Support for sending to silent payments

[benthecarman]

bitcoin/bips#1458

Supporting receiving for silent payments would be a very large undertaking. However, supporting sending should be relatively pretty trivial.

Tracking issues for SP sending support:

Single party payments:

All inputs are signed by the same entity (MuSig considered here)

Upstream

• Add "silentpayments" module implementing BIP352 (take 4, limited to full-node scanning) bitcoin-core/secp256k1#1765
• Add BIP 352 bindings (full node scanning only) rust-bitcoin/rust-secp256k1#876
• Add support for PSBTv2 rust-bitcoin/rust-bitcoin#3507 ¹²: Unplanned because rust-psbt will replace bitcoin::psbt
• Silent payments addresses (BIP352) rust-bitcoin/rust-bitcoin#2778

Local

• bdk_wallet coin select for SP inputs, single key types (p2wpkh, p2pkh)
• bdk_wallet coin select for SP inputs, always uses key path spend for TR SP inputs (p2tr key path spend)

Multi party payments and hardware signers:

The inputs should be signed by different entities (e.g. CoinJoin)

Upstream

• Add DLEQ proof implementing BIP 374 bitcoin-core/secp256k1#1802 ³⁴⁵
• rust-secp256k1 with DLEQ module (rust-dleq is a candidate to fill this gap). ⁶
• Add BIP375 fields rust-bitcoin/rust-psbt#45

Local

• bdk workspace and dependencies upgrade to DLEQ support

Extras:

• RBF support: The removal of any input used to compute a silent payment output, or the addition of any new input included in the BIP 352: Inputs for Shared Secret Derivation requires the re-computation of the silent payment output.
• TRUC Transactions: Allow wallets without eligible outputs to create silent payment transactions to create a zero fee transaction with a key path spend taproot transaction to create a silent payment output using the first transaction output as input.
• rust-libsecp256k1 with MuSig2 and FROST support
• rust-miniscript with MuSig2 and FROST support
• bdk_wallet coin select for SP inputs, aggregate key types (MuSig2, FROST)

Footnotes

1. PSBT SP Spec Delving Bitcoin Post ↩

2. BIP 375 Draft ↩

3. BIP 374 Draft ↩

4. BlockStream/secp256k1-zkp implementation ↩

5. BlockStream/secp256k1-zkp implementation exposed for BitBox ↩

6. NUT12 DLEQ cashubtc/cdk#65 (Cashu Development Kit DLEQ Implementation in Rust) ↩

[LLFourn]

Although sending has less moving parts I'm less sure what's the right API inside transaction building system (mostly because we haven't re-designed transaction building yet). With receiving I know precisely how to approach it (as a new tx graph index) so I'd be tempted to do receiving first and leave sending until later. Of course the basic function to produce a silent payment tx would be needed at the same time as the receiving code which would allow you to manually construct a silent payment tx. We could consider upstreaming this to rust-bitcoin also.

This would go all go in bdk_chain with bdk_tx_build proving more user friendly API coming later (when it exists).

[realeinherjar]

This BIP is recent and still with a lot of comments addressing implementation details, e.g. bitcoin/bips#1458 (comment).

[evanlinjin]

This BIP is recent and still with a lot of comments addressing implementation details, e.g. bitcoin/bips#1458 (comment).

I think Steven was mostly addressing HOW the BIP should be structured, not WHAT was specified in the BIP.

[LLFourn]

While implementing it we might be able to contribute to the BIP if we find places it could be improved.

[notmandatory]

I assigned this to the 1.1 alpha release, but we may need to move it to 2.0 depending on priorities and who's available/able to work on this.

[sethforprivacy]

Traction behind Silent Payments is rapidly growing, with two wallets releasing with full Silent Payments support this week. The most important step for their traction to continue is that wallets simply add the ability to send to Silent Payment addresses (as this PR is for) so that there is proper incentive for receiving to be added to wallets, exchanges, etc.

I started a bounty for this PR to be completed on X, and am offering 100k sats to the dev who's PR solves this issue (total bounty of 870k sats thanks to others on X).

Would be amazing for all BDK wallets to be able to trivially enable sending to Silent Payment addresses!

[sethforprivacy]

Note that a crate for Silent Payment support already exists here:

https://github.com/cygnet3/rust-silentpayments

[storopoli]

The parsing of a SP address is being discussed upstream here rust-bitcoin/rust-bitcoin#2778

[junderw]

I think this should wait for

1. Add BIP352 silentpayments module bitcoin-core/secp256k1#1519
2. merging 1 into the secp256k1 wrapper crate.

rust-silentpayments crate is a great prototype, but it is weak to timing attacks.