How input pseudo-commitments are calculated?

Question

I was reading Zero to Monero and other posts about this and I understand why do we need pseudo-commitment: they are just commitments of inputs' hidden amounts.

The thing that I don't get is how the blinding factor for the pseudo-commitment calculation is obtained. I mean, it couldn't be totally random because it has to maintain certain relationship with the real Pederson Commitment in order to perform the RingCT "cancel-out" calculations:

Pseudo-Commitments of Input Amounts - (Commitment of Output Amounts + Fees ) = 0

Could somebody guide me step by step about how the pseudo-commitment are calculated starting from a Pederson Commitment?

Answer 1

Good question

Pseudo-Commitments' blinding factors are chosen by payer SUCH AS:

1. each of them is different from blinding factor of actual input being hidden
2. the sum of Pseudo-Commitments' blinding factors is equal to the sum of outputs' blinding-factors

This choice is possible by the payer 'cause he/she knows blinding factor of actual inputs and outputs, since they are generated from Diffie-Hellman-like payer-payee exchanges in this and in a previous transactions

Point 2) permits the cancellation of the "blinding addends" of the commitments, you remain with an equality of an EC point multiplied by in/out amounts and fee, the last step to obtain equality of only in/out amounts and fee is possible thanks to Bulletproof

Point 1) requirement is a bit more technical: it's needed to obtain a pub/priv EC keys couple which could exist (and so sign level 2 of CLSAG) if and only if actual input’s commitment and Pseudo commitment refer to exactly the same hidden amount (which is fundamental, given the balance with cancellation the tx has to prove)

Perhaps this can help your study: https://www.getmonero.org/library/RctCheatsheet20210604.pdf

and perhaps this if you need to recap CLSAG: https://www.getmonero.org/library/RingsCheatsheet20210301.pdf

and this if you want to dig deep on that "Diffie-Hellman-like" exchange: https://www.getmonero.org/library/MoneroAddressesCheatsheet20201206.pdf

Disclaimer: I'm the author of the cheatsheets, I made them while studying Z2M as well.

---

EDIT TO ANSWER THE FURTHER QUESTION BY OP

b' (blinding factor for Pseudo Commitment) is always chosen by the sender different from b (blinding factor of the actual hidden input): that's point 1).

It's always possible cause sender has ways to know blinding factors of actual inputs and outputs, as previously stated, and the algorithm for the choice is sketched in Z2M pag 46-47 ("Fortunately, choosing such blinding factors is easy. In the current version of Monero, all blinding factors are random except for...")

I guess your doubt stems from randomness, something like "what if randomness cause b'=b?"... My educated guess is there's a condition escaping from this situation: maybe a repeated random generation or any other tie-breaker.... perhaps you could check that in source coded cited in Z2M as side-note: src/ringct/rctSigs.cpp, function verRctSemanticsSimple()

And to prevent an advanced doubt, no problems by possible overflows in blinding factors sums ('cause random overflowed blinding factor still elide each-other)... but don't worry if you don't get this point now.

Wish you good study!