diff --git a/elip-silent-payments-liquid.mediawiki b/elip-silent-payments-liquid.mediawiki
new file mode 100644
index 0000000..577b06c
--- /dev/null
+++ b/elip-silent-payments-liquid.mediawiki
@@ -0,0 +1,152 @@
+
+ELIP: ?
+Layer: Applications
+Title: Silent Payments for the Liquid Network
+Author: 42pupusas
+Comments-Summary: No comments yet.
+Comments-URI: https://github.com/ElementsProject/elips/wiki/Comments:ELIP-????
+Status: Draft
+Type: Standards Track
+Created: 2026-06-01
+License: BSD-3-Clause
+
+
+==Abstract==
+
+This document specifies Silent Payments for the Liquid Network. The key derivation,
+address format, scanning, and spending follow BIP-352[BIP-352: Silent Payments. https://github.com/bitcoin/bips/blob/master/bip-0352.mediawiki]
+exactly. This specification only adds Liquid-specific differences.
+
+==Motivation==
+
+Confidential Transactions (CT)[Confidential Transactions. https://elementsproject.org/features/confidential-transactions]
+hide a Liquid output's asset and amount but not its
+script. A receiver with one published address has to either reuse it, (linking
+all their payments) or run an interactive protocol to hand out fresh ones. Silent
+Payments remove that trade-off: one static address, a distinct unlinkable output per payment.
+
+==Specification==
+
+We reuse the notation, functions, and conventions of BIP-352. In particular,
+serP(P) is the SEC1 compressed encoding of a point, ser32(i)
+serializes a 32-bit unsigned integer most-significant-byte first, n is the
+secp256k1 curve order, and hashtag(x) denotes
+SHA256(SHA256(tag) || SHA256(tag) || x) as defined in
+BIP-340[BIP-340: Schnorr Signatures for secp256k1. https://github.com/bitcoin/bips/blob/master/bip-0340.mediawiki].
+
+We additionally define:
+
+* Let blind_tag be the exact 26-byte ASCII string LiquidSilentPayments/Blind.
+
+A mismatch in these bytes breaks unblinding across implementations. The tag is disjoint
+from BIP-352's BIP0352/SharedSecret, so the blinding key and the BIP-352
+output tweak, though both derived from S, do not reveal each other.
+
+A silent payment on Liquid is a BIP-352 output that is additionally made a confidential
+Liquid output, blinded to a per-output blinding key derived from the same shared secret.
+The sender, for each output index k:
+
+* Let S be the shared secret and P_k the output public key, derived as in BIP-352
+* Let scriptPubKey = OP_1 , a BIP-341[BIP-341: Taproot: SegWit version 1 spending rules. https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki] Taproot output
+* Let bk_k = int(hashblind_tag(serP(S) || ser32(k))) mod n
+** If bk_k = 0, increment k and continue
+* Let BK_k = bk_k·G
+* Blind the output's asset and amount to BK_k, as for any confidential Liquid output
+
+The receiver, having recomputed S as in BIP-352, recomputes
+bk_k and unblinds the output with no out-of-band exchange. Deriving the
+blinding key from S avoids both a fixed address-level blinding key (which
+would link a receiver's outputs) and an interactive per-output exchange.
+
+===Differences from BIP-352===
+
+* '''Output format.''' The output is a ''confidential'' Liquid TaprootBK_k, rather than a bare Taproot output.
+* '''outpoint_L encoding.''' Outpoints use the Elements consensus encoding (32-byte txid in internal byte order followed by 4-byte little-endian vout) in place of BIP-352's Bitcoin encoding.
+* '''Address HRP.''' The human-readable part is lqsp (mainnet) or tlqsp (testnet and regtest) — distinct from ex/tex, lq/tlq, and Bitcoin's sp/tsp. The address payload, version symbol (q), and relaxed Bech32 length limit are unchanged from BIP-352.
