Orchard diversifier derivation
- As with Sapling, we define a mechanism for deterministically deriving a sequence of diversifiers, without leaking how many diversified addresses have already been generated for an account. Given an Orchard extended spending key
+
As with Sapling, we define a mechanism for deterministically deriving a sequence of diversifiers, without leaking how many diversified addresses have already been generated for an account. Unlike Sapling, we do so by deriving a diversifier key directly from the full viewing key, instead of as part of the extended spending key. This means that the full viewing key provides the capability to determine the position of a diversifier within the sequence, which matches the capabilities of a Sapling extended full viewing key but simplifies the key structure.
+ Given an Orchard extended spending key
\((\mathsf{sk}_i, \mathsf{c}_i)\)
:
diff --git a/zip-0032.rst b/zip-0032.rst
index c803ea3e..320539f4 100644
--- a/zip-0032.rst
+++ b/zip-0032.rst
@@ -357,8 +357,13 @@ Orchard diversifier derivation
------------------------------
As with Sapling, we define a mechanism for deterministically deriving a sequence of diversifiers, without
-leaking how many diversified addresses have already been generated for an account. Given an Orchard extended
-spending key :math:`(\mathsf{sk}_i, \mathsf{c}_i)`:
+leaking how many diversified addresses have already been generated for an account. Unlike Sapling, we do so
+by deriving a diversifier key directly from the full viewing key, instead of as part of the extended spending
+key. This means that the full viewing key provides the capability to determine the position of a diversifier
+within the sequence, which matches the capabilities of a Sapling extended full viewing key but simplifies the
+key structure.
+
+Given an Orchard extended spending key :math:`(\mathsf{sk}_i, \mathsf{c}_i)`:
- Let :math:`\mathsf{fvk}_i` be the raw encoding of the Orchard full viewing key for :math:`\mathsf{sk}_i`
(as specified in TODO).