You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<code>(p, P)</code> and <code>(n, N)</code> are keys associated with the above path, depending on which side is performing the calculation.
73
+
''(p, P)'' and ''(n, N)'' are keys associated with the above path, depending on which side is performing the calculation.
73
74
74
-
N_x keys are the direct non-hardened children of N. For instance, the path of <code>N_0</code> from <code>N</code> is <code>m / 0</code>.
75
+
''N<sub>x</sub>'' keys are the direct non-hardened children of ''N''. For instance, the path of ''N<sub>0</sub>'' from ''N'' is ''m / 0''.
75
76
76
77
===Payment Code Structure and Encoding===
77
78
@@ -102,69 +103,59 @@ While payment codes use 2-byte bitflag arrays, notifications use ordinal values
102
103
103
104
===Notifications===
104
105
105
-
Notifications are performed by publishing transactions that contain a single 72-byte OP_RETURN output. The value of the OP_RETURN is constructed using the following formula:
106
+
Notifications are performed by publishing transactions that contain a single 72-byte <code>OP_RETURN</code> output. The value of the <code>OP_RETURN</code> is constructed using the following formula:
* <code>search_key</code> equals <code>BIP999</code> and is a static ASCII-encoded string (6 bytes)
110
-
* <code>notification_code</code> is <code>SHA256(n_x * P)</code> (32 bytes)
111
-
* <code>N_x</code> is the unique public key a sender is using for a particular recipient (33 bytes)
112
-
* <code>address_type</code> is the '''ordinal''' value of a single address type that a sender wants to send to (1 byte). This must be selected from the recepient's accepted address types.
110
+
* ''search_key'' equals "BIP999" and is a static ASCII-encoded string (6 bytes)
111
+
* ''notification_code'' is ''H(n<sub>x</sub> * P)'' (32 bytes)
112
+
* ''N<sub>x</sub>'' is the unique public key a sender is using for a particular recipient (33 bytes)
113
+
* ''address_type'' is the '''ordinal''' value of a single address type that a sender wants to send to (1 byte). This must be selected from the recepient's accepted address types.
113
114
114
115
When Alice wants to notify Bob that he will receive future payments from her, she performs the following procedure:
115
116
116
-
# Assigns an unused, unique index <code>x</code> to Bob (0 if Bob is the first party she is notifying).
117
-
# Calculates a notification code: <code>notification_code = SHA256(n_x * P)</code>
117
+
# Assigns an unused, unique index ''x'' to Bob (''0'' if Bob is the first party she is notifying).
118
+
# Calculates a notification code: ''notification_code = H(n<sub>x</sub> * P)''
118
119
# Commits to one of Bob's accepted address types by choosing its ordinal value. Going forward Alice must not send to address types other than the one she committed to in the notification.
119
120
# Constructs a notification payload by concatenating the above values according to the formula.
120
121
# Selects any UTXO in her wallet, preferably not associated with her.
121
-
# Sends a transaction with a single OP_RETURN output whose value is set to the constructed payload.
122
+
# Sends a transaction with a single <code>OP_RETURN</code> output whose value is set to the constructed payload.
122
123
123
-
When Bob notices an OP_RETURN starting with the search key, he performs the following procedure:
124
+
When Bob notices an <code>OP_RETURN</code> starting with the search key, he performs the following procedure:
124
125
125
126
# Breaks down the payload into its four constituent parts.
126
-
# Discards the search key (item #0).
127
-
# Selects <code>N_x</code> (item #2) and performs <code>SHA256(N_x * p)</code> (Bob does not know the value of <code>x</code>).
128
-
# If the above value matches the notification value (item #1), Bob found a notification addressed to himself and stores <code>N_x</code> together with <code>address_type</code>.
127
+
# Discards the ''search_key'' (item #0).
128
+
# Selects ''N<sub>x</sub>'' (item #2) and performs ''H(N<sub>x</sub> * p)'' (Bob does not know the value of ''x'').
129
+
# If the above value matches the notification value (item #1), Bob found a notification addressed to himself and stores ''N<sub>x</sub>'' together with ''address_type''.
129
130
# If this process fails for any reason, Bob assumes a spurious notification or one not addressed to himself and gives up.
130
131
131
-
Since changing <code>x</code> yields a completely different sender identity, Alice can always re-notify Bob from a different index when she does not want to be associated with her previous identity. Alice can also re-notify Bob when she wants to start sending to a different address type. Bob must be able to update his watchlist in that case and he can stop watching addresses associated with the old address type.
132
+
Since changing ''x'' yields a completely different sender identity, Alice can always re-notify Bob from a different index when she does not want to be associated with her previous identity. Alice can also re-notify Bob when she wants to start sending to a different address type. Bob must be able to update his watchlist in that case and he can stop watching addresses associated with the old address type.
132
133
133
134
===Transacting===
134
135
135
-
Alice initializes counter <code>c</code> which is unique to Bob and increments with each transaction. <code>c</code> is a 64-bit integer and must be inputted into a hasher as a big-endian encoded array of 8 bytes.
136
+
Alice initializes counter ''c'' which is unique to Bob and increments with each transaction. ''c'' is a 64-bit integer and must be inputted into a hasher as a big-endian encoded array of 8 bytes.
136
137
137
138
1. Alice calculates a secret point (constant between Alice and Bob):
138
139
139
-
<code>
140
-
S = n_x * P
141
-
</code>
140
+
''S = n<sub>x</sub> * P''
142
141
143
142
2. Alice calculates a shared secret:
144
143
145
-
<code>
146
-
s = SHA256(S, c)
147
-
</code>
144
+
''s = H(S | c)''
148
145
149
146
3. Alice calculates Bob's ephemeral public key and its associated address where the funds will be sent:
150
147
151
-
<code>
152
-
P_c = P + s*G
153
-
</code>
148
+
''P<sub>c</sub> = P + s*G''
154
149
155
-
4. Alice constructs an address using the key <code>P_c</code>, using one of the address types she committed to in the notification transaction.
150
+
4. Alice constructs an address using the key ''P<sub>c</sub>'', using one of the address types she committed to in the notification transaction.
156
151
157
-
Bob constructs his watchlist by mirroring this process on his end, except that his method of calculating S is:
152
+
Bob constructs his watchlist by mirroring this process on his end, except that his method of calculating ''S'' is:
158
153
159
-
<code>
160
-
S = N_x * p
161
-
</code>
154
+
''S = N<sub>x</sub> * p''
162
155
163
156
When Bob wants to spend from such addresses, he calculates his private keys in the following manner:
0 commit comments