1

Refer to ZtM2 chp3.5, we can see that in step 5

rπ = α − cπ * kπ (mod l)

It's fine for public-key-ring part because there is private key kπ.
But what if it is commitment-ring? How to do with no kπ?

Please help to answer it. Thanks!

  • 1
    It's the commitment to zero z_j, from section 6.2.2 – koe Jun 23 at 15:47
  • 1
    Yeah, the commitment has three components (plus the message and key prefixing) c_pi = H(m, (K_pi), [alpha_k G], [alpha_k H_p(K_pi)], (C_pi - C'_pi), [alpha_z G]). r_k_pi = alpha_k - c_pi*k_pi and r_z = alpha_z - c_pi*z. You can find discussion of the commitment to zero in section 5.4 – koe Jun 23 at 16:55
  • 1
    Thanks a lot @koe!! Your point is right. BTW, I think c_pi is called challenge not commitment. :) – Mooooo Jun 25 at 8:46
  • 1
    @Mooooo I'm not quite sure why you keep referring to this as a "commitment-ring"? The ring being signed is a ring of keys, not commitments. Even the commitment to zero is really just another key. Anyway, looks like you've found what you were after. – jtgrassie Jun 26 at 2:32
  • 1
    @jtgrassie MLSAG is a bit like two knotted bracelets glued together and tied at the same point, so in that sense one bracelet is the set of one-time address keys, and the other bracelet is the corresponding set of commitment to zero keys. I believe Mooooo is using 'ring' loosely to mean what I mean by bracelet. The entire set of keys is technically the 'ring', and there is no technical term for the ring's layers. – koe Jun 26 at 19:37
2

#Thanks for the reminder from @Koe.

Refer to ZtM2 chp 5.4...
The kπ here for "commitment-ring" should be xj-xj'
So that the challenge is

cπ+1 = Hn(m, Kπ, [α1G], [α1*Hp(K)], commitment_to_zero, [α2G])

Where commitment_to_zero can be derived fromxj-xj'.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.