When the recipient provides a silent payment address to the sender, does the sender actually combine some keys and will this key result in a public address of the recipient's wallet that only he (the recipient) knows?
Yes.
As shown above, the sender uses the key pair of one of his inputs (r for private key, R for public key). He then creates another key pair, hash(r*A) as private key and hash(r*A)*G as the public key. Then, he adds hash(r*A)*G to public key B, which is the key the recipient uses to spend the bitcoin.
The resulting public key is hash(r*A)*G + B. The private key of this public key is hash(r*A) + b, which is unknown for the sender (as he does not know b), but known by the recipient, because r*A = r*a*G = r*G*a = a*R. The recipient knows a, R, b. Therefore, they can spend from the receiving address.
Is there a discussion about Silent Payments going around on the Forum? I just found out about it, am very curious to learn more but I do not think I understand how it works yet.
Which part is more difficult to understand?
