Skip to content

Commit 1341201

Browse files
committed
Improve notifications
1 parent 9c57035 commit 1341201

File tree

1 file changed

+25
-31
lines changed

1 file changed

+25
-31
lines changed

bip-alfredhodler-privatepayments.mediawiki

Lines changed: 25 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -51,8 +51,6 @@ When Alice wants to start paying Bob in private, she imports his payment code in
5151
* x: Alice's secret recipient index, unique for each Bob
5252
* N_x: child public key derived from N at index x (non-hardened)
5353
* n_x: private key associated with N_x
54-
* Q: static notification address associated with this BIP
55-
* q: private key that can spend from Q
5654
* c: Alice's transaction count toward Bob
5755
* p_c: Bob's private key at index c
5856
* P_c: Bob's public key at index c
@@ -61,12 +59,6 @@ When Alice wants to start paying Bob in private, she imports his payment code in
6159
* +: EC addition
6260
* |: string concatenation
6361
64-
The values of q and Q are:
65-
66-
* q: <code>0x6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d</code>
67-
* Q (mainnet): <code>bc1qz9380vammj5zcz5sjs65yxp6q7qq74klxjycw8</code>
68-
* Q (testnet): <code>tb1qz9380vammj5zcz5sjs65yxp6q7qq74klv5lt45</code>
69-
7062
===Public Key Derivation Path===
7163

7264
The derivation path for this BIP follows BIP44. The following BIP32 path levels are defined:
@@ -95,51 +87,48 @@ Address type flags determine which address types a payment code accepts. This is
9587
Currently defined flags:
9688

9789
{| class="wikitable"
98-
! Address Type !! Flag !! Value
90+
! Address Type !! Flag !! Flag Value !! Ordinal Value
9991
|-
100-
| P2PKH || <code>1 << 0</code> || <code>0x0001</code>
92+
| P2PKH || <code>1 << 0</code> || <code>0x0001</code> || 0
10193
|-
102-
| P2WPKH || <code>1 << 1</code> || <code>0x0002</code>
94+
| P2WPKH || <code>1 << 1</code> || <code>0x0002</code> || 1
10395
|-
104-
| P2TR || <code>1 << 2</code> || <code>0x0004</code>
96+
| P2TR || <code>1 << 2</code> || <code>0x0004</code> || 2
10597
|}
10698

10799
The remaining flags are reserved for future address types.
108100

109-
===Notifications===
110-
111-
Notifications are performed by publishing transactions that contain two outputs:
112-
113-
# minimal P2WPKH output to Q (minimal with respect to some dust threshold).
114-
# OP_RETURN containing a 67-byte notification payload.
101+
While payment codes use 2-byte bitflag arrays, notifications use ordinal values in the form of a single byte.
115102

116-
The purpose of the output sending to Q is so that BIP157/158 compatible clients can use compact block filters to detect notifications without having to download every block. This enables the usage of the standard in resource constrained environments. The reason the address is static is so that privacy loss cannot occur through graph building. The private key that can spend from Q is publicly known in order to incentivize UTXO consolidation by random parties.
103+
===Notifications===
117104

118-
The value of the OP_RETURN output is constructed using the following formula:
105+
Notifications are performed by publishing transactions that contain a single 72-byte OP_RETURN output. The value of the OP_RETURN is constructed using the following formula:
119106

120-
<code>notification_code | N_x | address_types</code>
107+
<code>search_key | notification_code | N_x | address_type</code>
121108

109+
* <code>search_key</code> equals <code>BIP999</code> and is a static ASCII-encoded string (6 bytes)
122110
* <code>notification_code</code> is <code>SHA256(n_x * P)</code> (32 bytes)
123111
* <code>N_x</code> is the unique public key a sender is using for a particular recipient (33 bytes)
124-
* <code>address_types</code> is a two-byte bitarray whose bits are set to a subset of the ones representing recepients's accepted address types
112+
* <code>address_type</code> is the '''ordinal''' value of a single address type that a sender wants to send to (1 byte). This must be selected from the recepient's accepted address types.
125113
126114
When Alice wants to notify Bob that he will receive future payments from her, she performs the following procedure:
127115

