## 3 Proposed Method
### Process Design
#### 3.4.2 The Construction Phase of the Output Note  
Suppose the transaction sender [PERSON]'s note list is \(note_{\text{b}}=[note_{1},\;note_{2},\;note_{3}]\), where \(note_{1}=\langle T_{1},\,v_{1}=5,\,R_{1}\rangle\), \(note_{2}=\langle T_{2},\,v_{2}=6,\,R_{2}\rangle\), \(note_{3}=\langle T_{3},\,v_{3}=2,\,R_{3}\rangle\), and the amount of the transaction is \(v=9\). The interaction flow of each participant is shown in Figure 3, and the detailed process is described below.  
Figure 3: BTPP timing diagram.  
The transaction sender [PERSON] finds the notes that meet the transfer criteria  
If [PERSON]'s note list happens to have note with \(v=9\), then the number of input and output notes is 1 each; otherwise, [PERSON] needs to make a combined payment. This process corresponds to step 1 in Figure 2. The process is as follows:  
1. [PERSON] finds one or more of notes that have not yet been spent, i.e., \(note_{1}\), \(note_{2}\) and \(note_{3}\);
2. [PERSON] decrypts the notes by the private key \(sk_{\text{b}}\) to obtain the values and other information;
3. [PERSON] finds the notes that matche the transfer amount \(v\) as the input notes for this transaction, i.e., \(note_{\text{in}}=[note_{1},\;note_{2}]\), satisfying \(v_{\text{in}}=v_{1}+v_{2}\geq v\), and the whole process is shown as Equation (3): \[NoteSRCH(v,note_{\text{b}})\to note_{\text{in}}\] (3)
2. The transaction sender [PERSON] constructs the output note  
This process corresponds to step 2 in Figure 2. When the total value \(v_{\text{in}}\) of the input notes \(note_{\text{in}}\) exceeds the amount \(v\), [PERSON] needs to generate payment note \(note_{4}\) and change note \(note_{5}\) with values \(v_{4}=9\) and \(v_{5}=v_{\text{in}}-v_{4}=2\), respectively, with the following construction process:  
1. [PERSON] obtains the scan public key \(S_{\text{a}}\) and the spend public key \(B_{\text{a}}\) of [PERSON];
2. [PERSON] chooses a random integer \(k_{1}\), i.e., \(0<k_{1}{<}p-1\), and computes and sends the public key \(Pub_{\text{b}}\): \[pub_{\text{b}}=a^{k_{1}}\bmod p\] (4)
3. [PERSON] chooses a random integer \(k_{2}\), i.e., \(0<k_{2}{<}p-1\), and computes and sends the public key \(pub_{a}\): \[pub_{\text{a}}=a^{k_{2}}\bmod p\] (5)
4. [PERSON] receives the public key \(pub_{a}\) calculated by [PERSON] and uses the private key \(k_{1}\) to calculate the shared key \(K_{1}\): \[K_{1}=pub_{a}^{k_{1}}\bmod p\] (6)
5. [PERSON] receives the public key \(pub_{b}\) computed by [PERSON] and uses the private key \(k_{2}\) to compute the shared key \(K_{2}\): \[K_{2}=pub_{b}^{k_{2}}\bmod p\] (7)
6. Both sides of the transaction have the same shared key, i.e., \(K_{1}=K_{2}\), only both sides of the transaction know the shared key, and both sides use the shared key to compute the randomness seed: \[seed=Hash(k_{1})=Hash(k_{2})\] (8) where \(Hash(\cdot)\) is the secure hash function.
7. [PERSON] calculates the temporary public-private key pair \((r_{4},R_{4})\) for the payment note \(note_{4}\) transaction based on \(seed\): \[Random(seed)\to r_{4}\] (9) \[R_{4}=r_{4}{\cdot}G\] (10)
8. [PERSON] randomly selects the random number \(r_{5}\) of the change note \(note_{5}\) transaction to generate the public-private key pair \((r_{5},R_{5})\);
9. [PERSON] computes the shared keys \(c_{4}=H(r_{4}{\cdot}S_{\text{a}})\), \(c_{5}=H(r_{5}{\cdot}S_{\text{b}})\) for notes \(note_{4}\) and \(note_{5}\), respectively;
10. [PERSON] calculates the stealth addresses \(T_{4}=c_{4}{\cdot}G+B_{\text{a}}\) and \(T_{5}=c_{5}{\cdot}G+B_{\text{b}}\) of \(note_{4}\) and \(note_{5}\), respectively, and the corresponding receiver [PERSON] is also able to calculate the same shared key \(c_{4}\) of the payment note \(note_{4}\) based on the randomness seed \(seed\)thus calculating the corresponding stealth address \(T_{4}\). The whole process is shown in Equation (11):  
\[\begin{array}{rcl}NoteCreate(v_{4},r_{4},S_{\text{a}},B_{\text{a}})&\to&note_{4} \\ NoteCreate(v_{5},r_{5},S_{\text{b}},B_{\text{b}})&\to&note_{5}\end{array} \tag{11}\]