12:02:32 <i_a> luigi1111w: I described the process here https://pastebin.com/LwzqfGCq, did you look at it?
12:04:01 <i_a> I checked my code with mininero implementation and it looks like I have everything working, except the last mutiplication with output's privkey. Then I am doing some thing wrong with chosing the right coordinate.
12:14:59 <i_a> I calculate H_p(P), the result is stored into extended coordinate form. Then I pack it with https://github.com/trezor/trezor-firmware/blob/master/crypto/ed25519-donna/ed25519-donna-impl-base.c#L183 and the result looks all good (checked with mininero)
12:16:14 <i_a> And then finally I recover this into a point and do a scalar multiply with a output's private key, I got two coordinates, x and y.
12:17:42 <i_a> I check the even/odd of x-coordinate and based on this I update y-coordinate. Thats how I pack the resulting coordinates.
14:22:37 <luigi1111> do you not pack x*G into P?
14:35:22 <i_a> Yes I pack it. I check x-coordinate, if LSb is 1, then I flip y-coordinates' MSb to 1.
14:41:07 <i_a> Sorry maybe i am missing the point, packing is the same thing as compressing..?
17:33:28 <luigi1111> my point is they are the same thing. if P works then I should as well
18:06:40 <i_a> I think that the problem appears when I am recovering a packed result of H_p(P) into coordinates to do a final x*H_p(P). Otherwise I am lost.
18:41:22 <luigi1111> hmm I see. I don't really understand why that function is negative. I remember something similar in a js lib I used
20:21:53 <Isthmus> Is the dummy encrypted payment ID enforced in the protocol or just added to the core wallet?
20:22:26 <selsta> AFAIK core wallet
20:58:02 <luigi1111> I think extra is still wide open at this point