BIP47 Lab - Payment Code Tools

01 Exchange Payment Codes

Alice gets Bob's payment code from his donation page. This contains Bob's xpub at path m/47'.

Alice (Sender)

→ requests payment code from →

Bob (Receiver)

Bob's Payment Code (from donation page)

02 Create Notification Transaction

Alice creates a shared secret using ECDH: S = k × B, where k is her UTXO private key and B is Bob's notification public key.

                                        Alice's UTXO key (k) ×
                                        Bob's notif key (B) =
                                        Shared Secret (S)
                                    
                                        Calculating...

                                    Why this matters: Using ECDH, Alice and Bob can share a secret without transmitting an encryption key. Only Bob can decrypt Alice's payment code because only he holds private key b.
                                

Transaction Structure

OP_RETURN (80 bytes encrypted payload)
Contains Alice's encrypted payment code

Output 1 → Bob's notification address (546 sats)
Alerts Bob that someone opened a channel

Output 2 → Alice's change address
Remaining balance minus fees

03 Derive Payment Addresses

After the notification transaction confirms, Alice can generate unique payment addresses for Bob using the formula: K = B + sG

// For each payment i:
B = Bob's xpub at index i
S = a × B
s = SHA256(Sx)
sG = s × G
K = B + sG ← Payment address public key

Derived Payment Addresses

Important: Some indices produce invalid points outside the curve. These are skipped automatically. Notice address indices may not be sequential (0, 1, 2, 5, 6...).

04 Bob Receives & Spends

Bob monitors his notification address and sees Alice's transaction. He derives the same addresses using: k = b + s

Private Key Derivation (Bob only)

// Bob calculates:
b = Bob's private key at index i
S = b × A
s = SHA256(Sx)
k = b + s ← Private key to spend

                                    Key Insight: Alice can generate addresses and send payments, but only Bob can spend them because only he knows private key b. This is the magic of BIP47—one-way address derivation.
                                

1

Notification TX

∞

Payment Addresses

0

Address Reuse

> BIP47 LAB