Silent Payments for Multiparty Wallets

The proposed protocol outlines a method for secure multiparty signing, which integrates with Bitcoin Improvement Proposals (BIPs) focusing on cryptographic security and efficiency. This protocol is particularly concerned with facilitating Silent Payments using multiparty wallet keys, where the computational foundation relies on elliptic curve cryptography, specifically within the secp256k1 framework.

In the construction of wallet keys for multiparty usage, each key is represented as a linear combination of individual signer's secret contributions. These contributions can vary based on the protocol used—FROST, MuSig2, Nested MuSig2, or BLISK—each dictating the coefficients and secret keys involved in the aggregation. Key modifications, or tweaks, are also accounted for, adhering to BIP specifications that dictate parity and tweak accumulations.

A significant aspect of this protocol is the Weighted Elliptic Curve Diffie-Hellman (ECDH) approach which allows each signer to compute an ECDH share. These shares are then summed and adjusted by an input hash to produce a shared secret, from which payment outputs are calculated. This process ensures that even though the inputs may be handled separately, their contributions are securely aggregated into one coherent transaction output.

The protocol employs a Discrete Logarithm Equality (DLEQ) proof mechanism, termed AggDLEQ, to verify that the computed public key and the corresponding ECDH share derive from the same private key without revealing the private key itself. The AggDLEQ system is crucial for ensuring that each signer's contribution is valid, thereby preventing any single malformed input from jeopardizing the integrity of the transaction output.

To coordinate the signers and handle the computations, a two-round protocol is utilized. Initially, the coordinator distributes the transaction context to all signers, who then generate and send back their respective contributions along with nonce values. In the second round, after aggregating these contributions, the final signatures are computed and checked for correctness before being finalized in the transaction.

This protocol not only ensures the security of multiparty transactions through its robust cryptographic practices but also maintains compatibility with existing BIPs. It operates seamlessly with the unchanged verifier protocols of BIP-374 and BIP-375, and it does not require additional fields in the Partially Signed Bitcoin Transactions (PSBT) format, hence maintaining efficiency and interoperability within the Bitcoin ecosystem.

The security claims of the protocol, while promising, are contingent upon ongoing internal reviews and further cryptographic analysis, particularly concerning the assumptions underpinning the hardness of related computational problems. Future publications and peer reviews will likely provide more concrete assurances and potential improvements to this protocol.