I was reading about Confidential Transactions (CT) and understand the basic idea behind it. But what if CT must be bootstrapped on an existing Blockchain such as in Bitcoin, where the amounts are for now visible in the outputs?
Is it possible to create a CT transaction, where the inputs reference UTXOs that are not confidential (just as in Bitcoin now), but creating new outputs that are hiding the value using CT's scheme?
What would the network have to do to check that the sum of commitments in the outputs are the same as the sum of clear-text amounts from the inputs?
//Edit: I found some help from the mailing list describing how CT can be implemented as a Soft Fork to Bitcoin: https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2016-January/012194.html
But I am still not sure how the network can make sure that the confidential transaction outputs from "blinding transactions" sum up to the amount that is being stored into the GCTXO.
Similarly when "unblinding", how can the network be sure that the sum of commitments from the confidential inputs is the same as the amount that is being spent from the GCTXO?
//edit2: The only way I can think of is that the blinding tx also contains a proof using the sum of commitments in the outputs. That sum of commitments corresponds to a value equal to the amounts from the inputs (minus the tx-fee).
More precisely, a CT commitment looks like
H being generating points,
x a secret key and
a being the amount locked with the output. For a proof we sum all commitments from the outputs:
C=xG+aH + yG+bH + ... + zG+cH = (x+y+...+z)G + (a+b+...+c)H. A proof can then be provided by subtracting
C and signing it with the corresponding secret key:
(a+b+...+c) is exactly the amount from the inputs (minus tx fee), and a signature is provided from the public key
(x+y+...+z) is the private key.
But from reading the specification I cannot see where such a proof/signature would be provided with the blinding transaction?