I am aware that a similar question has been asked, but it doesn't go into the details of whether in the wallet level the individual user will be able to send rct and non-rct transactions, and wheather it will be possible to migrate each non-rct output to a rct output in their single transaction, instead of having to visibly mix all the user's non-rct outputs one last time in a sweep_all transaction? Even now I think it is kind of bad that it is not possible for the user to decide explicitly what outputs could go together, and which ones shouldn't, and I realize that after ringCT that concern will be mute, but I was hoping for the most privacy concious transition into rct possible.
1 Answer
If you have unspent outputs from non-rct transactions, they are mixed with other non-rct transaction outputs in the same manner as before (an attempt is made to find a mixin number of other outputs of same amount). Then, the amounts of each output in the new rct-transaction are separately "masked". Each verifier (all other nodes), create an "identity" commitment for the inputs to verify no XMR was created in the process - this is identical to how miner outputs now work.
A picture might help, two unspent transactions with mixin 2:
[input amt: 2]--
\
[input amt: 2]----[ring signature] --+
/ |
[input amt: 2]-- |
|
+--[proof: (inputs - outputs) == 0]--+
| |
[input amt: 5]-- | |
\ | |
[input amt: 5]----[ring signature] --+ |
/ |
[input amt: 5]-- [output amt: ?] ---- |
\ |
[output amt: ?]---------+
/
[output amt: ?] ----
I omitted transaction fees in this diagram (irrelevant for this discussion) - the 3 outputs must add up to 7 but the actual amounts are masked. So basically, the inputs to the transaction behave identical to pre-rct transactions, but the amount in each output is hidden.
So no sweep is necessary, until you have unmixable pre-rct unspent outputs. And even then, it is possible to do a transaction/sweep where the amounts in the input ring do not match (but this has not been implemented AFAIK).