+* '''Light-client scanning.''' The BIP-158[BIP-158: Compact Block Filters for Light Clients. https://github.com/bitcoin/bips/blob/master/bip-0158.mediawiki] compact-filter step is unnecessary: CT does not blind the scriptPubKey, so a client matches its derived candidate scripts directly against the public output scripts. The BIP-352 tweak server[BIP-352 Silent Payments index server. https://github.com/bitcoin/bips/blob/master/bip-0352/index-server.mediawiki] (publishing T = input_hash·A per transaction) is used unchanged.
+
+Everything else follows BIP-352 exactly: input eligibility, the even-Y rule,
+input_hash, S = input_hash·a·B_scan, the output tweak
+t_k, labels, gap-limit scanning, and the Taproot key-path spend with
+d = b_spend + t_k.
+
+===Privacy===
+
+Detecting or unblinding a silent payment requires the Diffie-Hellman shared secret
+S = input_hash·a·B_scan = b_scan·(input_hash·A). Computing it needs either the
+sender's input secret a or the receiver's secret scan key b_scan,
+so this inherits the BIP-352 privacy model. CT adds one thing on top: even someone who
+holds b_scan learns only that an output is a silent payment, not its amount or asset.
+
+==Test Vectors==
+
+All byte strings are hex. Receiver keys:
+
+
+b_scan = 1111111111111111111111111111111111111111111111111111111111111111
+b_spend = 2222222222222222222222222222222222222222222222222222222222222222
+
+
+Two eligible inputs:
+
+
+input 0: priv = 3131...31 (0x31 x32), outpoint txid = 1010...10 (0x10 x32), vout = 0
+input 1: priv = 3232...32 (0x32 x32), outpoint txid = 2020...20 (0x20 x32), vout = 1
+
+
+Aggregated values (outpoint_L = input 0, the lexicographically smaller):
+
+
+A = 031195a8046dcbb8e17034bca630065e7a0982e4e36f6f7e5a8d4554e4846fcd99
+input_hash = d392922c00280a7e8d282182f5026f2fddbc74c1e1de18b4822128b2b77ec641
+
+
+Per-output values:
+
+
+k = 0:
+ P_k = 02a29d9716417c964ca9e477343e71ffe730a4991a3eaad668eabec84e9feb7931
+ BK_k = 0344e1289497e6da66fde710d2f38de053fc07355e405524401d7d609df5a1a8cc
+ bk_k = 70ab8897b64bd21b427339ff4d014b883191ef6425862246c53bfc27a59aa3f0
+ spend priv = f03c436d2cd67ae1fecf7d88a38aa3a03c0abea43feaf6da8eb71e2e3a866bda
+ scriptPubKey = 5120a29d9716417c964ca9e477343e71ffe730a4991a3eaad668eabec84e9feb7931
+
+k = 1:
+ P_k = 0229d77654023af267dbe9cb7ff1956f947c816f203494381308387168fb010c92
+ BK_k = 03efdeda770ccdbe8bf466fba48bfd2b2c436ab0c04658fc6d6c277de5078129fa
+ bk_k = 945ba73a9804f62089c7d2ffdc079031031f0aebab372cec17ef9c110ebceb10
+ spend priv = 9eff3472230fc83ef5ea8f8c80401c4eecd595a048bd2482a107d3a49baa5a58
+ scriptPubKey = 512029d77654023af267dbe9cb7ff1956f947c816f203494381308387168fb010c92
+
+
+Mainnet address (HRP lqsp):
+
+
+lqsp1qqd8n2k7uklxq4aegau7vawtptkgxsja4kt99lpv6krctwpq8tpc65qjxd4lu4etruh9sngx3su9mtqp5fqzxz7re59y5nnez9p03ht3lyudcfhfe
+
+
+Because blinding factors are randomized per output, the blinded output is not
+byte-reproducible. What matters is that an output blinded to BK_k
+unblinds under bk_k and under no other key.
+
+==Backwards Compatibility==
+
+No consensus change. A silent-payment output is an ordinary confidential Taproot output,
+spent by an ordinary key-path signature, so existing relay and validation rules apply.
+Wallets that don't implement this are unaffected.
