i've some trouble understanding the base of the range proof presented at https://elementsproject.org/elements/confidential-transactions/investigation.html

I've understand the base of the Pedersen Commitment but I lost when he speak about commitment to zero:

A pedersen commitment can be proven to be a commitment to a zero by just signing a hash of the commitment with the commitment as the public key. Using the public key in the signature is required to prevent setting the signature to arbitrary values and solving for the commitment. The private key used for the signature is just the blinding factor.

Why to prove a zero commitment it make an hash of the commitment? Does he intend this ( if we call $C$ the commitment)?

$Hash(C)H + C$

But if I know the Publik key $P=kG$ cannot simply check if $C= P$ because we have that $C= kG + 0H$?



not sure if I understand your problem. But the zero commitment means that you know some k that makes k*G= your commitment C.

If you sign something with C as the public key, it also means that you know k.

so, if you can sign with C = zero commitment with C.

Hope it answers your question.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.