Silent payments
Also called: silent payment address, sp1 address, BIP352, BIP 352, static payment address, reusable payment address.
Silent payments (BIP 352) are reusable static addresses: each payer derives a fresh, unlinkable Taproot output, with no notification transaction.
Silent payments let a receiver publish one static address, such as a donation address, without every payment landing on the same on-chain address. Each sender works out a new, unique Taproot output that only the receiver can find and spend.
How it works
BIP 352, by josibake, Ruben Somsen and Sebastian Falbesoner, uses an elliptic-curve Diffie-Hellman key exchange:
- The receiver publishes an address holding two public keys: a scan key and a spend key.
- The sender adds up the private keys of the inputs it is spending and combines the result with the receiver's scan key to get a shared secret.
- That secret tweaks the receiver's spend key, giving the key of an ordinary-looking P2TR output.
- The receiver scans transactions with its scan private key and the inputs' public keys, computes the same secret and spots the payment.
Addresses use Bech32m with the prefix sp (tsp on test networks). A version 0 mainnet address starts with sp1q and is 116 characters long. Wallets deriving the keys from a seed use m/352'/0'/0'/1'/0 for the scan key and m/352'/0'/0'/0'/0 for the spend key.
Trade-offs
Unlike BIP 47 payment codes, silent payments need no notification transaction, so nothing on chain ties payments to the receiver, and payments from the same sender can't be linked together. The cost is scanning: the receiver must check every eligible transaction, which is easy for a full node but harder for light clients.
Related proposals add sending support to PSBTs (BIP 375) and an sp() output descriptor (BIP 392), and BIP 321 defines an sp= parameter for Bitcoin URIs. Read the silent payments guide.