BASIC SCHEME The recipient publishes their silent payment address, a single 32 byte public key: X = x*G The sender picks an input containing a public key: I = i*G The sender tweaks the silent payment address with the public key of their input: X' = hash(i*X)*G + X Since i*X == x*I (Diffie-Hellman Key Exchange), the recipient can detect the payment by calculating hash(x*I)*G + X for each input key I in the blockchain and seeing if it matches an output in the corresponding transaction. via

[bitcoin-dev] Silent Payments – Non-interactive private payments with no on-chain overhead - Ruben Somsen