How does commitment to zero work?

Question

Given two inputs each with their respective committed amounts; P1, P2.

Then given two outputs each with their own respective committed amounts; P3, P4.

We want to prove that the inputs - outputs - fee * G = 0

P1 = a1 * G + r1 * H P2 = a2 * G + r2 * H

P3 = a3 * G + r3 * H P4 = a4 * G + r4 * H

C = zG = (P1 + P2) - (P3 + P4)

if amounts are balanced, which means that (a1 + a2) - (a3 + a4) = 0

We then have zH = (r1 + r2 - r3 - r4)H

The sender should know z because it is the blinding factors, r1, r2, r3, r4.

r1, r2 are given to the sender from his previous transactions. r3, r4 are created by the sender to blind the new output amounts.

--- While writing this I have come up with a possible answer. Please check.

If the amounts do not balance out, for example, let's say the sender decides to not include P4.

Then we would have C2 = P1 + P2 - P3 = (a1 + a2 - a3)G - (r1 + r2 - r3)H

Since we do not know the relationship between G and H, the prover cannot sign unless he solves the DLP.

This brings up another question brought up by a friend:

What if the sender decides to cancel out the blinding factors part of the commitment instead by cleverly choosing the blinding factor?

Clarification on cancelling the blinding factors:

Let C = (a1 + a2 - b1 - b2)G + (r1 + r2 - r3 - r4)H

Assuming the amounts do not cancel out, so a1 + a2 - b1 - b2 does not equal zero.

What is stopping the sender from choosing r3 and r4 in such a way that r1 + r2 - r3 - r4 = 0 , then singing with the key as (a1 + a2 - b1 - b2) ?

---

Example of cancelling out:

• For clarity we will say that C = xG = aH, where a is amount and x is blinder.

• Bob wants to send 10 Monero to Alice.

• Bob has two inputs one with 8XMR and the other with 2XMR.
• Bob also has their commitments C1 = 10G + 8H and C2 = 12G + 2H.

He creates the output to be Alice, but being dishonest he sends her 8XMR and creates the commitment to the output like so: C3 = 22G + 8H

Calculating Sum(in) - Sum(out) we get:

C1 + C2 - C3 = 0G + 2H

Bob then signs with his key as "2"

My question is why is this impossible?

Answer 1

Firstly, your G and H are the wrong way round. Each Pedersen commitment is actually xG + aH where x is the blinding factor and a is the amount. So where you are writing P1 = a1 * G + r1 * H, I would write: C₁ = x₁G + a₁H.

If the amounts do not balance out, for example, let's say the sender decides to not include P4.

A transaction is invalid if it has more outputs than there are commitments for. It will get rejected.

What if the sender decides to cancel out the blinding factors part of the commitment instead by cleverly choosing the blinding factor?

This makes no sense without defining how they "cancel out the blinding factors". You are suggesting a way the underlying math could be broken without defining how / a way.

Update now you have tried to explain

You cannot arbitrarily change the blinding factors. Quoting from Zero to Monero, 5.6.2:

Indeed, z follows from the blinding factors if and only if input amounts equal output amounts (recalling Section 4.1, we don’t know γ in H = γG).

Given you cannot change the input commitments, the only thing you can do to create a valid commitment to zero, is by having your output commitment balance against the input commitments. In simple terms, if the input commitment is 5, only an output of 5 gives a commitment to 0.

Update based on question edited again

Your new edit just shows Bob burn 2 XMR. He spends input amounts 8 and 2, but only has one output, 8. Thus 2 burnt.

Further,

C1 + C2 - C3 = 0G + 2H

Bob then signs with his key as "2"

No, Bob would be signing with 0. Recall the number next to H is an amount, not a blinding factor.

With respect to the title question:

How does commitment to zero work?

The commitment to zero is a point, zG. This is the sum of all the input commitments blinding factors x, minus the sum of all the output commitments blinding factors y, multiplied by G.

See section: 5.6.2 Commitments to zero.

All of the details are covered extremely well in the Zero to Monero paper. Refer to sections 4.1, 4.2, 5.6.1 and 5.6.2.