This discussion took place at Pizza Day Prague 2022 after a brief discussion on Silent Payments. The main points have been summarized below.
The discussion was mainly between Alekos Filini, Martin Habovštiak, and Ruben Somsen, as well as Daniela Brozzoni, Eric Sirion, Pavol Rusnak, Salvatore Ingala, and others.
This was also posted to the the bitcoin-dev mailing list.
BIP47 requires a notification transaction prior to making payments. This transaction takes up on-chain space and can easily leak privacy if not handled with extreme caution. In practice this is quite hard.
The discussion revolved around whether we can a.) minimize the on-chain space required and b.) outsource the notification transaction so the link between the sender and recipient is no longer apparent on-chain.
As currently implemented, BIP47 (V1/V2) requires an input key for blinding, the blinded sender payment code in an op_return, and the recipient key in an output.
The first question that came up was whether it is necessary for the recipient to learn the payment code of the sender. The benefit is that this enables the recipient to send a notification transaction and subsequent payment to the sender, but in practice this never happens. It therefore seems acceptable to forego this requirement, as this potentially saves space. The minimum notification payload that seems required is a fresh sender key and a static recipient key.
The sender key should ideally be deterministically derived from the sender xpub based on the recipient key. If the user checks all the keys that were registered with the recipient prior to notification, it can statelessly find out whether the sender key was already previously registered. This step can be skipped, which is easier for light clients, but means the notification transaction will have to be resent if the user ever forgets they already sent a notification (such as when restoring from backup).
The next part of the discussion revolved around the idea of putting multiple notifications in a single transaction that can be outsourced to a third party in order to break the sender/recipient link. This third party could be paid over the Lightning Network for their services.
One idea was to use the taproot annex to insert the notification payload as (discounted) witness data. One downside with this approach is that it requires custom software for the recipient to notice the notification, since it's not tied to an easily noticeable output. The middle ground solution would be to put the sender keys there but still create an output for each recipient key.
One interesting point that came up was that you could represent the recipient key using e.g. only 4 bytes (provided you put it in the annex). This leaves a window of 1 in ~4.3 billion for a collision, but the extra work that needs to be performed when it does happen is negligible (essentially expecting a payment while there is none). This would reduce the payload from 64 bytes to 36 bytes of witness data.
While this did not come up in the discussion, it should be noted that using the annex makes the transaction non-standard. It could either be standardized as the first use case for the annex, or perhaps an alternative method should be considered.
BIP351 essentially implements the improvements over BIP47 from the Prague write-up with one change that is more reminiscent of Silent Payments (BIP352) - it encrypts the on-chain payment code. The consequences of this are two-fold.
On the positive side this allows the sender to create an on-chain notification without needing to worry about possibly linking the sender and recipient. In BIP47 the sender had to take care never to use funds intended for paying to make a notification in order to ensure there is no link. In the Prague write-up the notification is outsourced, ensuring the link is broken as long as the entity you outsourced it to didn't learn or divulge your information.
On the negative side this means notifications are no longer directly identifiable by the recipient. Recipients are required to receive all notifications in order to personally decrypt them. This is reminiscent to scanning in Silent Payments, except instead of scanning each transaction, you scan each notification (a lot less data).
Both the up and downside are significant. Whether this is an improvement over the original Prague write-up is debatable, but it's clearly a different set of tradeoffs.
Compared to Silent Payments senders are still required to make a notification transaction (big sender-side UX hassle and costly when on-chain fees are high), and repeat payments from the same sender are linkable by the recipient. Both have a scanning requirement, but for BIP351 it's significantly lighter.