GRIN Papyrus - a collection of important GRIN documents since Day-0

[tromp]

@mcm-mike

• IRC logs from 02.Aug.2016; the first appearance of Tom who submitted the first MW documents

Regarding the remark

Later, Shen Noether combined the two approaches to obtain “confidential transactions” of Maxwell AND the darkening of van Saberhagen [4].

from mimblewimble.txt, note that where Maxwell wanted the transaction excess to be an unblinded zero:

If the author of a transaction takes care in picking their blinding factors so that they add up correctly

Noether required it to not to be:

This is undesirable, since it removes the anonymity provided by the ring signatures.

And it’s easy to see how Jedusor was inspired by Noether’s

Thus, the above summation becomes a commitment to 0, with sk =
z, and pk = zG, rather than an actual equation summing to zero.

In Monero’s RingCT, the recipient blinding factor and hence this excess, is determined by the sender, while use of Diffie-Helmann allows for secure sharing with the receiver.

Jedusor’s insight was to instead let the receiver pick their own blinding factor, making the excess a 2-of-2 multiparty key shared by sender and receiver.

[4] https://eprint.iacr.org/2015/1098.pdf Shen Noether, Ring Confidential Transactions