3615,6 +3615,11 @@ The raw encoding of a \viewingKey consists of:
         of a Curve25519 private key \cite{Bern2006}.
 \end{itemize}
 
+$\TransmitPrivate$ \MUST be ``clamped'' using $\KAFormatPrivate$ as specified
+in \crossref{keycomponents}. That is, a decoded \viewingKey{} \MUST be considered
+invalid if $\TransmitPrivate \neq \KAFormatPrivate(\TransmitPrivate)$.
+($\KAFormatPrivate$ is defined in \crossref{concretekeyagreement}.)
+
 \pnote{
 For addresses on the production network, the lead bytes and encoded length
 cause the first two characters of the Base58Check encoding to be fixed as