Confidential Transactions

https://people.xiph.org/~greg/confidential_values.txt

by jc123 • 11 years ago

56 7 11 years ago

people.xiph.org

maxerickson• 11 years ago

This is related to:

https://news.ycombinator.com/item?id=9684066

deckar012• 11 years ago

A commitment scheme lets you keep a piece of data secret but commit to it so that you can not change it later.
commitment = SHA256( binding_factor || data )
Tell someone the commitment, then [later] reveal both the data and blinding factor.

It looks like I can change my data, then generate a binding factor that will combine to produce the original hash input.

throwaway7767• 11 years ago

> A commitment scheme lets you keep a piece of data secret but commit to it so that you can not change it later. > commitment = SHA256( binding_factor || data ) > Tell someone the commitment, then [later] reveal both the data and blinding factor.
It looks like I can change my data, then generate a binding factor that will combine to produce the original hash input.

If you can find SHA256 collisions on demand. But if you can do that, you should probably be writing a paper about it and advancing the state of the art.

deckar012• 11 years ago

Assume for a moment that no hashing is performed.

I compute C = B || D.

I reveal C.

I later choose new data D'.

I compute C = B' || D'.

I reveal B' and D'.

Since both B and D were secret, B' and D' are accepted.

Secretly masking data lends to malleability. (EDIT: Not a mask)

EDIT: As CJefferson points out the operation is not a mask, but concatenation of a fixed length random value which invalidates this example. Exploiting this secrecy would require a weakness in SHA256 that allows input prefixes to produce colliding hash states (hard).

TheLoneWolfling• 11 years ago

Only if you can break SHA. But still, good point.

benoitbenoit• 11 years ago

Related, this was just published today: http://voxelsoft.com/dev/sumcoin.pdf

Confidential Transactions

Related Stories