20

Can someone explain simply how RingCT can make sure that a user has the specified amounts without seeing it? My mind starts to pause as soon as i see formulas on a whitepaper.

Improve this question
0

1 Answer 1

Reset to default
18

Basic idea can be explained by simple arithmetics. Now, we're checking that sum of all inputs must be equal to sum of all outputs. For example:

1+2+3+4 = 3+5+2

Literally, "what comes in must come out", and that's how we assert no coins were created or destroyed in the transaction. And you can see the amounts. If you multiply everything by some random number A, you get the below:

(1A) + (2A) + (3A) + (4A) = (3A) + (5A) + (2*A). which can be written as:

A * ( 1+2+3+4) = A * (3 + 5 + 2), so we can be sure that 1+2+3+4 = 3+5+2 still holds true.

Trick is, with ringCT, only the sender and receiver know the value of A. All the rest see only the already multiplied values (2A), (3A)... so they can check that there's no cheating, but they don't know A, so they can't tell the exact amounts involved. Of course, it's not implemented exactly as above, but I think you can get the idea.

Improve this answer
8
  • 1
    If RingCT does not use coefficients, then what does it use? Is there a noticeable difference in average reported amount of a transaction of 10 XMR and 10000 XMR?
    – sgp
    Commented Aug 9, 2016 at 19:17
  • 1
    I think it's a hash function with the same property, i.e., f(a)+f(b) = a+b. It's descriped in MRL paper. I plan to research it a bit and can update the answer if it will be clear to me
    – JollyMort
    Commented Aug 11, 2016 at 8:03
  • 1
    correction: f(a)+f(b)=f(a+b)
    – JollyMort
    Commented Sep 12, 2016 at 17:44
  • 2
    Great explanation. But if only sender and receiver know value of A, how can the network validate that some next transaction using coins from this transactions doesnt create new coins? If I receive coins in this transaction and then I send to someone coins in another. Lets say in reality A was 100 but I will pretend that it was 10 and instead all coins were 10x more. How can network validate that I am lying?
    – urza.cc
    Commented Dec 4, 2016 at 22:37
  • 1
    Every transaction originates from an output of a known amount, ie the money was created somewhere first and amount hidden in the next and every subsequent transaction. It could be an old output found on the network, or a coinbase transaction. Later, all we have to prove is the commitment - that it's the same A on both sides of the equation, without having to reveal it. This is still ELI5 zone, and I don't yet know to explain it further.
    – JollyMort
    Commented Dec 4, 2016 at 22:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.