Monero Stack Exchange is a question and answer site for developers and users of the secure, private and untraceable cryptocurrency Monero. It only takes a minute to sign up.
Sign up to join this community
Conceptually how does one hide transaction values using pederson commitments and range proofs in ethereum(accounts model)?
The key issue is how can we make it happen in an accounts model and not in an UTXO model. Monero has an UTXO model.
I have understood the following partially so far- https://cryptoservices.github.io/cryptography/2017/07/21/Sigs.html
The author explains pederson commitments, range proofs, schnorr signatures, ring signatures, Borromean signatures.
I'll describe conceptually how they work in Monero, since this is the Monero stackexchange. I'd assume they would work similarly when implemented elsewhere.
Output amounts are encrypted by the sender using the transaction shared secret, and bundled with the transaction. The transaction shared secret is the result of a Diffie Hellman exchange between the sender and the recipient. The recipient decrypts the amount in order to figure out the value of the funds that have been sent.
It is also necessary to provide a Pedersen commitment for each output amount, so that the network can verify that no funds have been created out of thin air. The Pedersen commitment does not reveal the amount of the output and does not allow for values to be compared to one another, but does provide a mathematical mechanism to allow it to be proven that a set of Pedersen commitments sum to zero. This allows the network to verify that no Monero is being created out of thin air. The same mechanism described in the paragraph above for encrypting and sending the output amounts is used to additionally encrypt and bundle the Pederson commitment blinding factors to the recipient. Knowledge of these blinding factors is necessary for the recipient to construct a transaction in the future that can spend the outputs that are received in a past transaction.
Ring signatures prove that in at least one combination of the sum of possible inputs and outputs, one of those combinations does sum to zero. Since the sum of Pedersen commitments is a public key, and since the proof of a Pedersen commitment summing to zero is effectively a signature that demonstrates knowledge of the Pedersen commitment's private key, Pedersen commitments are easy to combine with ring signatures (since ring signatures prove knowledge of one private key for a given set of public keys).
