1

I'm reading the Confidential Transactions paper, and it says that the blinding factor in the pedersen commitment is derived using a shared secret, but I can't understand what's preventing the sender from cheating a bit.

The sender generates a ephemeral private key, and derives the secret as (ephemeral private key * receivers public key), and is supposed to pack the ephemeral public key in the transaction, so that the receiver can derive the shared secret (receivers private key * ephemeral public key) and get the blinding factor and derive transaction amount.

What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount.

The sender might be up to mischief, or claim that he sent a transaction (and show the transaction ID as proof), and claim that the receiver (maybe an exchange) is not depositing the right amount.

1

What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount.

The fact that the receiver wouldn't treat the result as a valid payment.

This is no different from them sending the right amount to the wrong address.

  • I see. Is there any way the receiver could prove that the sender messed up? In the case of sending to the wrong address, it's fairly easy to demonstrate the address was different, but I'm wondering if the receiver can trivially prove that the payment was invalid? (Because the transaction will "look" valid to the blockchain) – PowerPanda Feb 10 '18 at 0:17
  • Actually, never mind. I realized the sender can prove he did the right thing by disclosing his ephemeral private key. Thanks for taking the time! – PowerPanda Feb 10 '18 at 0:45
  • Well none of this is a transferable proof. You can't prove to someone else that you don't own a particular key. It's up to the other party to prove that it is (for example by requiring you to sign the address with a well-known identity key). – Pieter Wuille Feb 10 '18 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.