I understand one can have two commitments
Q, and show the world that
P - Q = 0 - communicating the commitment to only the recipient. In fact, it can be done with many input commitments
P1 ... Pn. However, how do the other commitments remain hidden?
The user can take
P1 ... Pn, when he really only knows the commitment key for
P1, and then generate output
Q1 ... Qn with
sum(Q). However, doesn't that invalidate the random
P2 ... Pn he was trying to mixin with? They still need to be able to spend their commitments using the private keys they know for the old
I just don't really understand how Pedersen Commitments integrate with mixins.
Under the original scheme, We have the following:
- Take N input transactions that hold the same amount of Monero
- Prove I have the private key for one of them using Ring Signatures
- Provide a keyImage that's never been used before, and prove that it is equal to privateKey * Hash(PublicKey) for one of the N transactions. This is done without revealing which privateKey was used.
- Provide M output transactions, signed to prove that you approve of them, such that the sum of the output amounts is equal to the common amount used in the input transactions.
The total state changes resulting from steps 1-4 is that One KeyImage is stored and cannot be used again, and M output transactions are stored for later usage.
(Of course, the proofs are stored too but are never used ever again except for new nodes downloading the blockchain. Thus, I do not include them in "state changes")
Now, my final question: How does this work with Pedersen Commitments? What exactly is the input->output relation for a transaction under RingCT, along with state changes? I want to be able to read it in a format equivalent to the step-by-step format I gave for pre-RingCT transactions. Bounty for whoever does this :)
I ask this because, if each Pedersen Commitment holds a different value, how could it ever be so that the Pedersen Commitment remains secret? Isn't it obvious which one I used? If I consumed several commitments, then what happens to them if I didn't own them? I just don't understand. I would like a more explicit explanation.
Everything written under "Bounty" can be ignored. Back to the original question, regarding mixins. I understand most of it now, due to "Can someone walk me through a simple example to explain how RingCT works?". However, this explanation does not discuss how the Pedersen Commitment proved is not used twice. I understand it's possible to introduce a second key image to prevent double usage of the pedersen commitment, but is this the most space-efficient method? What does Monero use? (Bounty is redesignated for the answerer of this question.)
Using a key image on Pedersen wouldn't solve the problem, because I could use a pedersen from someone else's transaction since I know the pedersen key for any transactions I send out. I could then steal their pedersen commitment. However, the realization is simple. I left it in a comment to "Can someone walk me through a simple example to explain how RingCT works?"