3

I'm a newcomer. I'm a bit confused about the current protocol and I don't quite feel like reading the code yet. I've been reading Shen Noether's paper as well as related work.

(1) I understand that currently, the range proofs are done with Borromean signatures, isn't it? Not ASLN?

(2) Does the sender communicate the blinding factors from the Pedersen commitments to the receiver? If not, how can he verify the actual amounts?

(3) Are the commitments to 0 or to zG as suggested in the paper mentioned? I didn't quite get the need for the latter, but I'm probably missing something

Is there more updated documentation of the current protocol available?

Kurt

Improve this question

2 Answers 2

Reset to default
5

(1) I understand that currently, the range proofs are done with Borromean signatures, isn't it? Not ASLN?

ASNL had a flaw, so it was changed to Borromean: What was the problem with ASNL forgery?

(2) Does the sender communicate the blinding factors from the Pedersen commitments to the receiver? If not, how can he verify the actual amounts?

The network verifies the sum of commitments, and with that it is indirectly verified that sum(inputs) == sum(outputs). The recipient is the only one who can actually see the amount in his output, as he will know the shared secret which is used to decode the amount.

(3) Are the commitments to 0 or to zG as suggested in the paper mentioned? I didn't quite get the need for the latter, but I'm probably missing something

I think the links above answer this as well.

Is there more updated documentation of the current protocol available?

I don't think there is. There's the RCT paper (with ASNL) and the Borromean fix is documented here.

Improve this answer
4

Indeed the protocol uses Borromean signatures for range proofs.

A RingCT signature contains all the info allowing everyone to check the validity of the amounts, and allowing the recipient to recover the real amounts (Pedersen commitments, the masks for amounts, etc).

I found the following article useful to understand how RingCT works: Confidential Transactions from Basic Principles

Improve this answer
1
  • Thanks for the link. As I read it now, the blinding factors should be sent privately to the receiver for verification of the actual amounts. Do the commitments have to sum up to zG? Is it really needed? Also, whatś the added value of signing on top with MLSAG?
    – Kurt
    Nov 1, 2017 at 18:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.