<blockquote>
  <p>What is exactly user B's stealth address? Is it his public key?</p>
</blockquote>

<p>In the simplest stealth address scheme, yes. The exact encoding depends on the implementation; DarkWallet's is described <a href="https://wiki.unsystem.net/en/index.php/DarkWallet/Stealth#Address_format" rel="nofollow">in their wiki</a>.</p>

<blockquote>
  <p>how can I multiply this coordinate with PublicB since both of them are points?</p>
</blockquote>

<p>Correct, <code>S = PrivA * PublicB = PrivB * PublicA</code> is a point. We want an integral shared secret. ECDH tells you to use the x coordinate of <code>S</code> as the shared secret, but in Bitcoin it's done differently. Instead <code>int(sha256(compress(S)))</code> is used:</p>

<ol>
<li>serialize S in compressed form as per <a href="http://www.secg.org/sec1-v2.pdf#page=16" rel="nofollow">SEC 1's Elliptic-Curve-Point-to-Octet-String Conversion</a></li>
<li>take its SHA-256 digest</li>
<li>interpret the result as a 256-bit big-endian integer</li>
</ol>

<p>This integer, <code>c</code>, is then used by A to calculate a public key <code>PublicB + c*G</code> to which A spends, and by B to calculate its private key <code>(PrivB + c) * G</code> from which B can redeem (where <code>G</code> is the base point generator).</p>

<p>Note that there's a problem with this "simplest" scheme. The only way that B's wallet software can see if a UTXO is redeemable by B (to keep track of the wallet's balance) is by doing the math above, which requires <code>PrivB</code>. In other words, it makes watching-only wallets impossible (and cold wallets impractical).</p>

<p>One solution to this is to use one <code>PublicB</code>/<code>PrivB</code> pair for ECDH, but a different <code>PublicB2</code>/<code>PrivB2</code> pair for deriving the spend/redeem keys. Now you can keep <code>PrivB</code> in your watching-only wallet, and <code>PrivB2</code> in your cold wallet. On the down side, B's stealth address is now twice as long, containing both <code>PublicB</code> and <code>PublicB2</code>.</p>

CC BY-SA 3.0
2015-05-08T00:29:48.440Z
Perfect. Thanks for your detailed answer.
abeikverdi
CC BY-SA 3.0
2015-05-07T16:45:21.740Z
2015-05-07T16:45:21.740Z
Christopher Gurnee
<p>Lets say user <code>A</code> wants to send bitcoin to user <code>B</code> stealth address.</p>

<ol>
<li><p>What is exactly user <code>B</code>'s stealth address? Is it his public key? Since User <code>A</code> needs to multiply his private key with user <code>B</code>'s public key based on <a href="http://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman" rel="nofollow">Elliptic Curve Diffie-Hellman</a> so I assume user <code>A</code> is receiving the complete point which is user <code>B</code>'s public key.</p></li>
<li><p>User <code>A</code> shoud calculate <code>PrivA * PublicB</code> which results in a coordinate. As far as I know this point will be used by multiplying it to the <code>publicB</code> and a nonce and that will be sent to the network. If what I am saying is correct, how can I multiply this coordinate with <code>PublicB</code> since both of them are points. Do we only get one axis of this point from the diffie hellman's calculation?</p></li>
</ol>

CC BY-SA 3.0
2015-05-07T15:50:39.167Z
Very good question. Pybitcointools has [code](https://github.com/vbuterin/pybitcointools/blob/master/bitcoin/stealth.py) for it FWIW
Wizard Of Ozzie
<stealth-address>
Stealth address in technical level
abeikverdi
# Stealth address in technical level

(Asked by: username_0 on 2015-05-07)

Lets say user `A` wants to send bitcoin to user `B` stealth address.

1. What is exactly user `B`'s stealth address? Is it his public key? Since User `A` needs to multiply his private key with user `B`'s public key based on [Elliptic Curve Diffie-Hellman](http://en.wikipedia.org/wiki/Elliptic_curve_Diffie%E2%80%93Hellman) so I assume user `A` is receiving the complete point which is user `B`'s public key.
2. User `A` shoud calculate `PrivA * PublicB` which results in a coordinate. As far as I know this point will be used by multiplying it to the `publicB` and a nonce and that will be sent to the network. If what I am saying is correct, how can I multiply this coordinate with `PublicB` since both of them are points. Do we only get one axis of this point from the diffie hellman's calculation?

**Tags:** stealth-address

> **Comments:**
> **username_1**: Very good question. Pybitcointools has [code](https://github.com/vbuterin/pybitcointools/blob/master/bitcoin/stealth.py) for it FWIW  

---

## 1 answers

### Answer by username_2 on 2015-05-07. Score: 3 | Accepted answer

> What is exactly user B's stealth address? Is it his public key?

In the simplest stealth address scheme, yes. The exact encoding depends on the implementation; DarkWallet's is described [in their wiki](https://wiki.unsystem.net/en/index.php/DarkWallet/Stealth#Address_format).

> how can I multiply this coordinate with PublicB since both of them are points?

Correct, `S = PrivA * PublicB = PrivB * PublicA` is a point. We want an integral shared secret. ECDH tells you to use the x coordinate of `S` as the shared secret, but in Bitcoin it's done differently. Instead `int(sha256(compress(S)))` is used:

1. serialize S in compressed form as per [SEC 1's Elliptic-Curve-Point-to-Octet-String Conversion](http://www.secg.org/sec1-v2.pdf#page=16)
2. take its SHA-256 digest
3. interpret the result as a 256-bit big-endian integer

This integer, `c`, is then used by A to calculate a public key `PublicB + c*G` to which A spends, and by B to calculate its private key `(PrivB + c) * G` from which B can redeem (where `G` is the base point generator).

Note that there's a problem with this "simplest" scheme. The only way that B's wallet software can see if a UTXO is redeemable by B (to keep track of the wallet's balance) is by doing the math above, which requires `PrivB`. In other words, it makes watching-only wallets impossible (and cold wallets impractical).

One solution to this is to use one `PublicB`/`PrivB` pair for ECDH, but a different `PublicB2`/`PrivB2` pair for deriving the spend/redeem keys. Now you can keep `PrivB` in your watching-only wallet, and `PrivB2` in your cold wallet. On the down side, B's stealth address is now twice as long, containing both `PublicB` and `PublicB2`.

> **Comments:**
> **username_0**: Perfect. Thanks for your detailed answer.  

---