+
+==Reference Implementations==
+
+* Rust: [[elip-silent-payments-liquid/rust/src/lib.rs|elip-silent-payments-liquid/rust/src/lib.rs]]
+* Python: [[elip-silent-payments-liquid/python/elip_sp_reference/core.py|elip-silent-payments-liquid/python/elip_sp_reference/core.py]]
+
+==Acknowledgements==
+
+This specification builds on BIP-352, the BIP-352 index server specification- >) -> Vec {
+ outpoints
+ .into_iter()
+ .map(|o| o.as_ref().to_vec())
+ .min()
+ .expect("at least one outpoint")
+}
+
+/// `input_hash = SHA256("BIP0352/Inputs"||"BIP0352/Inputs" || outpoint_L || serP(A))` mod n.
+///
+/// `outpoint_L` is the lexicographically smallest outpoint, selected internally.
+fn input_hash(outpoints: &[Vec], a_pubkey: &PublicKey) -> Scalar {
+ let mut eng = InputsHash::engine();
+ eng.input(&lowest_outpoint(outpoints));
+ eng.input(&a_pubkey.serialize());
+ Scalar::from_be_bytes(InputsHash::from_engine(eng).to_byte_array())
+ .expect("input_hash < curve order")
+}
+
+/// `t_k = SHA256("BIP0352/SharedSecret"||"BIP0352/SharedSecret" || serP(S) || ser32(k))` mod n.
+fn shared_secret_tweak(s: &PublicKey, k: u32) -> Scalar {
+ let mut eng = SharedSecretHash::engine();
+ eng.input(&s.serialize());
+ eng.input(&k.to_be_bytes());
+ Scalar::from_be_bytes(SharedSecretHash::from_engine(eng).to_byte_array())
+ .expect("t_k < curve order")
+}
+
+/// `bk_k = SHA256("LiquidSilentPayments/Blind"||"LiquidSilentPayments/Blind" || serP(S) || ser32(k))` mod n.
+fn blinding_secret(s: &PublicKey, k: u32) -> SecretKey {
+ let mut eng = BlindHash::engine();
+ eng.input(&s.serialize());
+ eng.input(&k.to_be_bytes());
+ SecretKey::from_slice(&BlindHash::from_engine(eng).to_byte_array()).expect("bk_k < curve order")
+}
+
+/// Sender's ECDH shared secret: `S = input_hash · a · B_scan`.
+fn sender_shared_secret(scan: &PublicKey, agg: &AggregatedInputs) -> PublicKey {
+ let a_ih = agg.a_sum.mul_tweak(&agg.input_hash).expect("scalar mul");
+ scan.mul_tweak(&EC, &secret_key_to_scalar(&a_ih))
+ .expect("ecdh")
+}
+
+/// Receiver's ECDH shared secret: `S = b_scan · (input_hash · A)`.
+fn receiver_shared_secret(
+ b_scan: &SecretKey,
+ a_pubkey: &PublicKey,
+ input_hash: &Scalar,
+) -> PublicKey {
+ let b_ih = b_scan.mul_tweak(input_hash).expect("scalar mul");
+ a_pubkey
+ .mul_tweak(&EC, &secret_key_to_scalar(&b_ih))
+ .expect("ecdh")
+}
+
+/// Derive `P_k`, `bk_k`, `BK_k` for output `k` from a shared secret and spend base.
+fn derive_output(spend_base: &PublicKey, s: &PublicKey, k: u32) -> SilentPaymentOutput {
+ let t_k = shared_secret_tweak(s, k);
+ let spend_pubkey = spend_base.add_exp_tweak(&EC, &t_k).expect("P_k");
+ let sk = blinding_secret(s, k);
+ SilentPaymentOutput {
+ spend_pubkey,
+ blinding_pubkey: sk.public_key(&EC),
+ blinding_seckey: sk,
+ }
+}
+
+// ── Public API ──
+
+/// Aggregate the sender's eligible inputs.
+///
+/// Keys are used as-is; this models a set of non-taproot inputs whose full public
+/// key is recoverable from the witness/scriptSig. For taproot (BIP-341) inputs,
+/// use [`aggregate_inputs_with_parity`] so the even-Y normalization is applied.
