RingCT: What happens if accidentially decoy "Input + Output" sum up to 0?

Question

In Ring CT the validattors check whether there is one combination of "Output + Input", that sums up to zero. What happens if "Real-Input + Output" does not sum up to zero, but accidentally some other combination (using the decoy as input) does?

Answer 1

Think of ring signatures as rows. When a single input is being spent, there is a row for each possible input (all are decoy inputs except for one real input). Each row contains a proof that a particular input is being spent, and a proof that the sum of that encrypted input amount - all encrypted output amounts - fee = 0.

The way ring signatures work is that you can't tell which row contains the real proof, but you know for sure that one of the rows must contain a valid proof (and that the valid proof row correlates with the declared input key image). Because each proof applies to the entire row, you can't mix and match encrypted input values from one possible input with a spend of a different input in the ring.

In the case of multiple inputs, there is a ring signature for each real input. The spender generates a "pseudo-out" for each of those rings, which is a re-encryption of the value of the real input being spent (using a different 'blinding factor' so that you can't tell which original encrypted input value this a re-encryption of). These pseudo-outs are declared by the spender as part of the transaction. Each row also proves that the declared psuedo-out is an encryption of the same value as the original encrypted input amount value for the input in that row. It is also then proven that the sum of all "pseudo-out" re-encrypted input amounts - all encrypted output amounts - fee = 0. Again, only the proof contained in one row of each ring signature is the genuine proof, and you can't tell which row this is.