It seems that the genRctSimple function will make a different input commitment for each input amount (line 675-683 in file src/rct/rctSigs.cpp). And summation of these input commitments = output commitments. Why not just use original input commitments along with the input coins? Is it for unlinkability? Or for later checking (if yes, how?) Or something else? Appreciate greatly for any possible answer.

2 Answers 2


Yes, the pseudoOuts are new commitments calculated for your real inputs. Each pseudoOut is calculated as pseudoOut = aG + bH where a is a newly generated mask (also known as a blinding factor) and b is the input amount.

If the existing commitments for inputs were used in transactions spending multiple inputs (known as RCTTypeSimple transactions), if one real input ring position was revealed, this would reveal all real input ring positions in the transaction.

Because OutPk and PseudoOut are both commitments to the same amount, this means that OutPk - PseudoOut = Commitment to Zero. You can therefore prove that your OutPk and PseudoOut are commitments to the same amount by signing for the commitment to zero. You can sign because you will know the private key, which is the difference between the mask used for the OutPk and the newly generated mask used for the PseudoOut. The original mask used for the OutPk of your input is communicated to you via the EcdhInfos in the transaction that created the input for you.

The codebase is the real documentation for figuring out how this stuff works, as the full procedure is not currently documented in an MRL paper.

  • " signing for the commitment to zero." I recently wrote a question on this, I think this is the part that does not make sense to me. Could you elaborate? Apr 23, 2019 at 13:56
  • @WeCanBeFriends There are various different ways of creating a signature proving you know the private key for a given public key (in this case, proving that if two commitments exist for the same value, that you know the private key for the subtraction of one from the other, which is only possible if they're for the same value because H will be cancelled out and you're left with just something * G). The MLSAG proves lots of things at the same time, and one of the things it proves is that you know the private key for this subtraction.
    – knaccc
    Apr 23, 2019 at 21:06

This doesn't make sense to me ... If you do not re-use the commitments for the outputs spent, then you could claim that you previously received a different amount that you now spend.

The point was that by signing with the private key of \sigma_i C^{in}_i - \sigma_j C^{out}_j you are proving that you are spending amounts you actually received.

If your C^{in}_i are new then you could just as well be creating money ...


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.