What are BIP 352 Silent Payments and what privacy problem do they solve on Bitcoin?

Bitcoin's transparency creates severe privacy vulnerabilities when recipients publish static addresses (such as donations or merchant checkouts). Address reuse allows chain analysis firms and eavesdroppers to link all past and future transactions to a single identity. Traditional solutions required running active payment servers (like BTCPay Server) to generate fresh xpub addresses per customer. BIP 352 Silent Payments introduces reusable, static public addresses (encoded as "sp1...") that allow senders to pay recipients without any communication or server interaction. Senders mathematically derive unique, unlinkable one-time Taproot keys directly from the transaction inputs, completely eliminating address reuse.

How does Alice (the sender) derive the one-time destination public key without knowing Bob's private key?

Bob publishes a Silent Payment address consisting of two public keys: a scan public key B_scan and a spend public key B_spend. When Alice creates a transaction, she aggregates the private keys of all her inputs (sum a_i) to form an input scalar a_sum and public key A_sum. Alice performs an Elliptic Curve Diffie-Hellman (ECDH) exchange: she computes the shared secret scalar tweak t = H("BIP0352/SharedSecret", a_sum * B_scan). Alice then tweaks Bob's spend key to create the output key P = B_spend + t * G. The resulting output is encoded as an ordinary P2TR (Pay-to-Taproot) address.

How does Bob discover that he received funds (the scanning process)?

Bob continuously scans new transactions on the blockchain. For each transaction with eligible inputs, Bob inspects the input public keys, computes A_sum, and multiplies it by his scan private key: b_scan * A_sum. Because b_scan * A_sum == a_sum * B_scan (the ECDH property), Bob derives the exact same tweak scalar t = H("BIP0352/SharedSecret", b_scan * A_sum). Bob then tests if P_calculated = B_spend + t * G matches any output in the transaction. If it matches, Bob records the output and derives the private spend key p = b_spend + t mod n to spend the coin.

Can a third-party observer or chain analysis firm link the on-chain output to Bob?

No. To an external observer, the output key P appears as an entirely random, standard Taproot 32-byte public key indistinguishable from any other P2TR output on the Bitcoin blockchain. Because the tweak t relies on a Diffie-Hellman exchange between Alice's private keys and Bob's scan key, no third party without access to either Alice's input private keys or Bob's scan private key can link P to Bob's silent payment address sp1...

BIP 352 Silent Payments Studio | Stealth Addresses & Ephemeral ECDH Scanning

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Bitcoin BIP 352 Standard Reusable sp1... Static Address Zero Address-Reuse Taproot

BIP 352 Silent Payments Studio

Simulate Bitcoin BIP 352 Silent Payments. Inspect dual-key generation (B_scan & B_spend), Alice's input-aggregated ECDH tweak derivation, on-chain Taproot output synthesis, and Bob's light-client scanning engine.

1. Recipient Key Material (Bob — Merchant)

Scan Private Key (b_scan):

Spend Private Key (b_spend):

Published Silent Payment Address (sp1...):

sp1qq9w7c5g998e3y327s5m... (67-byte bech32m)

2. Sender Transaction Setup (Alice)

Alice's Input UTXOs Count:

Payment Amount (BTC):

Output Label:

ECDH Tweak Scalar (t)

0x4c2b9f...

H(a_sum · B_scan)

On-Chain Output Key (P)

028a3f1b...

B_spend + t · G

Address Unlinkability

100.0%

Zero chain graph trace

Bob Detection Status

DETECTED

Private key derived!

Spendable Private Key (p)

b_spend + t mod n

Ready for Taproot spend

3. Dual-Key Diffie-Hellman Cryptographic Flow

Step 1: Alice's Tweak Derivation

Inputs: [UTXO 1, UTXO 2] → Sum: a_sum.
ECDH: S = a_sum · B_scan.
Tweak scalar: t = H("BIP0352/SharedSecret", S, k).
One-time Output: P = B_spend + t · G.

Step 2: On-Chain Public Footprint

Broadcasted Script: OP_1 <P> (34 bytes).
Chain Observers See: Normal Taproot spend.
Address reuse: NONE (P is mathematically unique).
Link to Bob's sp1... address: IMPOSSIBLE.

Step 3: Bob's Scanning & Spend Key

Bob checks TX inputs: computes A_sum.
ECDH: S' = b_scan · A_sum == S!
Recovers tweak: t = H(S', k).
Computes: p = (b_spend + t) mod n → Spends UTXO!

BIP 352 Silent Payments Studio

1. Recipient Key Material (Bob — Merchant)

2. Sender Transaction Setup (Alice)

3. Dual-Key Diffie-Hellman Cryptographic Flow

4. BIP 352 Python Reference Implementation (secp256k1)

🔍 Companion Workbenches & Verification Tools

W3C DID & Verifiable Credentials Studio: Self-Sovereign Identity & Zero-Knowledge Proofs

Lattice-Based Post-Quantum Zero-Knowledge Studio | Module-LWE & Module-SIS Proofs

CAEP & Shared Signals Protocol Studio: Real-Time Zero Trust Security Events

BIP 324 v2 Encrypted P2P Transport Studio | Elligator Swift & Censorship Resistance

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions