Return to Answer

Alice sends an amount $a$ to Bob, but does not declare the amount $a$ transparently on the blockchain.

Instead, she declares the Pedersen Commitment $A=aG+a'H$ as part of the transaction that appears on the blockchain. $a'$ is a uniformly random blinding factor, and $G$ and $H$ are well-known generator points chosen such that the EC discrete log $G/H$ is unknown. Alice additionally encrypts $a'$ as part of the transaction such that only Bob can decrypt it with his private key.

Now, Bob wants to spend $a$, splitting it up so that the amount $b$ goes to Carol, and the amount $c$ is returned to him as change.

Bob declares the Pedersen commitments $B=bG+b'H$ and $C=cG+c'H$, and includes them in the transaction.

Now, Bob has to prove that he has not created any currency out of thin air. He needs to prove that the three commitments $A, B, C$ commit to amounts $a,b,c$ such that $a=b+c$.

He does his by providing a signature on the value $C-A-B$ on the generator point $H$. He can do this since he was sent the blinding factor $a'$ by Alice, and he knows the blinding factors $b'$ and $c'$ because he has just chosen them.

A signature for $C-A-B$ on the generator point $H$ proves that the value $x$ is known such that $xH=C-A-B$.

Bob knows $x$, since $x = c'-a'-b'$.

The signature on the generator point $H$ is only possible if all the $G$ values cancel each other out. For example. If $C-A-B=3G+xH$, then $x=c'-a'-b'+3(G/H)$. But, since the discrete log $G/H$ is unknown, Bob cannot know $x$ when the commitment amounts do not cancel out the $G$ component.

Therefore, the signature is evidence that no amount was created out of thin air. The amount spent must perfectly match the sum of the amounts received.

Alice sends an amount $a$ to Bob, but does not declare the amount $a$ transparently on the blockchain.

Instead, she declares the Pedersen commitment $A=aG+a'H$ as part of the transaction that appears on the blockchain. $a'$ is a uniformly random blinding factor, and $G$ and $H$ are well-known generator points chosen such that the EC discrete log $G/H$ is unknown. Alice additionally encrypts $a'$ as part of the transaction such that only Bob can decrypt it with his private key.

Now, Bob wants to spend $a$, splitting it up so that the amount $b$ goes to Carol, and the amount $c$ is returned to him as change.

Bob declares the Pedersen commitments $B=bG+b'H$ and $C=cG+c'H$, and includes them in the transaction.

Now, Bob has to prove that he has not created any currency out of thin air. He needs to prove that the three commitments $A, B, C$ commit to amounts $a,b,c$ such that $a=b+c$.

He does his by providing a signature on the value $C-A-B$ on the generator point $H$. He can do this since he was sent the blinding factor $a'$ by Alice, and he knows the blinding factors $b'$ and $c'$ because he has just chosen them.

A signature for $C-A-B$ on the generator point $H$ proves that the value $x$ is known such that $xH=C-A-B$.

Bob knows $x$, since $x = c'-a'-b'$.

The signature on the generator point $H$ is only possible if all the $G$ values cancel each other out. For example. If $C-A-B=3G+xH$, then $x=c'-a'-b'+3(G/H)$. But, since the discrete log $G/H$ is unknown, Bob cannot know $x$ when the commitment amounts do not cancel out the $G$ component.

Therefore, the signature is evidence that no amount was created out of thin air. The amount spent must perfectly match the sum of the amounts received.

Note that due to the cyclical nature of group elements (generator points), Bob could spend the amount $a=3$ such that $b=\ell-1000$ and c=$1003$, where $\ell$ is the size of the group. This would mean that $a-b-c \operatorname{mod} \ell = 0$, and Bob has created the amount 1000 out of thin air. This is why you additionally need to provide a range proof for each Pedersen commitment declared in a transaction, demonstrating that amounts must be in a small range such that they can never sum to an amount that equals or exceeds $\ell$.

Alice sends an amount $a$ to Bob, but does not declare the amount $a$ transparently on the blockchain.

Instead, she declares the Pedersen Commitment $A=aG+a'H$ as part of the transaction that appears on the blockchain. $a'$ is a uniformly random blinding factor, and $G$ and $H$ are well-known generator points chosen such that the EC discrete log $G/H$ is unknown. Alice additionally encrypts $a'$ as part of the transaction such that only Bob can decrypt it with his private key.

Now, Bob wants to spend $a$, splitting it up so that the amount $b$ goes to Carol, and the amount $c$ is returned to him as change.

Bob declares the Pedersen commitments $B=bG+b'H$ and $C=cG+c'H$, and includes them in the transaction.

Now, Bob has to prove that he has not created any currency out of thin air. He needs to prove that the three commitments $A, B, C$ commit to amounts $a,b,c$ such that $a=b+c$.

He does his by providing a signature on the value $C-A-B$ on the generator point $H$. He can do this since he was sent the blinding factor $a'$ by Alice, and he knows the blinding factors $b'$ and $c'$ because he has just chosen them.

A signature for $C-A-B$ on the generator point $H$ proves that the value $x$ is known such that $xH=C-A-B$.

