1

After reading 5.6.3 in Zero-To-Monero: https://www.getmonero.org/library/Zero-to-Monero-1-0-0.pdf

It seems as if they are saying that we use the commitment to zero to sign the ring with the inputs as message. <- this seems horribly wrong however.

Each input needs the private key associated with it's one-time-pubkey/address in order to unlock it. So does each input have a ring signature with the private key corresponding to the one-time-public key needed to unlock our input?

Then maybe the commitment to zero is used to sign the whole transaction?

If any of the above is correctly assumed. At 5.7.2, they mention that in order to sign each individual input, we generate "a new commitment for the same amount but with a different blinding factor." This new commitment has nothing to do with the output commitment, how can we be sure that it is a commitment to zero?

2

It seems as if they are saying that we use the commitment to zero to sign the ring with the inputs as message.

Not quite, it does use it, but it is not the actual signing key.

It says:

Signing m with ko proves you are the owner/recipient of the amount committed to in Ca. Verifiers can be confident that transaction authors are spending their own funds.

And further up says:

With this observation made we can see the utility of zG. All commitment terms in R return some EC point, and the πth such term is zG. This allows us to create an MLSAG signature (Section3.3) on R.

Moving to your next question:

Each input needs the private key associated with it's one-time-pubkey/address in order to unlock it. So does each input have a ring signature with the private key corresponding to the one-time-public key needed to unlock our input?

Yes. Or to put it more accurately, the receiver of the outputs now being used as inputs (to spend), has derived the private keys (using the tx shared secret from the tx they received these outputs from, and their own wallet private keys).

Then maybe the commitment to zero is used to sign the whole transaction?

No. I think where you are getting lost is the distinction between proving ownership of inputs being spent and proving that the output amounts balance out the input amounts. The former is the job of the MLSAG signature(s), the latter is the job of the Pedersen commitments and the Range proofs (the commitments hide the amounts and prove the inputs minus outputs balance out, the range proof proves that each amount in an output commitment is within a range, in this case positive, which prevents creating money out of thin air).

The commitment to zero is used in the construction of the MLSAG signature, it is not the signing key itself.

  • does the commitment to output amount in the bulletproof rangeproof, need to be the same as the commitment on the output? – WeCanBeFriends Apr 22 at 23:01
  • 1
    Yes. The range proof is done on your outputs. – jtgrassie Apr 22 at 23:36
  • I also just expanded my answer to one of your questions (the private keys of the inputs being spent). I usually point people to this article by Luigi1111 which does a great job of simply explaining the stealth addresses (the one-time keys). – jtgrassie Apr 23 at 1:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.