6

In Confidential Transactions (as used in Blockstream's Elements and Liquid), there are still identifiable UTXOs. The only change is that instead of the amount, a homomorphic commitment to the amount is stored. While not technically correct, you could see it as a form of encryption that is compatible with addition and subtraction. So if a+b=c+d then E(a)+E(b)...


4

When we're talking about an amount like 133.7 BTC, we're actually talking about 13370000000 satoshis (13.37 billion units). If you're using 32-bit rangeproofs in Confidential Transactions, you're limited to a range of 1 through 2^32-1 satoshi (42.94967295 BTC). To use a number as large as 133.7 BTC, you would need 34 bits at least (making the proofs larger ...


4

Pretty good actually as it has become a lot easier after SegWit allowed for new script opcodes through soft forks. It might still be a few years out, as there are other priorities, but Gregory Maxwell is pretty active on CT.


3

Zerocoin is a proposed extension on Bitcoin to make Bitcoin more private. Zerocoin only hides the origin of a payment, the destination and amounts are still public. Zerocash is a further extension of the zerocoin protocol which hides the destination and amounts. Zerocash transactions are more compact than zerocoin transactions. Zcash is an implementation ...


3

In Elements Alpha, output "amounts" consist of 3 pieces of data: The Petersen commitment to the value, blinded by the blinding factor. The range proof, which can publicly prove that the value is within range [0..2^32-1] units (satoshis) without revealing anything about the blinding factor. An ECDH ephemeral public key of the sender. The latter is where the ...


2

After a lot of research and reading couple of different documents I found the answer to my own question and thought it would be good to share it with other people in the community. Pedersen commitment on amount a and blinding factor x is: C(a) = x*G + a*H Where G is generator point on Elliptic curve and H is another static point that everyone has agreed ...


2

This is not a question anyone can answer. If you'd asked me 2 years ago what the chances of raising the block size in the future were, I'd probably have said that they were pretty good. I think we can all definitely agree that CT is unlikely to be merged into Bitcoin Core itself any time soon, if at all, as it would require major wallet changes across the ...


2

The term is used specifically in Monero's ring signature based spending scheme. Monero transactions do not exactly specify which previous outputs are being spent. Instead, a list of alternative inputs is provided (consisting of the real one, and a number of chaff coins). A ring signature is then used to prove authority to spend from the real one, without ...


2

There are many ways an implementation could do this. For example, the blinding factor of the output could just be set to a hash of a shared secret. But this has a complication that there is normally one fewer degree of freedom than there are outputs because the blinding factors must sum to zero. Due to this it's not possible for all outputs to just have ...


2

If you're talking about the bulletproofs research or the bulletproofs topic, use "is". If you're talking about the individual proofs, use "are". Bulletproofs is shaping the future. Bulletproofs is an important protocol. Bulletproofs are short and don't require trusted setup. Bulletproofs are going to replace the usual signatures. Bulletproofs is going to ...


2

Short answer: yes. However that depends on the question if liquid supports segwit and creation of a lightning network. I have not looked at the details of liquid but I believe it does. The lightning network protocol itself is pretty agnostic to the underlaying blockchain. If you look at the channel announcement messages defined in BOLT7 you will see that ...


1

A lot of these terms end up being confusing and a little non descriptive. In the "elements project" nomenclature a confidential address is an encoding of a P2PKH key which includes the necessary information to make a confidential transaction, one which uses range proofs to blind the monetary units. There's nothing confidential about the address itself, it's ...


1

What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount. The fact that the receiver wouldn't treat the result as a valid payment. This is no different from them sending the right ...


1

The blinding key is a shared secret among the receiver and the sender. Typically the Diffie-Hellman key exchange is intiated by the sender ECDH, given that he already has knowledge of the receivers public key in a secure manner. The blinding key itself is not public knowledge, but the sender includes a one-time/temporary/ephemeral public key along with the ...


1

What if C and C' are commitments to 0 and -1? Then if I can sign, that means the ring signature is a proof is over {0,-1}. To create a signature, the public key must be a known multiple of G. That multiple is known as the private key. When a point has a nonzero H term in it, no signature with that point as public key can be created. In order to write rG+vH ...


1

If the network doesn't know transaction amounts, how can it verify a transaction? That's exactly what Pedersen commitments allow you to do. Each of the outputs contains a commitment P(v,r) = vH + rG, where v is the value and r is the blinding factr. The network does not know v or r, but does know P(v,r) (and H and G, which are constant). Pedersen ...


1

Only the overall commitment (P) is revealed. G and H are constants known to everyone. x (the blinding factor) and a (the value) are secret. if xG is a private value the CT paper tell: can be proven to be a commitment to a zero by just signing a hash of the commitment with the commitment as the public or if if you want to prove a=1 make C' = C - 1H and ...


1

Is it possible to create a CT transaction, where the inputs reference UTXOs that are not confidential (just as in Bitcoin now), but creating new outputs that are hiding the value using CT's scheme? Yes, you include a dummy blinding factor. What would the network have to do to check that the sum of commitments in the outputs are the same as the sum of ...


Only top voted, non community-wiki answers of a minimum length are eligible