#Thanks for the reminder from @Koe.
Refer to ZtM2 chp 5.4...
The kπ here for "commitment-ring" should be xj-xj'
So that the challenge is
cπ+1 = Hn(m, Kπ, [α1G], [α1*Hp(K)], commitment_to_zero, [α2G])
Where commitment_to_zero can be derived fromxj-xj'.
S1 sends fund to R1 using a stealth addresses.
"stealth address" is an unfortunate moniker. When a user sends funds to another users address, they create new, special, outputs that the receiver now owns and only the receiver can spend; the receivers address never gets stored on the blockchain, only these newly generated outputs, which have no ...
Here is the answer and it works well.
The key point is that commitments should be subtracted by pseudoOuts first.
def MLSAG_Ver(msg, pk, n, m, m1, I, c0, s):
c = c0
i = 0
while i < n:
tohash = msg
j = 0
while j < m:
if j == 1:
pk[j][i] = MiniNero.subKeys(pk[j][i], pseu)
Referencing section 7.3.6 of ZtM2, coinbase outputs (with amount a) are given a placeholder output commitment C = 1*G + a*H, and that is stored in local copies of the blockchain (each person who downloads the chain has to compute those commitments for each coinbase output). The placeholder commitment is treated like a normal commitment when coinbase outputs ...