It seems that the genRctSimple function will make a different input commitment for each input amount (line 675-683 in file src/rct/rctSigs.cpp). And summation of these input commitments = output commitments. Why not just use original input commitments along with the input coins? Is it for unlinkability? Or for later checking (if yes, how?) Or something else? Appreciate greatly for any possible answer.


Yes, the pseudoOuts are new commitments calculated for your real inputs. Each pseudoOut is calculated as pseudoOut = aG + bH where a is a newly generated mask (also known as a blinding factor) and b is the input amount.

If the existing commitments for inputs were used in transactions spending multiple inputs (known as RCTTypeSimple transactions), if one real input ring position was revealed, this would reveal all real input ring positions in the transaction.

Because OutPk and PseudoOut are both commitments to the same amount, this means that OutPk - PseudoOut = Commitment to Zero. You can therefore prove that your OutPk and PseudoOut are commitments to the same amount by signing for the commitment to zero. You can sign because you will know the private key, which is the difference between the mask used for the OutPk and the newly generated mask used for the PseudoOut. The original mask used for the OutPk of your input is communicated to you via the EcdhInfos in the transaction that created the input for you.

The codebase is the real documentation for figuring out how this stuff works, as the full procedure is not currently documented in an MRL paper.


This doesn't make sense to me ... If you do not re-use the commitments for the outputs spent, then you could claim that you previously received a different amount that you now spend.

The point was that by signing with the private key of \sigma_i C^{in}_i - \sigma_j C^{out}_j you are proving that you are spending amounts you actually received.

If your C^{in}_i are new then you could just as well be creating money ...


Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.