2
In the paper about Confidential Transaction, it is said that the blinding factor for the range proof can be deduced with the shared secret using HMAC. But i didn't understand how the receiver can find the 'main' blinding factor, the one which is linked to the output commitment. I assumed he would do it using the same method as for the blinding factor of the range proof but i am not sure. Can someone explain ?
2
There are many ways an implementation could do this.
For example, the blinding factor of the output could just be set to a hash of a shared secret.
But this has a complication that there is normally one fewer degree of freedom than there are outputs because the blinding factors must sum to zero. Due to this it's not possible for all outputs to just have their blinding factors be set as the result of a shared secret.
The obvious answer would be to just include an encryption of the relevant blinding factor. However, in my implementation the randomness in the proof can be used to form an encrypted communication channel, so the blinding factor (and value out the output) can just be communicated via that.
Another alternative would be to include a dummy output with a range of 0 (which is very efficient to prove).
