btcutil: Add library functions for BIP-0352 silent payment _send_ support by guggero · Pull Request #2244 · btcsuite/btcd

guggero · 2024-09-01T20:28:17Z

Adds library/API functionality for Silent Payment send support.

Implements the following BIPs (or pull requests to BIPs):

BIP-0352 - Silent Payments (added in BIP 352: Silent Payments bitcoin/bips#1458)
BIP-0374 - Discrete Log Equality Proofs (added in BIP374: Discrete Log Equality Proofs (DLEQ) bitcoin/bips#1689)
BIP-0375 - Sending Silent Payments with PSBTs (added in BIP375: Sending Silent Payments in PSBTs bitcoin/bips#1687)

Goal is to address send support first as that's rather straightforward. Receive support is much more involved as it requires scanning the chain in a specific manner.

coveralls · 2024-10-20T15:47:50Z

Pull Request Test Coverage Report for Build 20168757637

Details

522 of 731 (71.41%) changed or added relevant lines in 9 files are covered.
97 unchanged lines in 4 files lost coverage.
Overall coverage increased (+0.05%) to 55.009%

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
btcutil/silentpayments/output.go	53	59	89.83%
btcutil/silentpayments/secp.go	40	51	78.43%
btcutil/psbt/partial_output.go	27	39	69.23%
btcutil/psbt/partial_input.go	32	46	69.57%
btcutil/psbt/psbt.go	40	54	74.07%
btcutil/psbt/silentpayments.go	40	58	68.97%
btcutil/silentpayments/input.go	81	102	79.41%
btcutil/silentpayments/dleq.go	104	131	79.39%
btcutil/silentpayments/address.go	105	191	54.97%

Files with Coverage Reduction	New Missed Lines	%
mempool/mempool.go	1	66.56%
btcutil/gcs/gcs.go	4	80.95%
database/ffldb/blockio.go	4	88.81%
rpcclient/infrastructure.go	88	39.75%

Totals
Change from base Build 19121431262:	0.05%
Covered Lines:	31631
Relevant Lines:	57501

💛 - Coveralls

benma · 2025-08-14T12:14:10Z

This is great work and very welcome. However, BIP-375 specifies exclusion for PSBTv0, so this will not be compatible with other PSBT libraries/wallets. Imho it would be best to focus on adding support for PSBTv2 first (#2328).

myxmaster · 2026-03-14T10:37:12Z

Hey, just wanted to drop a quick note as an LND user who's been following this PR and the overall silent payments effort.

I understand that PSBTv2 support (#2328) would be needed for full BIP375 compliance and interoperability with external signers/hardware wallets. But even without that, having SP send support land in btcutil would already be a huge step forward, since it would unblock LND PR lightningnetwork/lnd#9398 and allow LND users to send to silent payment addresses using LND's internal wallet and signer.

Would love to see this land. Thanks for all the great work on this @guggero!

TechLateef · 2026-03-14T14:16:28Z

Hey @guggero and @benma , just a heads up that I'm starting work on the PSBTv2 support requested in #2328. Hopefully, that will help unblock full BIP375 compliance for this PR soon!

yyforyongyu · 2026-06-04T07:48:14Z

+	B := ScalarMult(privateKey.Key, scanKey)
+	G := Generator()
+
+	proof, err := DLEQProof(privateKey, B, G, r, nil)


CreateShare passes the computed ECDH share (a·scanKey) as the B argument to DLEQProof. DLEQProof then computes C = a·B, so this proof is for a²·scanKey, not for the returned share. A verifier using (A=privateKey.PubKey(), B=scanKey, C=share) will reject it. This should pass scanKey to DLEQProof and return the separately computed share.

Great catch! Fixed and added unit test.

yyforyongyu · 2026-06-04T07:48:14Z

+	}
+
+	// Let rand = hash_BIP0374/nonce(t || cbytes(A) || cbytes(C)).
+	rand := chainhash.TaggedHash(


Current BIP374 includes the optional message in the nonce derivation: hash_BIP0374/nonce(t || cbytes(A) || cbytes(C) || m'). This implementation omits m, which can leak a if the same aux randomness is reused with different messages.

