Stealth Addresses
Generic concept of generating a unique receiving address per payment via Diffie-Hellman key agreement between sender and receiver. Provides on-chain unlinkability for payments to the same recipient.
History
- 2014: original stealth-address proposals (Peter Todd, BIP63 draft).
- BIP63 was withdrawn; never widely adopted.
- BIP47 (2014) — concrete reusable payment codes (PayNyms).
- BIP352 (2024) — Silent Payments, the modern Schnorr-based variant.
Concept
Receiver: scan key (s), spend key (b)
public form (S, B)
Sender: per-payment random e
compute: P = B + H(e * S) * G
send to: address(P)
Receiver scans all txs for outputs matching: P = B + H(s * eG) * G
(where eG is the sender's ephemeral pubkey)
knowing s, derive scalar t = H(s * eG)
spend key for output: b + t (mod n)
Compared modern variants
- BIP47: uses notification tx + simpler derivation.
- BIP352 Silent Payments: stealth address concept refined for Schnorr, no notification tx.
- Monero stealth addresses: same concept native to Monero (cross-chain inspiration).
Status
- Generic "stealth address" no longer common term in Bitcoin context.
- Modern Bitcoin equivalents = BIP47 (older) and BIP352 (newer).