You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The remaining flags are reserved for future address types.
108
100
109
-
===Notifications===
110
-
111
-
Notifications are performed by publishing transactions that contain two outputs:
112
-
113
-
# minimal P2WPKH output to Q (minimal with respect to some dust threshold).
114
-
# OP_RETURN containing a 67-byte notification payload.
101
+
While payment codes use 2-byte bitflag arrays, notifications use ordinal values in the form of a single byte.
115
102
116
-
The purpose of the output sending to Q is so that BIP157/158 compatible clients can use compact block filters to detect notifications without having to download every block. This enables the usage of the standard in resource constrained environments. The reason the address is static is so that privacy loss cannot occur through graph building. The private key that can spend from Q is publicly known in order to incentivize UTXO consolidation by random parties.
103
+
===Notifications===
117
104
118
-
The value of the OP_RETURN output is constructed using the following formula:
105
+
Notifications are performed by publishing transactions that contain a single 72-byte OP_RETURN output. The value of the OP_RETURN is constructed using the following formula:
* <code>search_key</code> equals <code>BIP999</code> and is a static ASCII-encoded string (6 bytes)
122
110
* <code>notification_code</code> is <code>SHA256(n_x * P)</code> (32 bytes)
123
111
* <code>N_x</code> is the unique public key a sender is using for a particular recipient (33 bytes)
124
-
* <code>address_types</code> is a two-byte bitarray whose bits are set to a subset of the ones representing recepients's accepted address types
112
+
* <code>address_type</code> is the '''ordinal''' value of a single address type that a sender wants to send to (1 byte). This must be selected from the recepient's accepted address types.
125
113
126
114
When Alice wants to notify Bob that he will receive future payments from her, she performs the following procedure:
127
115
128
116
# Assigns an unused, unique index <code>x</code> to Bob (0 if Bob is the first party she is notifying).
129
117
# Calculates a notification code: <code>notification_code = SHA256(n_x * P)</code>
130
-
# Commits to a subset of Bob's accepted address types by constructing <code>address_types</code>. Going forward Alice must not send to address types she did not commit to in the notification.
118
+
# Commits to one of Bob's accepted address types by choosing its ordinal value. Going forward Alice must not send to address types other than the one she committed to in the notification.
131
119
# Constructs a notification payload by concatenating the above values according to the formula.
132
120
# Selects any UTXO in her wallet, preferably not associated with her.
133
-
# Sends a transaction with one output to Q and one OP_RETURN output whose value is set to the 67 byte notification payload.
121
+
# Sends a transaction with a single OP_RETURN output whose value is set to the constructed payload.
134
122
135
-
When Bob notices a transaction to Q, he extracts the 67 byte payload from the second output and performs the following procedure:
123
+
When Bob notices an OP_RETURN starting with the search key, he performs the following procedure:
136
124
137
-
# Breaks down the payload into its three constituent parts.
138
-
# Selects <code>N_x</code> (item #1) and performs <code>SHA256(N_x * p)</code> (Bob does not know the value of <code>x</code>).
139
-
# If the above value matches the notification value (item #0), Bob found a notification addressed to himself and stores <code>N_x</code>.
125
+
# Breaks down the payload into its four constituent parts.
126
+
# Discards the search key (item #0).
127
+
# Selects <code>N_x</code> (item #2) and performs <code>SHA256(N_x * p)</code> (Bob does not know the value of <code>x</code>).
128
+
# If the above value matches the notification value (item #1), Bob found a notification addressed to himself and stores <code>N_x</code> together with <code>address_type</code>.
140
129
# If this process fails for any reason, Bob assumes a spurious notification or one not addressed to himself and gives up.
141
130
142
-
Since changing <code>x</code> yields a completely different sender identity, Alice can always re-notify Bob from a different index when she does not want to be associated with her previous identity.
131
+
Since changing <code>x</code> yields a completely different sender identity, Alice can always re-notify Bob from a different index when she does not want to be associated with her previous identity. Alice can also re-notify Bob when she wants to start sending to a different address type. Bob must be able to update his watchlist in that case and he can stop watching addresses associated with the old address type.
0 commit comments