Bob knows $x$, since $x = c'-b'-a'$.

The signature on the generator point $H$ is only possible if all the $G$ values cancel each other out. For example. If $C-A-B=3G+xH$, then $x=c'-b'-a'+3(G/H)$. But, since the discrete log $G/H$ is unknown, Bob cannot know $x$ when the commitment amounts do not cancel out the $G$ component.

Therefore, the signature is evidence that no amount was created out of thin air.

Alice sends an amount $a$ to Bob, but does not declare the amount $a$ transparently on the blockchain.

Instead, she declares the Pedersen Commitment $A=aG+a'H$ as part of the transaction that appears on the blockchain. $a'$ is a uniformly random blinding factor, and $G$ and $H$ are well-known generator points chosen such that the EC discrete log $G/H$ is unknown. Alice additionally encrypts $a'$ as part of the transaction such that only Bob can decrypt it with his private key.

Now, Bob wants to spend $a$, splitting it up so that the amount $b$ goes to Carol, and the amount $c$ is returned to him as change.

Bob declares the Pedersen commitments $B=bG+b'H$ and $C=cG+c'H$, and includes them in the transaction.

Now, Bob has to prove that he has not created any currency out of thin air. He needs to prove that the three commitments $A, B, C$ commit to amounts $a,b,c$ such that $a=b+c$.

He does his by providing a signature on the value $C-A-B$ on the generator point $H$. He can do this since he was sent the blinding factor $a'$ by Alice, and he knows the blinding factors $b'$ and $c'$ because he has just chosen them.

A signature for $C-A-B$ on the generator point $H$ proves that the value $x$ is known such that $xH=C-A-B$.

Bob knows $x$, since $x = c'-a'-b'$.

The signature on the generator point $H$ is only possible if all the $G$ values cancel each other out. For example. If $C-A-B=3G+xH$, then $x=c'-a'-b'+3(G/H)$. But, since the discrete log $G/H$ is unknown, Bob cannot know $x$ when the commitment amounts do not cancel out the $G$ component.

Therefore, the signature is evidence that no amount was created out of thin air. The amount spent must perfectly match the sum of the amounts received.

Alice sends an amount $a$ to Bob, but does not declare the amount $a$ transparently on the blockchain.

Instead, she declares the Pedersen Commitment $A=aG+a'H$ as part of the transaction that appears on the blockchain. $a'$ is a uniformly random blinding factor, and $G$ and $H$ are well-known generator points chosen such that $h=H/G$ is unknown. Alice additionally encrypts $a'$ as part of the transaction such that only Bob can decrypt it with his private key.

Now, Bob wants to spend $a$, splitting it up so that the amount $b$ goes to Carol, and the amount $c$ is returned to him as change.

Bob declares the Pedersen commitments $B=bG+b'H$ and $C=cG+c'H$, and includes them in the transaction.

Now Bob has to prove that he has not created any currency out of thin air. He needs to prove that the three commitments $A, B, C$ contain values $a,b,c$ such that $a=b+c$.

He does his by providing a signature on the value $C-A-B$ on the generator point $H$. He can do this since he was sent the blinding factor $a'$ by Alice, and he knows the blinding factors $b'$ and $c'$ because he has just chosen them.

A signature for $C-A-B$ on the generator point $H$ proves that the value $x$ is known such that $xH=C-A-B$.

Bob knows $x$, since $x = c'-b'-a'$.

The signature on the generator point $H$ is only possible if all the $G$ values cancel each other out. Therefore, the signature is evidence that no amount was created out of thin air.

Alice sends an amount $a$ to Bob, but does not declare the amount $a$ transparently on the blockchain.

Instead, she declares the Pedersen Commitment $A=aG+a'H$ as part of the transaction that appears on the blockchain. $a'$ is a uniformly random blinding factor, and $G$ and $H$ are well-known generator points chosen such that the EC discrete log $G/H$ is unknown. Alice additionally encrypts $a'$ as part of the transaction such that only Bob can decrypt it with his private key.

Now, Bob wants to spend $a$, splitting it up so that the amount $b$ goes to Carol, and the amount $c$ is returned to him as change.

Bob declares the Pedersen commitments $B=bG+b'H$ and $C=cG+c'H$, and includes them in the transaction.

Now, Bob has to prove that he has not created any currency out of thin air. He needs to prove that the three commitments $A, B, C$ commit to amounts $a,b,c$ such that $a=b+c$.

He does his by providing a signature on the value $C-A-B$ on the generator point $H$. He can do this since he was sent the blinding factor $a'$ by Alice, and he knows the blinding factors $b'$ and $c'$ because he has just chosen them.

A signature for $C-A-B$ on the generator point $H$ proves that the value $x$ is known such that $xH=C-A-B$.

Bob knows $x$, since $x = c'-b'-a'$.

The signature on the generator point $H$ is only possible if all the $G$ values cancel each other out. For example. If $C-A-B=3G+xH$, then $x=c'-b'-a'+3(G/H)$. But, since the discrete log $G/H$ is unknown, Bob cannot know $x$ when the commitment amounts do not cancel out the $G$ component.

Therefore, the signature is evidence that no amount was created out of thin air.