In principle it's clear from the CN whitepaper:
Bob checks every passing transaction with his private key (a,b), and computes P' = Hs(aR)G + B. If Alice's transaction for with Bob as the recipient was among them, then aR = arG = rA and P' = P.
What I'm interested in is the particular implementation in the current software. How I see it, there could be 2 options:
- For each TX, the wallet fetches
Psfrom the daemon, and computes
P'. The wallet tests
P' == P.
- For each TX, the wallet fetches only the
Rfrom the daemon, computes
P'and sends it to the daemon. The daemon tests
P' == Pand if matching, returns the matching outputs to the wallet.
Which way is currently used? Option 1. is safer but option 2. looks like it would significantly reduce the amount of data that needs to be transferred between the wallet and daemon. Could 2. be implemented for light wallets connecting to a trusted daemon, if not already?
Edit: adding some clarification for reference