What is a stealth address?

Question

Canonical question on stealth addresses: They are mentioned in the context of privacy of Bitcoin transactions but are also implemented in Cryptonote based currencies. What are they and how would they work? Can they provide 100% anonymity?

Answer 1

This is a complex topic that loses many in forest of cryptographic trees, but the following highlights important points required to understand and follow stealth address concepts.

Stealth address technology originated from Cryptonote technology, but Bitcoin (e.g. libbitcoin) and its altcoins can also implement stealth addresses. For Bitcoin and its altcoins, stealth addresses must be explicitly supported by the sender's and recipient's wallets, but such support is implicit to Cryptonote wallets.

For Bitcoin, stealth addresses are a bit longer than normal Bitcoin addresses, e.g., vJmsp9MxWMj6jiUg8Rejh23pqRCthWQhwtUKvmLw2kcE83AHer1MchTN4DVacHt43r8hSKBQpjPuqYDKuKgyVBkGkUdcsNAdnk2aZW. However, the transactions associated with a stealth transaction looks no different than normal transactions on the Bitcoin Blockchain. Stealth addresses contain one public view (in Cryptonote vernacular) or scan (in Bitcoin vernacular) key, and one or more spend public keys. These keys are always encoded in a stealth address to support a the 1st portion of Diffie-Helman-Merkle Key Exchange. (Bitcoin's public/private key pairs are derived from the secp256k1 elliptic curve, while Cryptonote uses Ed25519 derived public/private key pairs.)

One can publish their stealth address on a business card, and sustain their privacy when funds are sent to a dynamically computed destination address by the sender of funds. Stealth addresses essentially put the onus of dynamic address calculation, typically associated with a recipient's hierarchical deterministic (HD) wallet, on the sender's wallet. One stealth address is functionally akin to an HD wallet account, and can thus be used over and over for many fund transfers. Stealth addresses provide confidentiality for the recipient of transaction pairs that utilize information from a stealth address.

Stealth addresses innately perform the 1st half of a Diffie-Helman-Merkle Key Exchange when a sender of funds receives a stealth address. With Bitcoin, two blockchain transactions are required to complete the sending of funds to a stealth address that will belong to the recipient of funds.

Since it is operationally improbable a sender's and recipient's wallets will communicate directly to each other, the 1st transaction is a persistent OP_RETURN transaction that is used to complete the 2nd half of a Diffie-Helman-Merkle Key Exchange. The second transaction is the actual sending of funds to a dynamically calculated destination address that is strongly based upon an ephemeral random number generator in the sender's wallet. The second half of the Diffie-Helman-Merkle key exchange, the OP_RETURN, allows a recipient's wallet of a stealth transaction to dynamically calculate the private redemption key associated with a particular transaction to redeem the funds at a later date.

Stealth addresses can be extended to support multisig. This is a multisig capability that is more inherent to Bitcoin than Cryptonote. Here is were details for calculating Monero stealth addresses can be found.

Ignoring middleman snooping on IP addresses associated with stealth address transaction pairs, only the two core parties involved in a transaction pair will know any identity details associated with sending funds to a stealth address. Hence, the need for Kovri I2P technology. Hence, stealth transactions by themselves don't provide 100% anonymity protection. Also Confidential Transactions (CT) technology is needed by Bitcoin to mask details about the amount transferred by a transaction.

Answer 2

Stealth addresses take care of the receiver's privacy, not the sender's.

In cryptocurrency, the ability to spend a certain amount of coins is the same as the knowledge of the private key to the public key associated with the coins.

So (simplifying a bit), in Bitcoin if there is 1 bitcoin associated to the public key P and if Bob knows the corresponding private key x such that P = xG, then he can spend the Bitcoin by submitting a message (transaction) to the network signed with x.

There is one privacy issue, though: if Bob keeps using the same P to receive bitcoins, then any observer will be able to see all payments were made to the same entity that controls P (Bob). This is the problem that stealth addresses solve.

In the context of stealth addresses, addresses are now composed of two public keys, and the coins sent to Bob will not be sent to his stealth address on the blockchain, rather the stealth address will be used by the sender to produce fresh new bitcoin addresses for every new transaction. These new addresses, even though generated by the sender (Alice) and unknown to Bob until the transaction is made, will nonetheless be controlled by Bob! Here is how it works:

Bob creates two pairs of private and public keys. Let's denote them by (a,A) and (b,B), where by definition A = aG and B = bG. Bob makes the pair of public keys (A,B) available to the network; this will be his stealth address.

Alice wishes to send 1 bitcoin to Bob; that is, she wants to assign 1 bitcoin to a public key P such that Bob knows x and P = xG. She will construct such P using Bob's stealth address by using a hashing function H, choosing a random big number r, and setting P = H(rA)G + B. Then Alice sends the bitcoin to P, the transaction is broadcast along with R = rG (but not r, which can't be recovered from R).

Now how does Bob get the money? Well he has to keep listening on the network for all new transactions in the hopes that they are for him. When he sees Alice's transaction, he performs x := H(aR)+b and realizes that:

xG = (H(aR)+b)G = H(aR)G+bG = H(arG)G+B = H(raG)G+B = H(rA)G+B = P,

that is, Bob can reconstruct x such that P = xG and is therefore the owner of the bitcoin! Notice that neither Alice nor any observer has the ability to derive x (because they don't know a and b), and that besides Alice and Bob no one knows that (x,P) was generated from Bob's stealth address (because they don't know r).

Note that, as mentioned, this protects Bob privacy, but it is still visible to the network that Alice, the entity that used to control that bitcoin, made a transaction. In order to obfuscate that action, Monero implements the use of Ring Signatures, which will allow Alice to, instead of directly signing the transaction, produce a proof that her, or several other people, did send a coin to Bob. The math behind Ring Signatures is not as simple as in Stealth Addresses, but it is still very approachable.

So, in a nutshell:

Stealth addresses take care of recipient's privacy.

Ring Signatures take care of sender's privacy.

Answer 3

For more details about how stealth addresses are generated take a look at my explanation video or git repo