Silent Payments for Multiparty Wallets

The notation in the formulas for $C$, $R_1$, $R_2$, and $s$ required correction to maintain consistency with established standards like BIP-327 and BIP-445. Specifically, the coefficient $c_i$ should be adjusted to $\hat c_i = g \cdot c_i$, reflecting the convention of applying accumulated parity to each signer's secret. This adjustment ensures that the equation $s = r + e \cdot a$ holds, where $a$ is defined as $\sum_{i \in T} \hat c_i k_i + \tau$.

If the generator $g$ takes the value $-1$, the original equations inadvertently prove knowledge of an incorrect discrete logarithm. The calculations then yield $C = [x + \tau]B$, which is interpreted as a share of $X + [\tau]G$ rather than the intended $A$. This discrepancy causes the proof to fail verification according to BIP-374 when checked against $A$. As a result, the session properly aborts instead of erroneously accepting an invalid share.

Despite these changes, the responses $z_i$ and the per-signer verification checks remain unaffected because they are computed using $K_i$. This retention further safeguards the protocol's correctness. An update to the corresponding documentation will ensure clarity and alignment with this corrected approach.