Sending confidential transaction amount to the receiver

3

1

In confidential transaction proposed by Maxwell, instead of transaction amounts we use pedersen commitments to hide the amount and add the range proof to the transaction to prevent overflow. A simple commitment with one input and one output C1 and C2 is as follow: (Ignore the fee for simplicity)

C1 = C2 => BF1*G + a*H = BF2*G + a*H

where in this example BF1 = BF2 obviously since it only has one input and output.
How does the sender send the amount and blinding factor to the receiver? Receiver can check if the amount is correct! I noticed Maxwell said they use ECDH. I assume there is no additional communication channel for ECDH. Then how does the sender get receivers public key? and does sender need to reveal both blinding factor and amount in the ECDH?

abeikverdi

Posted 2016-08-16T06:13:05.963

Reputation: 784

Answers

4

In Elements Alpha, output "amounts" consist of 3 pieces of data:

  • The Petersen commitment to the value, blinded by the blinding factor.
  • The range proof, which can publicly prove that the value is within range [0..2^32-1] units (satoshis) without revealing anything about the blinding factor.
  • An ECDH ephemeral public key of the sender.

The latter is where the solution lies. Every confidential transactions address contains an ECDH public key of the receiver (the blinding key), in addition to normal P2PKH or P2SH data.

When a CT transaction is sent, the sender chooses an ECDH ephemeral private key, and combines it with the blinding key to derive a blinding seed. This seed is used as a basis for the random number generator to create the range proof. The public version of the ephemeral key is then written in the 3rd field of the amount.

When the receiver sees this ECDH ephemeral public key, he combines it with his private blinding key, to derive the same seed as the sender used. Using this same seed, he can "unwind" the range proof, and decode the secret information that was used when creating it: the value and the blinding factor. There is in fact space for another 2 kilobytes of data in the range proof, only visible to the receiver (or anyone holding the private blinding key).

Pieter Wuille

Posted 2016-08-16T06:13:05.963

Reputation: 54 032

By the random number for creating range proof you are referring to the commitment's blinding factor? Blinding factor in the ring signature proves the range proof as far as i know. If so then the blinding factor is generated from the seed? May I know what the seed is exactly? – abeikverdi – 2016-08-19T05:03:06.003

If the range proof only covers values up to 2^32-1 does that mean you can't send more than ~42.9… bitcoins with CT? – Murch – 2016-08-19T06:57:56.243

@abeikverdi No, the seed value is not the blinding factor. It is the base for the randomness that goes into the ring signatures inside the range proofs. By making the randomness deterministic, the receive can "undo" the range proof by knowing what randomness goes into it. – Pieter Wuille – 2016-08-19T08:31:45.253

1@Murch The range can actually be chosen to be anything between 2 and 64 bits of randomness, but that range is public. So you can use a larger range, but that gives an indication you're transacting more. Of course, you can always use larger ranges even when transacting small values, but this increases the price. – Pieter Wuille – 2016-08-19T08:33:20.470

Asked: 2016-08-16T06:13:05.963

Viewed: 227 times

Active: 2019-10-14T15:36:23.943