# Can I manually check consistency of Pedersen Commitments in RingCT?

Even though I fully trust the math behind RingCT and I know no moneroj can be created out of thin air, sometimes I'd like to see for myself the consistency of the Pedersen Commitment before/after any given transaction (ie. they sum up to the same value).

If I do print_tx 914b3d1367f10ee95e4aad793e07dab20c2c7106c63593821d7300a7a4cb1a34 on the testnet, I see some information among quite a chunk of data:

Found in blockchain at height 834232
...(chunk)...
{
"version": 2,
"unlock_time": 0,
"vin": [ {
"key": {
"amount": 0,
"key_offsets": [ 13206, 10439, 3501, 19878, 1840
],
"k_image": "85e8e93b7dcee586a427f7892d42e9d6127231261ee794bed0b0a17d3de4df38"
}
}, {
"key": {
"amount": 0,
"key_offsets": [ 41271, 5033, 2562, 21, 95
],
"k_image": "0606c5bdb3f04cf602a1a50b76253b4fac1f86aa283ecae56af05eeab361cf2f"
}
}, {
"key": {
"amount": 0,
"key_offsets": [ 19118, 15576, 2754, 6750, 4652
],
}
}, {
"key": {
"amount": 0,
"key_offsets": [ 22933, 15530, 3305, 5886, 1244
],
"k_image": "d8fe30c97b13beed710b2609dc1ce06e85b08a741fb7d7a5960810ff5de47a7e"
}
}
],
"vout": [ {
"amount": 0,
"target": {
"key": "5cde923e1712422d71dd577b35681125912b4c4a538444193ab6e271fd7a43a8"
}
}, {
"amount": 0,
"target": {
"key": "ca3cc9d51a037322e3f3ff2fe771e85c26628b7e2c1163c3e1e29515885c4163"
}
}
],
"extra": [ 1, 235, 1, 181, 37, 243, 100, 198, 158, 197, 43, 164, 39, 167, 190, 249, 250, 228, 251, 153, 212, 248, 165, 112, 95, 210, 238, 138, 151, 158, 243, 238, 50
],
"rct_signatures": {
"type": 2,
"txnFee": 30000000000,
"ecdhInfo": [ {
"amount": "63c1d97047ff515ccd5ca271f4e5013b9c1092c25307207a0ff037b13f492c00"
}, {
}],
"outPk": [ "f9cabc6b0fd32822feb3e13c70b54b2cdc2a3ce7c88ac661c29ab20732e2974f", "cfb010382648e11d7d5744fe8051c8606f31c901f9ede5b7e392f73790f9e7f8"]
},
"rctsig_prunable": {
"rangeSigs": [ {
...(chunk)...


I guess key_offsets point to the outputs P_i^j and outPk represent the output commitments C_{i,out} as in MRL-0005 (page 9, Definition 4.1). What I would like to do is to check that i-th member of R actually matches \sum_{j}P_i^j + \sum_{j}C_i^j - \sum_{k}C_{k,out}. Can I do this by myself easily, eg. by using Luigi1111's JavaScript code? How can I get P_i^j and C_i^j and i-th member of R from the daemon?

Also, what do pseudoOuts represent?

• As far as I know, pseudoOuts are the "decoy" outputs used for the ring signature. In your example there are 4 pseudoOuts, which corresponds to the minimum mixin of 4 that is enforced on testnet. – dEBRUYNE Nov 12 '16 at 11:36
• @dEBRUYNE Thanks for answering. How are these "decoy outputs" used in the ring signature? I don't find this term in MRL-0005. – kenshi84 Nov 13 '16 at 7:28

As in my post to MRL Issue #6, I now figured out what pseudoOuts mean. Assuming the outPk means the output commitments, what I'd like to know (assuming the ring signature is valid), would be to see the following hold:

sum_j{pseudoOuts[j]} = sum_i{outPk[i]} + fee*H


What I'm missing in Luigi's JS code is a way to get fee*H.

Edit: Luigi kindly answered my question! Here's the full JS code you can try at: https://xmr.llcoins.net/

> var H = ge_scalarmult(cn_fast_hash(ge_scalarmult_base("0100000000000000000000000000000000000000000000000000000000000000")), "0800000000000000000000000000000000000000000000000000000000000000");
undefined
> H
> var fee = swapEndian(d2h256("30000000000"));
undefined
> fee
"00AC23FC06000000000000000000000000000000000000000000000000000000"
> var feeH = ge_scalarmult(H, fee);
undefined
> feeH
"527e4c0b6e34f948fb59ab014ec8eedf9eccfda4930a0b30d12790a0ec0d91f2"
undefined
> var outPk = [ "f9cabc6b0fd32822feb3e13c70b54b2cdc2a3ce7c88ac661c29ab20732e2974f", "cfb010382648e11d7d5744fe8051c8606f31c901f9ede5b7e392f73790f9e7f8"]
undefined

• fee*H should be easy to do in the JS (I assume you're using a browser console to access it?). You can generate H with var H = generate_key_derivation_2(cn_fast_hash(sec_key_to_pub("0100000000000000000000000000000000000000000000000000000000000000")), "0800000000000000000000000000000000000000000000000000000000000000");. Then convert the fee in AU to a 32byte string and scalarmult with something like var feeH = generate_key_derivation_2(H, swapEndian(("0000000000000000000000000000000000000000000000000000000000000000" + parseInt(<your AU fee here>).toString(16)).slice(-64))); – Luigi Nov 29 '16 at 21:57
• I like it a lot. :) Since you exposed my, uh, dumb function names (or was that me), I renamed/aliased some of them. ge_scalarmult is now the name for generate_key_derivation_2 (both still work) and ge_scalarmult_base now also works for sec_key_to_pub. I also added a new d2h256 conversion function to convert any size decimal value to padded hex. – Luigi Nov 30 '16 at 1:25
• Thanks, I replaced some function names! Your function d2h256  seems to give me the hex string in the wrong order: 00000000000000000000000000000000000000000000000000000006FC23AC00 – kenshi84 Nov 30 '16 at 3:58