+pub fn aggregate_inputs(inputs: &[(Vec, SecretKey)]) -> AggregatedInputs {
+ let keys: Vec<(Vec, SecretKey, bool)> = inputs
+ .iter()
+ .map(|(o, sk)| (o.clone(), *sk, false))
+ .collect();
+ aggregate_inputs_with_parity(&keys)
+}
+
+/// Aggregate eligible inputs, applying BIP-352 even-Y normalization per input.
+///
+/// Each entry is `(outpoint, private_key, is_taproot)`. For taproot inputs the
+/// key is replaced by [`normalize_taproot_input_key`] before summation, exactly
+/// as BIP-352 requires ("for each private key `a_i` corresponding to a BIP341
+/// taproot output, check that the private key produces a point with an even Y
+/// coordinate and negate the private key if not"). The aggregate `a` and
+/// `A = a·G` — and therefore every derived output — differ from the un-normalized
+/// aggregate whenever any taproot input key had odd Y.
+pub fn aggregate_inputs_with_parity(inputs: &[(Vec, SecretKey, bool)]) -> AggregatedInputs {
+ let norm = |sk: SecretKey, is_taproot: bool| {
+ if is_taproot {
+ normalize_taproot_input_key(sk)
+ } else {
+ sk
+ }
+ };
+ let (first, rest) = inputs.split_first().expect("at least one eligible input");
+ let mut a_sum = norm(first.1, first.2);
+ for (_, sk, is_taproot) in rest {
+ a_sum = a_sum
+ .add_tweak(&secret_key_to_scalar(&norm(*sk, *is_taproot)))
+ .expect("non-zero aggregated key");
+ }
+ let a_pubkey = a_sum.public_key(&EC);
+ let outpoints: Vec> = inputs.iter().map(|(o, _, _)| o.clone()).collect();
+ let input_hash = input_hash(&outpoints, &a_pubkey);
+ AggregatedInputs {
+ a_sum,
+ a_pubkey,
+ input_hash,
+ }
+}
+
+/// Sender: derive output `k` for a given address.
+pub fn sender_derive_output(
+ address: &SilentPaymentAddress,
+ agg: &AggregatedInputs,
+ k: u32,
+) -> SilentPaymentOutput {
+ let s = sender_shared_secret(&address.scan, agg);
+ derive_output(&address.spend, &s, k)
+}
+
+/// Receiver: recompute output `k` and the spend private key `b_spend + t_k`.
+pub fn receiver_derive_output(
+ b_scan: &SecretKey,
+ b_spend: &SecretKey,
+ a_pubkey: &PublicKey,
+ input_hash: &Scalar,
+ k: u32,
+) -> (SilentPaymentOutput, SecretKey) {
+ let s = receiver_shared_secret(b_scan, a_pubkey, input_hash);
+ let out = derive_output(&b_spend.public_key(&EC), &s, k);
+ let t_k = shared_secret_tweak(&s, k);
+ let spend_sk = b_spend.add_tweak(&t_k).expect("spend sk");
+ (out, spend_sk)
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// Section 4 — Tweak server
+// ═══════════════════════════════════════════════════════════════════════════════
+//
+// The server publishes `T = input_hash · A`. The client computes `S = b_scan · T`.
+// On Liquid, BIP-158 compact filters are unnecessary: the scriptPubKey is public.
+
+/// Compute `(T = input_hash · A, input_hash, A)` from the eligible input public
+/// keys and the transaction's outpoints (the smallest is selected internally).
+pub fn compute_tweak(
+ input_pubkeys: &[PublicKey],
+ outpoints: &[Vec],
+) -> (PublicKey, Scalar, PublicKey) {
+ let a = PublicKey::combine_keys(&input_pubkeys.iter().collect::>())
+ .expect("at least one input pubkey");
+ let ih = input_hash(outpoints, &a);
+ let t = a.mul_tweak(&EC, &ih).expect("tweak point");
+ (t, ih, a)
+}
+
+/// A published tweak for one transaction.
+#[derive(Debug, Clone)]
+pub struct TweakEntry {
+ pub txid: [u8; 32],
+ pub tweak: PublicKey, // T = input_hash · A
+ pub a_pubkey: PublicKey, // A
+ pub input_hash: Scalar, // input_hash
+}
+
+/// Minimal tweak server.
