Source: https://arxiv.org/pdf/1909.06535

Note Structure Overview:

• Address Public Key (apk): An elliptic curve public key used to receive payments.
• Address Secret Key (ask): A private key used to spend notes and generate nullifiers.
• Random Nonce (ρ): A random scalar for generating unique nullifiers.
• Value (v): Represents the value of the note.
• Asset Type (color): Specifies the type of asset.
• Commitment (cm): A cryptographic commitment to the note’s details, generated using zero-knowledge-friendly schemes like Pedersen commitments: $cm=Commit(apk,v,ρ)$

Encryption Process (Note Creation):

When creating a note, the sender encrypts the note details using the ECIES so only the intended recipient can decrypt it.

Key Agreement and Encryption of the Note:

The protocol uses an ephemeral key generated by the sender for secure encryption:

1. Ephemeral Key Generation:
   • The sender generates an ephemeral private key (esk) from the elliptic curve field, which will be used for this specific transaction.
   • The corresponding ephemeral public key (epk) is derived as: $epk = esk \cdot G$
   • The sender then shares epk with the receiver in the transaction.
2. Shared Secret Calculation:

   • The sender uses their ephemeral private key (esk) and the recipient’s public key (pk_enc) to compute a shared secret ss: $kk = esk \cdot pk_{enc}$

     $ss=KDF(kk)$

   • This shared secret ss will serve as the symmetric encryption key for the note details.

3. Encrypting the Note:
   • The note details (e.g., v, color, ρ, cm) are encrypted using ss as the encryption key, generating a ciphertext C: $C = \text{Encrypt}_{ss}(\text{note\_details})$

Including the Encrypted Note in a Transaction:

The transaction includes:

• The encrypted note C.
• The commitment cm, allowing network verifiers to confirm note validity without decrypting its content.
• The ephemeral public key (epk), enabling the recipient to calculate the shared secret for decryption.