I've some doubt about Greg Maxwell Confidential transaction and hope someone can help to make it clear. A commitment using Elliptic Curve math is:
P=xG + aH
where G,H are public value and x,a are private.
My questions are:
xGis public or private value?
xGis a public value why an attacker cannot simply make a brute force attack trying all possible value of
achecking for the equality with the P value?
xGis a private value the CT paper tell:
can be proven to be a commitment to a zero by just signing a hash of the commitment with the commitment as the publicor if if you want to prove
C' = C - 1Hand then sign the hash of
C'. How signing
C'can I prove the value and also how can I verify a sign if I dont know