+#[derive(Debug, Default)]
+pub struct TweakServer {
+ entries: Vec,
+}
+
+impl TweakServer {
+ pub fn publish(&mut self, txid: [u8; 32], input_pubkeys: &[PublicKey], outpoints: &[Vec]) {
+ let (tweak, input_hash, a_pubkey) = compute_tweak(input_pubkeys, outpoints);
+ self.entries.push(TweakEntry {
+ txid,
+ tweak,
+ a_pubkey,
+ input_hash,
+ });
+ }
+
+ pub fn get_by_txid(&self, txid: &[u8; 32]) -> Option<&TweakEntry> {
+ self.entries.iter().find(|e| &e.txid == txid)
+ }
+}
+
+/// `S = b_scan · T` (from a tweak server entry).
+pub fn shared_secret_from_tweak(b_scan: &SecretKey, entry: &TweakEntry) -> PublicKey {
+ let b = secret_key_to_scalar(b_scan);
+ entry.tweak.mul_tweak(&EC, &b).expect("ecdh")
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// Section 5 — Confidential output blinding / unblinding
+// ═══════════════════════════════════════════════════════════════════════════════
+//
+// The sender blinds to `BK_k = bk_k·G`. The receiver recomputes `bk_k` and
+// unblinds, recovering plaintext asset + value with no out-of-band exchange.
+
+/// Build a confidential `TxOut` blinded to `BK_k`.
+pub fn build_confidential_sp_txout(
+ out: &SilentPaymentOutput,
+ asset: lwk_wollet::elements::AssetId,
+ value: u64,
+ rng: &mut (impl rand::RngCore + rand::CryptoRng),
+) -> Result<
+ (
+ lwk_wollet::elements::TxOut,
+ lwk_wollet::elements::TxOutSecrets,
+ ),
+ lwk_wollet::elements::secp256k1_zkp::Error,
+> {
+ use lwk_wollet::elements::confidential::{
+ Asset, AssetBlindingFactor, Nonce, Value, ValueBlindingFactor,
+ };
+ use lwk_wollet::elements::secp256k1_zkp::{Generator, PedersenCommitment, RangeProof, Tag};
+ use lwk_wollet::elements::{TxOut, TxOutSecrets, TxOutWitness};
+
+ let script_pubkey = out.script_pubkey();
+
+ let abf = AssetBlindingFactor::new(&mut *rng);
+ let vbf = ValueBlindingFactor::new(&mut *rng);
+
+ // CT nonce derived from BK_k — this is what lets the receiver unblind.
+ let (nonce, ct_shared_secret) = Nonce::new_confidential(&mut *rng, &EC, &out.blinding_pubkey);
+
+ let asset_tag = Tag::from(asset.into_inner().to_byte_array());
+ let asset_gen = Generator::new_blinded(&EC, asset_tag, abf.into_inner());
+ let value_commitment = PedersenCommitment::new(&EC, value, vbf.into_inner(), asset_gen);
+
+ let mut message = [0u8; 64];
+ message[..32].copy_from_slice(&asset.into_inner().to_byte_array());
+ message[32..].copy_from_slice(abf.into_inner().as_ref());
+
+ let rangeproof = RangeProof::new(
+ &EC,
+ 1,
+ value_commitment,
+ value,
+ vbf.into_inner(),
+ &message,
+ script_pubkey.as_bytes(),
+ ct_shared_secret,
+ 0,
+ 52,
+ asset_gen,
+ )?;
+
+ let txout = TxOut {
+ asset: Asset::Confidential(asset_gen),
+ value: Value::Confidential(value_commitment),
+ nonce,
+ script_pubkey,
+ witness: TxOutWitness {
+ surjection_proof: None,
+ rangeproof: Some(Box::new(rangeproof)),
+ },
+ };
+ let secrets = TxOutSecrets {
+ asset,
+ asset_bf: abf,
+ value,
+ value_bf: vbf,
+ };
+
+ Ok((txout, secrets))
+}
+
+/// Unblind a confidential output with `bk_k`, recovering asset + value.
