We cannot use MLSAG and sign all inputs at once; as all real inputs would need to share the same index.
The partial solution is to use a ring signature on each input separately.
We need to ensure that the inputs balance out the outputs.
To illustrate how I believe it works, I will use an example:
A Pedersen commitment P is defined as
P = bG + aH
- where a is the amount and b is blinding factor.
- Discrete Log is unknown with respect to both G and H.
Alice wants to send 5XMR to Bob.
Alice uses two inputs:
Input1 has amount 2XMR and the commitment C1 = xG + 2H
Input2 has amount 3XMR and the commitment C2 = yG + 3H
Alice creates an output addressed to Bob:
- Output1 has amount 5XMR and the commitment C3 = kG + 5H
Alice creates new pseudo-commitments for each input, whereby the amount stays the same:
C'k would denote the input associated with Ck.
- C'1 = x'G + 2H
- C'2 = y'G + 3H
Alice then calculates a commitment to zero for each input:
Commitment to Zero for input 1 would be C1 - C'1 = (x - x')G = z1G
Commitment to Zero for input 2 would be C2 - C'2 = (y - y')G = z2G
The sum of all k' scalars are chosen in such a way that they cancel out the sum of the blinding factors of k.
This means that:
(x' + y') - (x + y) = 0
This would allow us to prove that the input amount equals the output amounts because:
C1 + C2 - (C'1 - C'2) = (x + y)G + 5H - (x' + y')G + 5H = 0 (fee is omitted for simplicity).
At this point, someone verifying this transaction could do the sum(Ck) - sum(C'k) = 0 for all inputs, maybe checking that Ck and C'k are different.
Question: This would not be enough because the scheme does not end here, why?
Since each input is signed individually, I will focus on input1 only, as it is the same for input2.
As mentioned above the Commitment to Zero for input 1 would be C1 - C'1 = (x - x')G = z1G
*Alice is now attempting to sign input1.
She gathers a set of decoy outputs and their commitments. The one-time public key associated with each output is used as mixins.
In 5.7.2, still I mis-understand why z1G is being used in the ring.
For a ring signature, we need a message
m and signing key
k and a set of public keys
Pk where k=x is the public key corresponding to the signing key
k. If this is correct, then what is the purpose of z1G in this ring signature?
- I cannot seem to decouple the signing process from proving that the inputs and outputs balance out, mainly because the signing process uses zG for some reason.