How are outPk, mask and amount fields created when spending RignCT coinbase transactions?

Question

RingCT coinbase transactions don't have ecdhInfo fields with mask, outPk and amount. For example, this is how ringct coinbase transactions looks like (look at JSON representation):

https://explorer.xmr.my/tx/b3630cecf07e3db8a3bad74f9e3ec29451148ec3a0cce1475d73549576bbc773/1

Notice that the ringct fields are empty:

"rct_signatures": {
"type": 0
}

Now compare this with a normal ringct transaction: https://explorer.xmr.my/tx/91870fad32873d8e01f1e1328540dd9d997a042343664aec4e5a1ace58d4554a/1

rct_signatures structure is field. Of special interest is ecdhInfo:

"ecdhInfo": [ {
"mask": "ea3f55ede33a6500cbaf8209494f98f47c8e2c392ae1c4829ca2b6e56fa7a80a",
"amount": "0aeff00281a107ae87a1d36d15d935a5af4bb42386feccb0913e98deeb67ee09"
}, {
"mask": "4238c9f9cdc40045e79970ad9481af1fa1f2141e9dedc58a13adfb3dec21f607",
"amount": "826a729c9bf014af4af3b801b195c3787566b89d28a887f6c0262ed26237ba09"
}],
"outPk": [ "8d58a7e35b866bcb8f3fc14dd44d7190a8b8057917d8b1362a36562bf5466aef", "6bcb6810dcf18c4f6480c695b619e3302c92ab1642ce6b263bfdbbd935d18649"]
},

Normal transactions have outPk, mask and amount provided and available in the blockchain. Those values are not available for coinbase ringct transactions. My guess is that they are created in flight when spending ringct coinbase transactions? But how? I can't find this information. They are needed for spending coinbase ringct transactions from what I understand.

Any info is appreciated.

Answer 1

The person(s) mining would need to provide these fields. They are normally created by the sender of a normal transaction whereby a new private / public key pair and corresponding shared ECDH secret is created. In this case the person(s) who successfully mined a block gets to "send" themselves the block reward. But instead of sending it as RingCT type 0 (more on this below), they'll need to split the coinbase into multiple inputs can adopt RingCT type 1. It is not yet mandatory that coinbase transactions do this, but I believe the next hard fork will make this a requirement.

Also pay attention to the RingCT/type: yes/0 field in the first link you provided. There are three types of RingCT, and a 0 indicates NULL:

Null is used for coinbase transactions. There are no inputs to sign, so no signatures can be provided. If a miner uses this mode (as opposed to tx.version == 1) then the coinbase output can be used as a dummy input in any rct transaction (AFAIK, primarily due to how it is stored in a database).

In your second link you'll notice RingCT/type: yes/1, with type 1 indicating Simple:

Simple is currently used when a transaction has multiple inputs. There is a LSAG signature for each input. Each LSAG is smaller in size than a tx.version == 1 signature, so there is still some space savings over the original signature method.

Source

This accounts for the missing fields.

This may also be of interest to you: RING CONFIDENTIAL TRANSACTIONS

Answer 2

The ecdhInfo fields are encrypted from the sender to the receiver using the shared secret derived from the ECDH exchange. They contain the mask that "hides" the amount being transferred in the public commitment, and the amount that the mask is hiding. The receiver verifies that the public commitment = mask + amount (hand-waving away the EC arithmetic required to make this happen), and therefore can verify the actual amount received.

Coinbase transactions must publically declare the coinbase amount so everyone can verify the inflation schedule is being followed. Thus, coinbase transaction have no use for ecdhInfo since the amount being claimed is already public knowledge.

When a node stores a ringct coinbase transaction in the database, it forcibly sets a "commitment" where ecdhInfo.mask = 0 and ecdhInfo.amount = coinbase amount. When the miner wants to "spend" the transaction, they are required to provide a signature where the commitment matches the one forcibly created by the nodes (mask == 0, amount == coinbase amount).