Based on Maxwell's proposal of confidential transaction, a ring signature can solve the range proof issue. I can totally follow the pedersen commitment and everything. I don't quite get how ring signature helps in range proofs? Like we wanna know if the Bitcoin amount is not negative and we don't want to reveal it. The connection between ring signature and range proof doesn't click for me.

1 Answer 1


After a lot of research and reading couple of different documents I found the answer to my own question and thought it would be good to share it with other people in the community.
Pedersen commitment on amount a and blinding factor x is:

C(a) = x*G + a*H

Where G is generator point on Elliptic curve and H is another static point that everyone has agreed on. (It is actually a map of Hash of G on curve).
In order to prove that the amount is within a specific range without revealing the amount, CT uses ring signature.
Lets say Alice wants to prove to Bob that her transaction amount is within the range [0,y]. If Bob calculates:

C' = C(1) - 1*H

It would be equal to:


If Alice can make a signature with x as a private key (using ECDSA for example) then she can verify that she knows x thus the amount is actually 1.
In Confidential transaction however Alice doesn't want to reveal the amount so instead lets say if she does this operation for all amounts like:

C" = c(2) - 2*H

and etc for all the amounts till y. Then if Alice makes a ring signature for all these amounts then she is basically saying my amount is one of the amounts in the whole range without revealing it. Ring signature is a signature that shows one of the inputs is a signing it without revealing who.
That basically results in the range proof and alice successfully can prove that to Bob through this way without revealing the amount.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.