{"type":"rich","version":"1.0","author_name":"npub10etkvm8l0jr0jsgdx02dxnhnu5g989dnca90guj5rklwkaplnh3sgjc727","author_url":"https://nostr.ae/npub10etkvm8l0jr0jsgdx02dxnhnu5g989dnca90guj5rklwkaplnh3sgjc727","provider_name":"njump","provider_url":"https://nostr.ae","html":"📅 Original date posted:2014-01-08\n📝 Original message:Thanks Peter for the paper!\n\nI'm just going to restate your 'simple explanation' to make sure I got  \nit...\n\nThe payee publishes a public key of theirs, which will be a long-standing  \nidentifier, public key = 'Q', corresponding private key = 'd'.\n\nTo pay them, payee generate a keypair, private key = 'e' public key of  \n'P'. Publish 'P' in the transaction.\n\nThe payer can calculate S = eQ, where S is a shared secret between  \npayer/payee. The payee calculates the same S as S = dP. So the payee sees  \n'P' in a transaction, and multiplies by their private key, to get S.\n\nNow that we have the shared secret, either side can calculate an offset to  \nQ which becomes the pay-to-address. When you say BIP32-style derivation,  \nQ' = H(S) + Q, does this mean Q + SHA256(33-byte S)?\n\nA payee has to check each transaction (or every transaction of a fixed  \nprefix) with 'P', calculate Q' = Q + H(dP) and see if that transaction  \npays to Q'. If the address matches, then the payee can spend it with  \nprivate key of d + H(dP).\n\nOne downside is that you have to hold your private key in memory  \nunencrypted in order to identify new payments coming in. So  \nstealth-addresses may not be suitable for receiving eCommerce payments,  \nsince you can't implement a corresponding watch-only wallet, e.g. there's  \nno way to \"direct-deposit into cold storage.\"\n\nHope I got that right...\n\nOn Mon, 06 Jan 2014 04:03:38 -0800, Peter Todd \u003cpete at petertodd.org\u003e wrote:\n\n\u003e Using Elliptic curve Diffie-Hellman (ECDH) we can generate a shared\n\u003e secret that the payee can use to recover their funds. Let the payee have\n\u003e keypair Q=dG. The payor generates nonce keypair P=eG and uses ECDH to\n\u003e arrive at shared secret c=H(eQ)=H(dP). This secret could be used to\n\u003e derive a ECC secret key, and from that a scriptPubKey, however that\n\u003e would allow both payor and payee the ability to spend the funds. So\n\u003e instead we use BIP32-style derivation to create Q'=(Q+c)G and associated\n\u003e scriptPubKey.\n\u003e\n\u003e As for the nonce keypair, that is included in the transaction in an\n\u003e additional zero-valued output:\n\u003e    RETURN \u003cP\u003e"}