How come the regular transaction pubkey is not sufficient for subaddresses? Why do we add extra pubkeys to tx extra?
1 Answer
A normal (no subaddresses involved) tx public key R is calculated as rG, but when a tx includes a destination output to a subaddress, it needs to attach a tx public key calculated as sDi, (Di being the receivers subaddress public spend key), which is unique to the receiving subaddress.
The rationale (and other info) is explained in MRL-0006: "The use of separate transaction keys for each output allows Alice to include multiple outputs directed to subaddresses." (and of course so the wallet can relate outputs to specific subaddresses).
It should be noted, additional tx pub keys are not added if there's only one destination (that's a subaddress) [ref], in which case it just sets a single tx public key as sDi.
