20

Can someone explain simply how RingCT can make sure that a user has the specified amounts without seeing it? My mind starts to pause as soon as i see formulas on a whitepaper.

JollyMort
  • 19,934
  • 3
  • 46
  • 105

1 Answers1

18

Basic idea can be explained by simple arithmetics. Now, we're checking that sum of all inputs must be equal to sum of all outputs. For example:

1+2+3+4 = 3+5+2

Literally, "what comes in must come out", and that's how we assert no coins were created or destroyed in the transaction. And you can see the amounts. If you multiply everything by some random number A, you get the below:

(1A) + (2A) + (3A) + (4A) = (3A) + (5A) + (2*A). which can be written as:

A * ( 1+2+3+4) = A * (3 + 5 + 2), so we can be sure that 1+2+3+4 = 3+5+2 still holds true.

Trick is, with ringCT, only the sender and receiver know the value of A. All the rest see only the already multiplied values (2A), (3A)... so they can check that there's no cheating, but they don't know A, so they can't tell the exact amounts involved. Of course, it's not implemented exactly as above, but I think you can get the idea.

JollyMort
  • 19,934
  • 3
  • 46
  • 105
  • 1
    If RingCT does not use coefficients, then what does it use? Is there a noticeable difference in average reported amount of a transaction of 10 XMR and 10000 XMR? – sgp Aug 09 '16 at 19:17
  • 1
    I think it's a hash function with the same property, i.e., f(a)+f(b) = a+b. It's descriped in MRL paper. I plan to research it a bit and can update the answer if it will be clear to me – JollyMort Aug 11 '16 at 08:03
  • 1
    correction: f(a)+f(b)=f(a+b) – JollyMort Sep 12 '16 at 17:44
  • @Jolly Mort: I think you mean f(a)+f(b) = f(a+b)? – user3858678 Sep 12 '16 at 15:45
  • 2
    Great explanation. But if only sender and receiver know value of A, how can the network validate that some next transaction using coins from this transactions doesnt create new coins? If I receive coins in this transaction and then I send to someone coins in another. Lets say in reality A was 100 but I will pretend that it was 10 and instead all coins were 10x more. How can network validate that I am lying? – urza.cc Dec 04 '16 at 22:37
  • 1
    Every transaction originates from an output of a known amount, ie the money was created somewhere first and amount hidden in the next and every subsequent transaction. It could be an old output found on the network, or a coinbase transaction. Later, all we have to prove is the commitment - that it's the same A on both sides of the equation, without having to reveal it. This is still ELI5 zone, and I don't yet know to explain it further. – JollyMort Dec 04 '16 at 22:46
  • @urza.cc typically a zero knowledge proof begins as an interative process algorithm where the prover is given a challenge puzzle and can only tractably (as in probability of cheating is intractable) answer correctly if thing being proved is mathematically true. This is then turned into a non-interactive protocol with the Fiat-Shamir transformation employing the irreversibility of a hash function. I could explain it better in a longer document than can fit in a comment. – Shelby Moore III Aug 01 '17 at 11:59
  • Hi and welcome to Monero StackExchange. If you could frame it as a Q&A in the context of Monero RCT, please be encouraged to post it and answer your own question! – JollyMort Aug 01 '17 at 14:32