I have read Mimblewimble paper.

Certainly, Transaction merging process is non-interactive.
However, Transaction creation process seems to be not non-interactive.
To create transaction, a sender must interact a receiver because a sender shouldn't know all output's blinding factor(except change). If a sender knows output's blinding factor, he can spend output.

Is my understanding of this correct?

up vote 5 down vote accepted

It is possible to create MW transactions interactively, and if you're creating multisignature outputs I think this is actually necessary. But ordinary transactions can be created non-interactively (well, with half a round of interaction, as in Bitcoin where one party sends an address to another party who builds a transaction) in two ways:

Suppose the sender is trying to send 5BTC to the receiver.

  1. The sender can create a transaction that doesn't balance unless a 5BTC output is added. Aside from this discrepancy the transaction is valid; she sends this to the recipient. The recipient then adds a 5BTC output, adds another kernel to the transaction so that the blinding factors still add up, and the transaction is complete.
  2. The sender acts as above, but sends the opening of the kernel. This is a bit dangerous because it gives the sender the ability to reverse the transaction long after the fact, but I'm unsure what sort of attack this would enable.

Note that both cases require a secure channel from the sender to the receiver because anyone who gets the incomplete transaction could add their own 5BTC output to it.

It's also possible to do this in reverse: the recipient sends the sender an incomplete transaction that needs a 5 BTC input to balance, and the same considerations apply.

  • Does the kernel means excess value? and What is opening? – chikyukotei Feb 3 '17 at 6:32
  • 1
    Kernel is the more generic term for excess value. Opening means being able to spend. – Pieter Wuille Feb 4 '17 at 5:04
  • Could some form of DH be used for the secure channel and passive receiving? Like, I publish some pubkey (A=a*G) of mine, you generate some random one-time private key (R=r*G), and publish the (R, H(r*A), unbalanced transaction encrypted with H(r*A)) to the blockchain. I can claim this TX at any time (unless you double-spend?), after which it could be purged from the blockchain. – JollyMort Oct 14 '17 at 17:38

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.