128116
# Assigns an unused, unique index <code>x</code> to Bob (0 if Bob is the first party she is notifying).
129117
# Calculates a notification code: <code>notification_code = SHA256(n_x * P)</code>
130-
# Commits to a subset of Bob's accepted address types by constructing <code>address_types</code>. Going forward Alice must not send to address types she did not commit to in the notification.
118+
# Commits to one of Bob's accepted address types by choosing its ordinal value. Going forward Alice must not send to address types other than the one she committed to in the notification.
131119
# Constructs a notification payload by concatenating the above values according to the formula.
132120
# Selects any UTXO in her wallet, preferably not associated with her.
133-
# Sends a transaction with one output to Q and one OP_RETURN output whose value is set to the 67 byte notification payload.
121+
# Sends a transaction with a single OP_RETURN output whose value is set to the constructed payload.
134122
135-
When Bob notices a transaction to Q, he extracts the 67 byte payload from the second output and performs the following procedure:
123+
When Bob notices an OP_RETURN starting with the search key, he performs the following procedure:
136124

137-
# Breaks down the payload into its three constituent parts.
138-
# Selects <code>N_x</code> (item #1) and performs <code>SHA256(N_x * p)</code> (Bob does not know the value of <code>x</code>).
139-
# If the above value matches the notification value (item #0), Bob found a notification addressed to himself and stores <code>N_x</code>.
125+
# Breaks down the payload into its four constituent parts.
126+
# Discards the search key (item #0).
127+
# Selects <code>N_x</code> (item #2) and performs <code>SHA256(N_x * p)</code> (Bob does not know the value of <code>x</code>).
128+
# If the above value matches the notification value (item #1), Bob found a notification addressed to himself and stores <code>N_x</code> together with <code>address_type</code>.
140129
# If this process fails for any reason, Bob assumes a spurious notification or one not addressed to himself and gives up.
141130
142-
Since changing <code>x</code> yields a completely different sender identity, Alice can always re-notify Bob from a different index when she does not want to be associated with her previous identity.
131+
Since changing <code>x</code> yields a completely different sender identity, Alice can always re-notify Bob from a different index when she does not want to be associated with her previous identity. Alice can also re-notify Bob when she wants to start sending to a different address type. Bob must be able to update his watchlist in that case and he can stop watching addresses associated with the old address type.
143132

144133
===Transacting===
145134

@@ -180,6 +169,7 @@ p_c = p + s
180169
==Test Vectors==
181170

182171
===Alice's Wallet===
172+
183173
'''BIP32 seed:''' 0xfe
184174

185175
'''Master xprv:''' xprv9s21ZrQH143K2qVytoy3eZSSuc1gfzFrkV4bgoHzYTkgge4UoNP62eV8jkHYNqddaaefpnjwkz71P5m4EW6RuQBJeP9pdfa9WBnjP6XUivG
@@ -194,6 +184,7 @@ p_c = p + s
194184

195185
'''N_x:''' 039d138aaf5bc2e27a9740541576eceb90a5f20b4799dbfda48e5c7ca240505753
196186

187+
197188
===Bob's Wallet===
198189
'''BIP32 seed:''' 0xff
199190

@@ -207,14 +198,16 @@ p_c = p + s
207198

208199
'''Payment code:''' pay1qqps99p7hjcahv0ped7qx5rg0skgm003cne4pkzfxsdxlas6t90jpp0zpnwgqy
209200

201+
210202
===Alice notifying Bob===
211203
'''S:''' 0x0295ac9a667d7077def44b11104811e5d91d164dd60cb08275b313a33691320cb3
212204

213205
'''Notification code:''' 0xfbe8d683683023aaa066ba13cf79c9f8a7d3c69a4705025f3f4f4887a61eb975
214206

215-
'''Script type commitment flags:''' 0x0002 (segwit only)
207+
'''Address type commitment:''' 1 (segwit)
208+
209+
'''Notification output script:''' OP_RETURN OP_PUSHBYTES_72 424950393939fbe8d683683023aaa066ba13cf79c9f8a7d3c69a4705025f3f4f4887a61eb975039d138aaf5bc2e27a9740541576eceb90a5f20b4799dbfda48e5c7ca24050575301
216210

217-
'''Notification output script:''' OP_RETURN OP_PUSHBYTES_67 fbe8d683683023aaa066ba13cf79c9f8a7d3c69a4705025f3f4f4887a61eb975039d138aaf5bc2e27a9740541576eceb90a5f20b4799dbfda48e5c7ca2405057530002
218211

219212
===Alice sending to Bob===
220213
'''c:''' 0
@@ -227,6 +220,7 @@ p_c = p + s
227220

228221
'''A_c:''' bc1q7nmrkdgg3qq3l2ggh46zwv7750q6rjux0nx27a
229222

223+
230224
===Bob spending===
231225
'''c:''' 0
232226

0 commit comments

Comments
 (0)