I'm using Pedersen commitments to maintain the account balance in the ledger.

  1. Assume that when I create the account, I record the Pedersen commitment of 0 in a ledger (here, the blinding factor and generators are also recorded in a ledger).

  2. First, I minted some tokens, let's say 10 tokens. Now I retrieve Pedersen's commitment of 0 from the ledger. Now I add Pedersen's commitments of 10 and 0 to the ledger and record the resultant Pedersen's commitment in ledger.

  3. The sender now has a balance of 10 in the ledger as a Pedersen commitment. If the sender wishes to send 15 tokens to another account, I first retrieve a commitment of 10 from the ledger and subtract a commitment of 15 from 10. Before proceeding with the transaction, I want to verify if the resultant Pedersen commitment(C(10, r1) - C(15,r2) is negative.

How to check that?

I know that range proofs (bulletproof) are used to determine whether Pedersen's commitment is negative or not, but in this case, I'd like to determine whether the resultant Pedersen's commitment is negative or not.



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.