+pub fn unblind_output(
+ txout: &lwk_wollet::elements::TxOut,
+ bk_k: SecretKey,
+) -> Result {
+ txout.unblind(&EC, bk_k)
+}
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// Section 6 — Tests
+// ═══════════════════════════════════════════════════════════════════════════════
+
+#[cfg(test)]
+mod tests {
+ use super::*;
+ use lwk_wollet::elements::hashes::hex::DisplayHex;
+
+ fn sk_byte(b: u8) -> SecretKey {
+ SecretKey::from_slice(&[b; 32]).unwrap()
+ }
+
+ fn outpoint(txid_byte: u8, vout: u32) -> Vec {
+ let mut v = vec![txid_byte; 32];
+ v.extend_from_slice(&vout.to_le_bytes());
+ v
+ }
+
+ /// Test vectors from the ELIP.
+ ///
+ /// b_scan = 0x11×32, b_spend = 0x22×32.
+ /// Two inputs: 0x31×32 @ 0x10…:0, 0x32×32 @ 0x20…:1.
+ #[test]
+ fn test_vectors() {
+ let b_scan = sk_byte(0x11);
+ let b_spend = sk_byte(0x22);
+ let address = SilentPaymentAddress {
+ scan: b_scan.public_key(&EC),
+ spend: b_spend.public_key(&EC),
+ };
+
+ let agg = aggregate_inputs(&[
+ (outpoint(0x10, 0), sk_byte(0x31)),
+ (outpoint(0x20, 1), sk_byte(0x32)),
+ ]);
+
+ assert_eq!(
+ agg.a_pubkey.serialize().to_lower_hex_string(),
+ "031195a8046dcbb8e17034bca630065e7a0982e4e36f6f7e5a8d4554e4846fcd99",
+ "A"
+ );
+ assert_eq!(
+ agg.input_hash.to_be_bytes().to_lower_hex_string(),
+ "d392922c00280a7e8d282182f5026f2fddbc74c1e1de18b4822128b2b77ec641",
+ "input_hash"
+ );
+
+ let expected: [(u32, &str, &str, &str, &str, &str); 2] = [
+ (
+ 0,
+ "02a29d9716417c964ca9e477343e71ffe730a4991a3eaad668eabec84e9feb7931",
+ "0344e1289497e6da66fde710d2f38de053fc07355e405524401d7d609df5a1a8cc",
+ "70ab8897b64bd21b427339ff4d014b883191ef6425862246c53bfc27a59aa3f0",
+ "f03c436d2cd67ae1fecf7d88a38aa3a03c0abea43feaf6da8eb71e2e3a866bda",
+ "5120a29d9716417c964ca9e477343e71ffe730a4991a3eaad668eabec84e9feb7931",
+ ),
+ (
+ 1,
+ "0229d77654023af267dbe9cb7ff1956f947c816f203494381308387168fb010c92",
+ "03efdeda770ccdbe8bf466fba48bfd2b2c436ab0c04658fc6d6c277de5078129fa",
+ "945ba73a9804f62089c7d2ffdc079031031f0aebab372cec17ef9c110ebceb10",
+ "9eff3472230fc83ef5ea8f8c80401c4eecd595a048bd2482a107d3a49baa5a58",
+ "512029d77654023af267dbe9cb7ff1956f947c816f203494381308387168fb010c92",
+ ),
+ ];
+
+ for (k, pk, bk, bk_sk, spk_sk, script) in expected {
+ let sender = sender_derive_output(&address, &agg, k);
+ let (recv, spend_sk) =
+ receiver_derive_output(&b_scan, &b_spend, &agg.a_pubkey, &agg.input_hash, k);
+
+ assert_eq!(sender, recv, "sender/receiver agree at k={k}");
+ assert_eq!(
+ sender.spend_pubkey.serialize().to_lower_hex_string(),
+ pk,
+ "P_k k={k}"
+ );
+ assert_eq!(
+ sender.blinding_pubkey.serialize().to_lower_hex_string(),
+ bk,
+ "BK_k k={k}"
+ );
+ assert_eq!(
+ sender.blinding_seckey.secret_bytes().to_lower_hex_string(),
+ bk_sk,
+ "bk_k k={k}"
+ );
+ assert_eq!(
+ spend_sk.secret_bytes().to_lower_hex_string(),
+ spk_sk,
+ "spend_sk k={k}"
+ );
+ assert_eq!(
+ sender.script_pubkey().as_bytes().to_lower_hex_string(),
+ script,
+ "scriptPubKey k={k}"
+ );
+ }
+
+ assert_eq!(
+ address.encode(ElementsNetwork::Liquid),
+ "lqsp1qqd8n2k7uklxq4aegau7vawtptkgxsja4kt99lpv6krctwpq8tpc65qjxd4lu4etruh9sngx3su9mtqp5fqzxz7re59y5nnez9p03ht3lyudcfhfe",
+ "mainnet address"
+ );
+ }
+
+ /// BIP-352 even-Y normalization for taproot inputs.
