Let's start by first defining a couple of things. Outputs created in a coinbase transaction can later be spent by using them as inputs to a subsequent transaction. A transaction also has a public key, which is used as the public part of a secret (it's shared, it's in the tx which is on the blockchain).
When constructing a coinbase (miner) transaction, the generated coins are placed as outputs of the transaction. These outputs are only spendable by the miner - they are constructed in such a way that only the miner can spend them (you would need the miners private spend key).
crypto::generate_key_derivation(miner_address.m_view_public_key, txkey.sec, derivation);
A (the miners public view key) and
r (the tx private key), the output of the function
generate_key_derivation (which is placed in
So key derivation is 8*(PvK txsk), right?
crypto::derive_public_key(derivation, no, miner_address.m_spend_public_key, out_eph_public_key);
This is placing
H(8rA||i)G + B in
out_eph_public_key. This is an output key that becomes spendable by the miner. There can be more than one output key (hence this is in a loop and is indexed by
H(8rA||i)G + B).
Then derive_public_key is H(8*(PvK txsk) || output_i)G + PsK?
Do all my assumptions make sense? And is the output of generate_key_derivation a plain public key?
generate_key_derivation is creating
8rA (a point), which is then used by
derive_public_key to create an output key (or in Monero parlance, a stealth address).
And is the shared secret key the output of hash_to_scalar?
hash_to_scalar just takes a hash and converts it to a scalar. The public part of the shared secret is the tx public key, created earlier in
keypair txkey = keypair::generate(hw::get_device("default"));
This is creating
R (in txkey). The shared part is
R which is included in the tx as the tx public key (stuffed into the tx field
add_tx_pub_key_to_extra). Only someone with
a can derive the shared secret
rA (as used in the calculations above). The recipient uses
aR in their side of the calculations when scanning transactions, to know the transaction is destined for them.
r is not stored in the transaction, it is used for the sender-side of the shared secret (
Hope this helps!