# How to get the r value for commitment in mlsag sign

Refer to ZtM2 chp3.5, we can see that in step 5

rπ = α − cπ * kπ (mod l)

It's fine for public-key-ring part because there is private key kπ.
But what if it is commitment-ring? How to do with no kπ?

• It's the commitment to zero `z_j`, from section 6.2.2
– koe
Commented Jun 23, 2020 at 15:47
• Yeah, the commitment has three components (plus the message and key prefixing) `c_pi = H(m, (K_pi), [alpha_k G], [alpha_k H_p(K_pi)], (C_pi - C'_pi), [alpha_z G])`. `r_k_pi = alpha_k - c_pi*k_pi` and `r_z = alpha_z - c_pi*z`. You can find discussion of the commitment to zero in section 5.4
– koe
Commented Jun 23, 2020 at 16:55
• Thanks a lot @koe!! Your point is right. BTW, I think c_pi is called challenge not commitment. :) Commented Jun 25, 2020 at 8:46
• @Mooooo I'm not quite sure why you keep referring to this as a "commitment-ring"? The ring being signed is a ring of keys, not commitments. Even the commitment to zero is really just another key. Anyway, looks like you've found what you were after. Commented Jun 26, 2020 at 2:32
• @jtgrassie MLSAG is a bit like two knotted bracelets glued together and tied at the same point, so in that sense one bracelet is the set of one-time address keys, and the other bracelet is the corresponding set of commitment to zero keys. I believe Mooooo is using 'ring' loosely to mean what I mean by bracelet. The entire set of keys is technically the 'ring', and there is no technical term for the ring's layers.
– koe
Commented Jun 26, 2020 at 19:37

The kπ here for "commitment-ring" should be `xj-xj'`
``````cπ+1 = Hn(m, Kπ, [α1G], [α1*Hp(K)], commitment_to_zero, [α2G])
Where commitment_to_zero can be derived from`xj-xj'`.