+ ///
+ /// `normalize_taproot_input_key` must return a key whose public point has
+ /// even Y, leaving even-Y keys untouched and negating odd-Y ones. We assert
+ /// the invariant directly, and that aggregating an odd-Y key *as taproot*
+ /// changes the aggregate (negation happened) while aggregating it *as
+ /// non-taproot* does not.
+ #[test]
+ fn taproot_even_y_negation() {
+ // Find one even-Y and one odd-Y sample key among simple byte fills.
+ let mut even_key = None;
+ let mut odd_key = None;
+ for b in 1u8..=0xff {
+ let sk = sk_byte(b);
+ match sk.x_only_public_key(&EC).1 {
+ Parity::Even if even_key.is_none() => even_key = Some(sk),
+ Parity::Odd if odd_key.is_none() => odd_key = Some(sk),
+ _ => {}
+ }
+ if even_key.is_some() && odd_key.is_some() {
+ break;
+ }
+ }
+ let even_key = even_key.expect("some even-Y key exists");
+ let odd_key = odd_key.expect("some odd-Y key exists");
+
+ // Invariant: output always has even-Y public key.
+ for sk in [even_key, odd_key] {
+ let norm = normalize_taproot_input_key(sk);
+ assert_eq!(
+ norm.x_only_public_key(&EC).1,
+ Parity::Even,
+ "normalized key must have even-Y public point"
+ );
+ }
+ // Even-Y key is untouched; odd-Y key is negated.
+ assert_eq!(
+ normalize_taproot_input_key(even_key),
+ even_key,
+ "even-Y unchanged"
+ );
+ assert_eq!(
+ normalize_taproot_input_key(odd_key),
+ odd_key.negate(),
+ "odd-Y negated"
+ );
+
+ // Aggregation: treating the odd-Y key as taproot must differ from
+ // treating it as non-taproot (the negation changes `a` and `A`).
+ let op = outpoint(0x10, 0);
+ let as_taproot = aggregate_inputs_with_parity(&[(op.clone(), odd_key, true)]);
+ let as_legacy = aggregate_inputs_with_parity(&[(op.clone(), odd_key, false)]);
+ assert_ne!(
+ as_taproot.a_pubkey.serialize(),
+ as_legacy.a_pubkey.serialize(),
+ "odd-Y taproot input must be negated, changing A"
+ );
+ // The taproot aggregate's A is the even-Y point of the odd-Y key.
+ assert_eq!(
+ as_taproot.a_pubkey.x_only_public_key().0,
+ odd_key.x_only_public_key(&EC).0,
+ "x-only A is unchanged by negation"
+ );
+ assert_eq!(as_taproot.a_pubkey.serialize()[0], 0x02, "A is even-Y");
+
+ // An even-Y taproot input behaves identically to a non-taproot input.
+ let t_even = aggregate_inputs_with_parity(&[(op.clone(), even_key, true)]);
+ let l_even = aggregate_inputs_with_parity(&[(op.clone(), even_key, false)]);
+ assert_eq!(
+ t_even.a_pubkey.serialize(),
+ l_even.a_pubkey.serialize(),
+ "even-Y key: taproot vs non-taproot agree"
+ );
+ }
+
+ /// Tweak server: client's `S = b_scan · T` must equal sender's `S`.
