How does Ring Confidential Transactions work?

Question

Can someone explain to me how RingCT works and how the recipient gets the actual amount from the encrypted amount in a RingCT transaction?

Answer 1

All outputs on the Monero blockchain have encrypted amounts, with the exception of outputs created in a 'coinbase' transaction. A coinbase transaction is a transaction that creates new Monero out of thin air according to Monero's emission schedule. Here is an example coinbase transaction: https://xmrchain.net/tx/c0b6b35c1a9c580aaa5ba04db6477cb255b33abb6492f9b5d6e02d7768aefcee

The amount of each output is encrypted and written into the transaction in two different ways. Once, as part of the 'ecdhInfo' in a way that allows only the recipient to decode the actual value, and a second time as a 'Pedersen commitment'.

Only the recipient of an output is able to decode the actual amount. This amount is encrypted by the sender using the transaction shared secret, and is transmitted to the recipient in the 'ecdhInfo' section of the transaction. The transaction shared secret is computed by combining the recipient's private view key with the transaction public key (the latter is transmitted as part of the transaction).

Third party observers will not be able to decrypt that amount, and will need to use the Pedersen commitments to verify that other than the allowed creation of new Monero as part of the emission schedule, no Monero has been created out of thin air.

RingCT achieves this by doing two things:

1. Proving that all of a transaction's outputs are greater than zero. This prevents the sender from starting with 1 XMR, and then creating two outputs where one has a value of -99 XMR and the other has a value of 100 XMR. This is achieved with a 'range proof'. A range proof proves that the encrypted amount must have been created out of the addition of a series of positive powers of 2, without disclosing what the actual powers of 2 are. For more information, see https://people.xiph.org/~greg/confidential_values.txt

2. As you probably know, there are real inputs and fake inputs referenced in each transaction. No third party can tell which are real and which are fake. RingCT proves that in at least one combination of the possible inputs and the outputs, that Pedersen commitments of the inputs - Pedersen commitment of the transaction fee - Pedersen commitments of the outputs = a zero Perdersen commitment.

   This is possible because input and output amounts are encrypted using 'homomorphic' Pedersen commitments, meaning that although you can't tell the values, you can verify that they sum to zero. Proving that they sum to zero is achieved by proving that you know the private key of the 'zero' Pedersen commitment for at least one of the combinations of possible inputs and outputs.

   Therefore, for a transaction of ring size 5, as an outside observer you'll come up with 5 different possible 'zero Pedersen commitments', where only one of those possibilities really will be a commitment to zero. Since the Pedersen commitments are all technically public keys, and since the sender of the transaction needs to prove that they know the private key for at least one of those combinations (thus proving one of the combinations really does sum to zero), this is an ideal task for a ring signature. This is because ring signatures are a device to prove that out of a set of public keys, you know the private key for at least one of them.

   The full math is here: https://lab.getmonero.org/pubs/MRL-0005.pdf

To sum up, RingCT is a mechanism that allows an outside observer to check that in at least one combination of inputs and outputs, no Monero has been created out of thin air. This mechanism is impossible to cheat.