From the confidential transactions article:
C' = C - 1H
Then I provide a ring signature over{C, C’}
.If C was a commitment to 1 then I do not know its discrete log, but C’ becomes a commitment to 0 and I do know its discrete log (just the blinding factor). If C was a commitment to 0 I know its discrete log, and I don’t for C’. If it was a commitment to any other amount, none of the result will be zero and I won’t be able to sign.
What if C and C' are commitments to 0 and -1? Then if I can sign, that means the ring signature is a proof is over {0,-1}
. I'm probably missing something, so please tell me, why can't the amount be -1 in this proof?