user3837: I am reading the technical "specification" for stealth addresses, available here. The core idea is described in the following paragraph:

Using Elliptic curve Diffie-Hellman (ECDH) we can generate a shared
  secret that the payee can use to recover their funds. Let the payee
  have keypair Q=dG. The payor generates nonce keypair P=eG and uses
  ECDH to arrive at shared secret c=H(eQ)=H(dP). This secret could be
  used to derive a ECC secret key, and from that a scriptPubKey, however
  that would allow both payor and payee the ability to spend the funds.
  So instead we use BIP32-style derivation to create Q'=(Q+c)G and
  associated scriptPubKey.

I understand everything except the last sentence. As far as I can tell, Q and c are known to the payee and payer so the keypair Q'=(Q+c)G is also known to both. How does Q' allow for only the payee to spend the funds? How does BIP32-style derivation work?

user3837: I believe there is a typo. It should instead read Q'=(d+c)G=Q+cG. The private part d+c is an offset of the payee's private part d, so only known to the payee. The public part is an offset cG, known to both.

user15209: maybe this will help? https://bitcoin.org/en/developer-guide#hierarchical-deterministic-key-creation
or check the various BIP32 implementations (bitcore for example)

3837: <p>I am reading the technical "specification" for stealth addresses, available <a href="http://sourceforge.net/p/bitcoin/mailman/message/31813471/" rel="noreferrer">here</a>. The core idea is described in the following paragraph:</p>

<blockquote>
  <p>Using Elliptic curve Diffie-Hellman (ECDH) we can generate a shared
  secret that the payee can use to recover their funds. Let the payee
  have keypair Q=dG. The payor generates nonce keypair P=eG and uses
  ECDH to arrive at shared secret c=H(eQ)=H(dP). This secret could be
  used to derive a ECC secret key, and from that a scriptPubKey, however
  that would allow both payor and payee the ability to spend the funds.
  So instead we use BIP32-style derivation to create Q'=(Q+c)G and
  associated scriptPubKey.</p>
</blockquote>

<p>I understand everything except the last sentence. As far as I can tell, <code>Q</code> and <code>c</code> are known to the payee and payer so the keypair <code>Q'=(Q+c)G</code> is also known to both. How does <code>Q'</code> allow for only the payee to spend the funds? How does BIP32-style derivation work?</p>
 3837: <p>I believe there is a typo. It should instead read <code>Q'=(d+c)G=Q+cG</code>. The private part <code>d+c</code> is an offset of the payee's private part <code>d</code>, so only known to the payee. The public part is an offset <code>cG</code>, known to both.</p>
 15209: <p>maybe this will help? <a href="https://bitcoin.org/en/developer-guide#hierarchical-deterministic-key-creation" rel="nofollow">https://bitcoin.org/en/developer-guide#hierarchical-deterministic-key-creation</a></p>

<p>or check the various BIP32 implementations (bitcore for example)</p>
