I am aware that a similar question has been asked, but it doesn't go into the details of whether in the wallet level the individual user will be able to send rct and non-rct transactions, and wheather it will be possible to migrate each non-rct output to a rct output in their single transaction, instead of having to visibly mix all the user's non-rct outputs one last time in a sweep_all transaction? Even now I think it is kind of bad that it is not possible for the user to decide explicitly what outputs could go together, and which ones shouldn't, and I realize that after ringCT that concern will be mute, but I was hoping for the most privacy concious transition into rct possible.


If you have unspent outputs from non-rct transactions, they are mixed with other non-rct transaction outputs in the same manner as before (an attempt is made to find a mixin number of other outputs of same amount). Then, the amounts of each output in the new rct-transaction are separately "masked". Each verifier (all other nodes), create an "identity" commitment for the inputs to verify no XMR was created in the process - this is identical to how miner outputs now work.

A picture might help, two unspent transactions with mixin 2:

[input amt: 2]--
[input amt: 2]----[ring signature] --+
                /                    |
[input amt: 2]--                     |
                                     +--[proof: (inputs - outputs) == 0]--+ 
                                     |                                    |
[input amt: 5]--                     |                                    |
                \                    |                                    |
[input amt: 5]----[ring signature] --+                                    |
                /                                                         |
[input amt: 5]--                                  [output amt: ?] ----    |  
                                                                      \   |
                                                  [output amt: ?]---------+
                                                  [output amt: ?] ----

I omitted transaction fees in this diagram (irrelevant for this discussion) - the 3 outputs must add up to 7 but the actual amounts are masked. So basically, the inputs to the transaction behave identical to pre-rct transactions, but the amount in each output is hidden.

So no sweep is necessary, until you have unmixable pre-rct unspent outputs. And even then, it is possible to do a transaction/sweep where the amounts in the input ring do not match (but this has not been implemented AFAIK).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.