1

I'm reading the Confidential Transactions paper, and it says that the blinding factor in the pedersen commitment is derived using a shared secret, but I can't understand what's preventing the sender from cheating a bit.

The sender generates a ephemeral private key, and derives the secret as (ephemeral private key * receivers public key), and is supposed to pack the ephemeral public key in the transaction, so that the receiver can derive the shared secret (receivers private key * ephemeral public key) and get the blinding factor and derive transaction amount.

What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount.

The sender might be up to mischief, or claim that he sent a transaction (and show the transaction ID as proof), and claim that the receiver (maybe an exchange) is not depositing the right amount.

Improve this question

1 Answer 1

Reset to default
1

What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount.

The fact that the receiver wouldn't treat the result as a valid payment.

This is no different from them sending the right amount to the wrong address.

Improve this answer
3
  • I see. Is there any way the receiver could prove that the sender messed up? In the case of sending to the wrong address, it's fairly easy to demonstrate the address was different, but I'm wondering if the receiver can trivially prove that the payment was invalid? (Because the transaction will "look" valid to the blockchain)
    – PowerPanda
    Feb 10, 2018 at 0:17
  • Actually, never mind. I realized the sender can prove he did the right thing by disclosing his ephemeral private key. Thanks for taking the time!
    – PowerPanda
    Feb 10, 2018 at 0:45
  • Well none of this is a transferable proof. You can't prove to someone else that you don't own a particular key. It's up to the other party to prove that it is (for example by requiring you to sign the address with a well-known identity key).
    – Pieter Wuille
    Feb 10, 2018 at 2:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.