Yes, this was updated later on in the BIP. Fixed and did a full review on the latest version of the BIP.

yyforyongyu · 2026-06-04T07:48:14Z

+		// These types are supported in any case.
+		return true, script, nil
+
+	case txscript.ScriptHashTy:


This accepts every P2SH output as silent-payment compatible. BIP352 only includes P2SH-P2WPKH in shared-secret derivation; arbitrary P2SH/multisig inputs should be excluded or otherwise identified precisely, otherwise sender and receiver can derive different secrets.

Correct. Passing in the public key now so we can at least assert the address wasn't made from an incorrect (e.g. uncompressed key).

yyforyongyu · 2026-06-04T07:48:14Z

+		return nil, errors.New("invalid bech32 version")
+	}
+
+	regrouped, err := bech32.ConvertBits(data[1:], 5, 8, false)


DecodeAddress slices data[1:] and later reads data[0] before checking that data is non-empty. A checksum-valid Bech32m string with an empty data part can panic here instead of returning an error.

Yes, good catch. Added a fuzz test as well and ran it for a few hours on a beefy machine.

yyforyongyu · 2026-06-04T07:48:14Z

+func DLEQVerify(A, B, C, G *btcec.PublicKey, proof [64]byte, m *[32]byte) bool {
+	// Fail if any of is_infinite(A), is_infinite(B), is_infinite(C),
+	// is_infinite(G).
+	if !A.IsOnCurve() || !B.IsOnCurve() || !C.IsOnCurve() {


The comment quotes BIP374's requirement to fail if any of A, B, C, or G is infinite/off-curve, but the code only checks A, B, and C. Since G is caller-supplied, it should be validated too.

Makes sense, fixed.

yyforyongyu · 2026-06-04T07:48:14Z

+
+	idx := 0
+	grouped := make([][]Address, len(groups))
+	for _, group := range groups {


GroupByScanKey builds the returned slice by ranging over a map, so group order is randomized. Since AddressOutputKeys documents that recipients are ordered by output index and returns a flat result slice, this can make the returned output order nondeterministic for multiple scan-key groups.

Very good point, addressed and unit tested.

yyforyongyu

Fired some agents to review it while catching up with the bip🤓

ping-localhost · 2026-06-08T09:11:30Z

I currently use btcutil.DecodeAddress to validate if a provided Bitcoin address is valid. Seeing how it hasn't been changed, I'll have to make a fallback for Silent Payments once this is merged?

Is it maybe a good idea to add a more generic ValidateAddress-function that can deal with all types? Just brain dumping, so feel free to ignore me.

guggero · 2026-06-18T14:13:59Z

I currently use btcutil.DecodeAddress to validate if a provided Bitcoin address is valid. Seeing how it hasn't been changed, I'll have to make a fallback for Silent Payments once this is merged?

Is it maybe a good idea to add a more generic ValidateAddress-function that can deal with all types? Just brain dumping, so feel free to ignore me.

Hmm, that's a valid point. But I'm not sure what would be best here. Adding anything to the existing DecodeAddress in the now-extracted address/v2 package can't be done, as that would introduce a circular package dependency.
And adding a new DecodeAnyAddress would need to return an address.Address interface. But that interface requires the ScriptAddress() []byte method to be defined that can be used to produce the pkScript of a receiver output.
But that's exactly the complication with Silent Payment addresses: They are dependent on the inputs being spent.
So for safety reasons, the ScriptAddress method would need to panic for Silent Payment addresses and any caller would need to know how to deal with them.

So perhaps a simple silentpayments.IsValidAddress() would be enough to make the detection easier?

guggero · 2026-06-18T14:17:03Z

Thanks a lot for the review, @yyforyongyu! I addressed all your points and did a full (agentic) review against the three updated BIPs and made sure all updated test vectors also pass. Should be quite solid now.

ping-localhost · 2026-06-18T14:17:16Z

So perhaps a simple silentpayments.IsValidAddress() would be enough to make the detection easier?

