josie

> > I don't think we should get a failure by doing additions and multiplications (summing priv keys, pub keys, ecdh) > > One reason EC operations can fail is...

@vostrnad > One reason EC operations can fail is when a pseudorandom scalar value exceeds the curve order, which should only happen with negligible probability but other BIPs still have...

> we are already using existing valid private keys @vostrnad Actually, what I said above is not true and your point stands. When we do _tn = hash(ecdh_shared_secret || n)_...

I've added a reference Python implementation along with test vectors for sending and receiving. I'll be updating the "Appendix B: Test Vectors" section shortly.

There was a suggestion to use [BIP21](https://github.com/bitcoin/bips/blob/master/bip-0021.mediawiki) for silent payments instead of introducing a new address format, the reasoning being introducing yet another address format is a burden on wallet...

@Sosthene00 @cygnet3 Thanks for the suggestions! I think just sorting the labeled spend pub keys is likely the best solution. For sorting, we can just lexicographically sort the compressed format...

Thanks for the review @naumenkogs ! > most of my comments are addressed and can be closed I went through the open comments and resolved most of them. Let me...

Thanks again to everyone for the thorough review! I've tried to address all the unaddressed comments, but please let me know if I've missed anything. Major changes: * Hashing has...

> One overall comment is that the real world applicability of this is currently going to be limited to single signature taproot wallets, which is understandable, but also disappointing. This...

Updated `reference.py` and labels format in test vectors