1

Refer to ZtM2 chp3.5, we can see that in step 5

rπ = α − cπ * kπ (mod l)

It's fine for public-key-ring part because there is private key kπ.
But what if it is commitment-ring? How to do with no kπ?

Please help to answer it. Thanks!

Mooooo
  • 459
  • 2
  • 8
  • 1
    It's the commitment to zero z_j, from section 6.2.2 – koe Jun 23 '20 at 15:47
  • 1
    Yeah, the commitment has three components (plus the message and key prefixing) c_pi = H(m, (K_pi), [alpha_k G], [alpha_k H_p(K_pi)], (C_pi - C'_pi), [alpha_z G]). r_k_pi = alpha_k - c_pi*k_pi and r_z = alpha_z - c_pi*z. You can find discussion of the commitment to zero in section 5.4 – koe Jun 23 '20 at 16:55
  • 1
    Thanks a lot @koe!! Your point is right. BTW, I think c_pi is called challenge not commitment. :) – Mooooo Jun 25 '20 at 08:46
  • ah yes my mistake – koe Jun 25 '20 at 14:45
  • 1
    @Mooooo I'm not quite sure why you keep referring to this as a "commitment-ring"? The ring being signed is a ring of keys, not commitments. Even the commitment to zero is really just another key. Anyway, looks like you've found what you were after. – jtgrassie Jun 26 '20 at 02:32
  • 1
    @jtgrassie MLSAG is a bit like two knotted bracelets glued together and tied at the same point, so in that sense one bracelet is the set of one-time address keys, and the other bracelet is the corresponding set of commitment to zero keys. I believe Mooooo is using 'ring' loosely to mean what I mean by bracelet. The entire set of keys is technically the 'ring', and there is no technical term for the ring's layers. – koe Jun 26 '20 at 19:37
  • 1
    @koe I'm just glad you could decipher the question! As far as I'm concerned, they're all just keys being signed; not separate "layers" or "commitment-rings" or "bracelets" ;) – jtgrassie Jun 26 '20 at 22:31
  • @jtgrassie Thank you for the reminder! I know it should not be called "commitment-ring". I used it in that way just because not knowing how to call them lol. Anyway, thank you jtgrassie and koe for answering this question! – Mooooo Jun 28 '20 at 07:23

1 Answers1

2

#Thanks for the reminder from @Koe.

Refer to ZtM2 chp 5.4...
The kπ here for "commitment-ring" should be xj-xj'
So that the challenge is

cπ+1 = Hn(m, Kπ, [α1G], [α1*Hp(K)], commitment_to_zero, [α2G])

Where commitment_to_zero can be derived fromxj-xj'.

Mooooo
  • 459
  • 2
  • 8