Yeah, that would help already! Anything to make the process easier is very much appreciated.

guggero · 2026-06-18T14:24:32Z

So perhaps a simple silentpayments.IsValidAddress() would be enough to make the detection easier?

Yeah, that would help already! Anything to make the process easier is very much appreciated.

Okay, I've added IsValidAddress(string) bool.

Fixes an independent issue discovered while reviewing and testing the code that failed to detect duplicate xPubs because the wrong variable (keyData holding the nil value of the global unsigned TX, instead of the lowercase keydata that's the loop variable).

guggero force-pushed the silent-payments branch from 95b791d to f8bf376 Compare October 20, 2024 15:44

guggero force-pushed the silent-payments branch 4 times, most recently from 2a9a931 to 996c4d3 Compare December 31, 2024 08:19

guggero mentioned this pull request Dec 31, 2024

Add Silent Payment send support lightningnetwork/lnd#9398

Draft

saubyk assigned guggero Feb 13, 2025

saubyk added this to the v0.25 milestone Feb 13, 2025

saubyk requested a review from kcalvinalvin February 18, 2025 00:48

guggero force-pushed the silent-payments branch from 996c4d3 to 28b7587 Compare March 28, 2025 20:35

guggero marked this pull request as ready for review March 28, 2025 20:37

guggero force-pushed the silent-payments branch 2 times, most recently from 88fa441 to 8a4fe70 Compare March 28, 2025 20:47

guggero force-pushed the silent-payments branch from 8a4fe70 to dc6f721 Compare October 30, 2025 13:44

guggero force-pushed the silent-payments branch from dc6f721 to a2a18af Compare December 12, 2025 13:47

guggero mentioned this pull request Dec 16, 2025

[WIP] btcutil: Add library functions for BIP-0352 silent payment _scan_ support #2466

Draft

TechLateef mentioned this pull request Mar 15, 2026

psbt: implement PSBTv2 (BIP-370) support #2496

Open

otaliptus mentioned this pull request Mar 16, 2026

bip-0370 PSBT Version 2 support #2328

Open

guggero force-pushed the silent-payments branch from a2a18af to a78309b Compare May 20, 2026 09:45

yyforyongyu reviewed Jun 4, 2026

View reviewed changes

guggero force-pushed the silent-payments branch from a78309b to 4021194 Compare June 18, 2026 14:13

guggero force-pushed the silent-payments branch from 4021194 to ddc83d7 Compare June 18, 2026 14:24

guggero added 8 commits June 25, 2026 07:12

silentpayments: add test vectors, implement addr struct

3f5a596

silentpayments: add send output support

1ff7d8b

silentpayments: implement DLEQ proofs

2577a19

psbt: add global/input silent payment shares

0d0f9ea

psbt: add global/input silent payment DLEQ proofs

1282cfe

psbt: add output silent payment info

49fad28

psbt: add test vectors from BIP-375

4109502

guggero force-pushed the silent-payments branch from ddc83d7 to f74abc7 Compare June 25, 2026 05:12

Uh oh!

Conversation

guggero commented Sep 1, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

coveralls commented Oct 20, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request Test Coverage Report for Build 20168757637

Details

💛 - Coveralls

Uh oh!

benma commented Aug 14, 2025

Uh oh!

myxmaster commented Mar 14, 2026

Uh oh!

TechLateef commented Mar 14, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yyforyongyu left a comment

Choose a reason for hiding this comment

Uh oh!

ping-localhost commented Jun 8, 2026

Uh oh!

guggero commented Jun 18, 2026

Uh oh!

guggero commented Jun 18, 2026

Uh oh!

ping-localhost commented Jun 18, 2026

Uh oh!

guggero commented Jun 18, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

guggero commented Sep 1, 2024 •

edited

Loading

coveralls commented Oct 20, 2024 •

edited

Loading