+ #[test]
+ fn tweak_server_agreement() {
+ let b_scan = sk_byte(0x11);
+ let b_spend = sk_byte(0x22);
+ let address = SilentPaymentAddress {
+ scan: b_scan.public_key(&EC),
+ spend: b_spend.public_key(&EC),
+ };
+
+ let agg = aggregate_inputs(&[(outpoint(0xAA, 0), sk_byte(0x55))]);
+ let sender_out = sender_derive_output(&address, &agg, 0);
+
+ // Tweak server publishes T from public keys only.
+ let (tweak, input_hash, a_pubkey) =
+ compute_tweak(&[sk_byte(0x55).public_key(&EC)], &[outpoint(0xAA, 0)]);
+ let client_s = shared_secret_from_tweak(
+ &b_scan,
+ &TweakEntry {
+ txid: [0u8; 32],
+ tweak,
+ a_pubkey,
+ input_hash,
+ },
+ );
+
+ let client_out = derive_output(&b_spend.public_key(&EC), &client_s, 0);
+ assert_eq!(client_out, sender_out, "client output must match sender");
+
+ let sender_s = sender_shared_secret(&address.scan, &agg);
+ assert_eq!(
+ client_s.serialize(),
+ sender_s.serialize(),
+ "shared secrets must match"
+ );
+ }
+
+ /// CT round-trip: sender blinds to BK_k, receiver unblinds with bk_k.
+ #[test]
+ fn ct_round_trip_unblind_with_bk() {
+ use lwk_wollet::elements::AssetId;
+
+ let b_scan = sk_byte(0x11);
+ let b_spend = sk_byte(0x22);
+ let address = SilentPaymentAddress {
+ scan: b_scan.public_key(&EC),
+ spend: b_spend.public_key(&EC),
+ };
+
+ let agg = aggregate_inputs(&[(outpoint(0xAB, 0), sk_byte(0x33))]);
+ let k = 0;
+ let asset = AssetId::from_slice(&[0x42; 32]).unwrap();
+ let value = 123_456u64;
+ let mut rng = rand::thread_rng();
+
+ let sender_out = sender_derive_output(&address, &agg, k);
+ let (txout, secrets) =
+ build_confidential_sp_txout(&sender_out, asset, value, &mut rng).unwrap();
+
+ let (recv_out, _) =
+ receiver_derive_output(&b_scan, &b_spend, &agg.a_pubkey, &agg.input_hash, k);
+ assert_eq!(recv_out.blinding_seckey, sender_out.blinding_seckey);
+
+ let recovered = txout.unblind(&EC, recv_out.blinding_seckey).unwrap();
+ assert_eq!(recovered.asset, asset);
+ assert_eq!(recovered.value, value);
+ assert_eq!(recovered.asset_bf, secrets.asset_bf);
+ assert_eq!(recovered.value_bf, secrets.value_bf);
+
+ // Wrong scan key → unblind fails.
+ let (wrong, _) =
+ receiver_derive_output(&sk_byte(0x99), &b_spend, &agg.a_pubkey, &agg.input_hash, k);
+ assert_ne!(wrong.blinding_seckey, sender_out.blinding_seckey);
+ assert!(txout.unblind(&EC, wrong.blinding_seckey).is_err());
+ }
+
+ /// Address round-trip and network separation.
+ #[test]
+ fn address_round_trip_and_network_separation() {
+ let address = SilentPaymentAddress {
+ scan: sk_byte(0x11).public_key(&EC),
+ spend: sk_byte(0x22).public_key(&EC),
+ };
+ for network in [ElementsNetwork::Liquid, ElementsNetwork::LiquidTestnet] {
+ let enc = address.encode(network);
+ assert_eq!(SilentPaymentAddress::parse(&enc, network).unwrap(), address);
+ }
+ let mainnet = address.encode(ElementsNetwork::Liquid);
+ assert_eq!(
+ SilentPaymentAddress::parse(&mainnet, ElementsNetwork::LiquidTestnet),
+ Err(AddressError::WrongNetwork),
+ );
+ }
+}