# Monero Ring CT sj calculation

For a university project, I am currently implementing the RingCT Ring signatures as used in Monero (before the introduction of Bulletproofs) as laid out in this paper. To close the ring we calculate the last $$s$$ like this: (where $$\alpha$$ is the random value initially chosen and $$l$$ is the order of the elliptic curve group) $$s_j = α − c_j· x_j \bmod l$$

So as I understand the modulo in this case only applies to the $$c_j· x_j$$ otherwise we might get an out of range scalar, but then if this value is bigger then $$\alpha$$ it could happen that the $$s$$ is negative? Do I need another modulos here or do I understand something incorrectly?

All of the arithmetic is done modulo $$l$$ here. The notation is slightly confusing—I would have written it as: $$s_j \equiv \alpha - c_j\cdot x_j \pmod l.$$ It may not actually matter whether the integer representative you choose for the scalar is positive or negative; there are many equivalent choices of scalar that will yield the same result when you multiply a curve point by them. (But the specific algorithm you use to compute scalar multiplication may impose constraints on the integer, like being positive and below a certain size.)