up vote 2 down vote favorite

Conceptually how does one hide transaction values using pederson commitments and range proofs in ethereum(accounts model)?

The key issue is how can we make it happen in an accounts model and not in an UTXO model. Monero has an UTXO model.

I have understood the following partially so far- https://cryptoservices.github.io/cryptography/2017/07/21/Sigs.html

The author explains pederson commitments, range proofs, schnorr signatures, ring signatures, Borromean signatures.

share|improve this question
  • Can you clarify the question as it looks like it's already answered in the section "Hiding Transaction Amounts" of the article you linked. – jtgrassie Sep 14 at 11:21
  • The key issue is how can we make it happening in an accounts model and not in an UTXO model. Monero has an UTXO model – user136368 Sep 14 at 16:15
up vote 0 down vote

I'll describe conceptually how they work in Monero, since this is the Monero stackexchange. I'd assume they would work similarly when implemented elsewhere.

Output amounts are encrypted by the sender using the transaction shared secret, and bundled with the transaction. The transaction shared secret is the result of a Diffie Hellman exchange between the sender and the recipient. The recipient decrypts the amount in order to figure out the value of the funds that have been sent.

It is also necessary to provide a Pedersen commitment for each output amount, so that the network can verify that no funds have been created out of thin air. The Pedersen commitment does not reveal the amount of the output and does not allow for values to be compared to one another, but does provide a mathematical mechanism to allow it to be proven that a set of Pedersen commitments sum to zero. This allows the network to verify that no Monero is being created out of thin air. The same mechanism described in the paragraph above for encrypting and sending the output amounts is used to additionally encrypt and bundle the Pederson commitment blinding factors to the recipient. Knowledge of these blinding factors is necessary for the recipient to construct a transaction in the future that can spend the outputs that are received in a past transaction.

Ring signatures prove that in at least one combination of the sum of possible inputs and outputs, one of those combinations does sum to zero. Since the sum of Pedersen commitments is a public key, and since the proof of a Pedersen commitment summing to zero is effectively a signature that demonstrates knowledge of the Pedersen commitment's private key, Pedersen commitments are easy to combine with ring signatures (since ring signatures prove knowledge of one private key for a given set of public keys).

share|improve this answer
  • How can one do it in an acounts model? Just the confidential transactions. – user136368 Sep 14 at 16:15
  • @user136368 I'm not familiar enough with how ethereum works to give you a walk through. If you are familiar with ethereum, then all you need to do is figure out how an account can have a public and private key associated with it, and then that is sufficient to allow the Diffie Hellman exchange to occur. Then you need to figure out where the payload (encrypted output amounts and Pedersen commitments) can be stored alongside the transaction, and need to figure out how to write the code that will verify the Pedersen commitments of any transaction submitted. – knaccc Sep 14 at 17:19

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.