Making non-native tokens private by using RingCT

Question

(This is a research oriented question)

Is it possible to leverage the CT primitive and use it in order to transfer non-native and non-fungible tokens such as ERC721 (in another blockchain of course, since Monero doesn't support a token that is different from XMR)?

Stealth addresses and ring signatures should work, but I don't quite know how to perform the adaption to RingCT (though its value might be necessary cause its non-fungible feature).

Any comments to what I want to do or examples that someone else may have made a POC for would be appreciated!

Thanks.

Answer 1

RingCT is basically the combination of three things: ring signatures, stealth addresses (one-time output keys) and CT (Confidential Transactions).

The ring signature provides sender ambiguity, the stealth addresses (one-time output keys) hide the recipient address from the blockchain and CT is used in hiding the amount. Combined, you have the properties needed for a private fungible asset because the asset has no history to follow - 1 XMR will always be worth 1 XMR - they are indistinguishable.

ERC721 is for non-fungible assets, so I'm not quite following why you would want to use RingCT. That said, if you just wanted to make use of CT, to hide the value (or any other integer for that matter), it is not a particularly difficult construct to grasp.

CT requires two generators, a binding factor and the amount. A Pedersen commitment is then created like xG + aH (x and a being the binding factor and amount, G and H being the generators). Note you cannot recover the amount from the commitment - its a commitment to a value, not encryption of a value. Therefore in Monero, ECDH is employed to pass the amount encrypted separately (within the tx), which also means you need some mechanism to have a shared secret, for which Monero neatly places in the tx extra field. Also note, if you are using CT for a tx amount on a blockchain, you will also want to employ a range proof to prove the amounts in the commitments fall within a positive range (to prevent inflation).

For reference, the original CT paper can be found here: Confidential Transactions

When I think of non-fungible assets, provenance springs to mind - you want a transparent history of that asset - which is contradictory to what you get with RingCT.