Given two inputs each with their respective committed amounts; P1, P2.
Then given two outputs each with their own respective committed amounts; P3, P4.
We want to prove that the inputs - outputs - fee * G = 0
P1 = a1 * G + r1 * H P2 = a2 * G + r2 * H
P3 = a3 * G + r3 * H P4 = a4 * G + r4 * H
C = zG = (P1 + P2) - (P3 + P4)
if amounts are balanced, which means that (a1 + a2) - (a3 + a4) = 0
We then have zH = (r1 + r2 - r3 - r4)H
The sender should know z because it is the blinding factors, r1, r2, r3, r4.
r1, r2 are given to the sender from his previous transactions. r3, r4 are created by the sender to blind the new output amounts.
--- While writing this I have come up with a possible answer. Please check.
If the amounts do not balance out, for example, let's say the sender decides to not include P4.
Then we would have C2 = P1 + P2 - P3 = (a1 + a2 - a3)G - (r1 + r2 - r3)H
Since we do not know the relationship between G and H, the prover cannot sign unless he solves the DLP.
This brings up another question brought up by a friend:
What if the sender decides to cancel out the blinding factors part of the commitment instead by cleverly choosing the blinding factor?
Clarification on cancelling the blinding factors:
Let C = (a1 + a2 - b1 - b2)G + (r1 + r2 - r3 - r4)H
Assuming the amounts do not cancel out, so a1 + a2 - b1 - b2 does not equal zero.
What is stopping the sender from choosing r3 and r4 in such a way that r1 + r2 - r3 - r4 = 0 , then singing with the key as (a1 + a2 - b1 - b2) ?
Example of cancelling out:
For clarity we will say that C = xG = aH, where a is amount and x is blinder.
Bob wants to send 10 Monero to Alice.
- Bob has two inputs one with 8XMR and the other with 2XMR.
- Bob also has their commitments C1 = 10G + 8H and C2 = 12G + 2H.
He creates the output to be Alice, but being dishonest he sends her 8XMR and creates the commitment to the output like so: C3 = 22G + 8H
Calculating Sum(in) - Sum(out) we get:
C1 + C2 - C3 = 0G + 2H
Bob then signs with his key as "2"
My question is why is this impossible?