I'm trying to create Bob's first receive (ephemeral) address according to the BIP 47 spec after the Notification Transaction has taken place, which I believe to be:
according to these test vectors. I have been unable to calculate the correct ephemeral public key (B') corresponding to this address via:
B' = B + sG
or the correct private key (b') for the ephemeral address via:
b' = b + s
The variables I have come up with so far for this first address include:
// Alice selects the 0th private key derived from her payment code: a = 8d6a8ecd8ee5e0042ad0cb56e3a971c760b5145c3917a8e7beaf0ed92d7a520c // Alice selects the next unused public key derived from Bob's payment code, // starting from zero: B = 024ce8e3b04ea205ff49f529950616c3db615b1e37753858cc60c1ce64d17e2ad8 // Alice calculates a secret point: S = 03f5bb84706ee366052471e6139e6a9a969d586e5fe6471a9b96c3d8caefe86fef // Alice calculates a scalar shared secret using the x value of S: // x value = f5bb84706ee366052471e6139e6a9a969d586e5fe6471a9b96c3d8caefe86fef // SHA256(x value) s = d24366e662da47c0cccca4cc2d2d817af54e4d21039c0cc4fc441624efe273f7 // s multiplied by generator point sG = 0283850c6835576554261fbab5845a099638859528b2725455e6a48e7566415c02 // Alice uses the scalar shared secret to calculate the ephemeral public key // used to generate the P2PKH address for this transaction: B' = 0344b4795e48df097bd87e6cf87a70e4f0c30b2d847b6e34cddde64af10296952d // Bob's first private key b = 04448fd1be0c9c13a5ca0b530e464b619dc091b299b98c5cab9978b32b4a1b8b b' = d687f6b820e6e3d47296b01f3b73ccdc930eded39d559921a7dd8ed81b2c8f82
Are any of these variables incorrect, and if so, how are the correct ones obtained?