Sending confidential transaction amount to the receiver

Question

In confidential transaction proposed by Maxwell, instead of transaction amounts we use pedersen commitments to hide the amount and add the range proof to the transaction to prevent overflow. A simple commitment with one input and one output C1 and C2 is as follow: (Ignore the fee for simplicity)

C1 = C2 => BF1*G + a*H = BF2*G + a*H 

where in this example BF1 = BF2 obviously since it only has one input and output.
How does the sender send the amount and blinding factor to the receiver? Receiver can check if the amount is correct! I noticed Maxwell said they use ECDH. I assume there is no additional communication channel for ECDH. Then how does the sender get receivers public key? and does sender need to reveal both blinding factor and amount in the ECDH?

Answer 1

In Elements Alpha, output "amounts" consist of 3 pieces of data:

• The Petersen commitment to the value, blinded by the blinding factor.
• The range proof, which can publicly prove that the value is within range [0..2^32-1] units (satoshis) without revealing anything about the blinding factor.
• An ECDH ephemeral public key of the sender.

The latter is where the solution lies. Every confidential transactions address contains an ECDH public key of the receiver (the blinding key), in addition to normal P2PKH or P2SH data.

When a CT transaction is sent, the sender chooses an ECDH ephemeral private key, and combines it with the blinding key to derive a blinding seed. This seed is used as a basis for the random number generator to create the range proof. The public version of the ephemeral key is then written in the 3rd field of the amount.

When the receiver sees this ECDH ephemeral public key, he combines it with his private blinding key, to derive the same seed as the sender used. Using this same seed, he can "unwind" the range proof, and decode the secret information that was used when creating it: the value and the blinding factor. There is in fact space for another 2 kilobytes of data in the range proof, only visible to the receiver (or anyone holding the private blinding key).