Monero Ring CT sj calculation

Question

For a university project, I am currently implementing the RingCT Ring signatures as used in Monero (before the introduction of Bulletproofs) as laid out in this paper. To close the ring we calculate the last $s$ like this: (where $\alpha$ is the random value initially chosen and $l$ is the order of the elliptic curve group) $$s_j = α − c_j· x_j \bmod l $$

So as I understand the modulo in this case only applies to the $$c_j· x_j$$ otherwise we might get an out of range scalar, but then if this value is bigger then $\alpha$ it could happen that the $s$ is negative? Do I need another modulos here or do I understand something incorrectly?

Answer 1

All of the arithmetic is done modulo $l$ here. The notation is slightly confusing—I would have written it as: $$s_j \equiv \alpha - c_j\cdot x_j \pmod l.$$ It may not actually matter whether the integer representative you choose for the scalar is positive or negative; there are many equivalent choices of scalar that will yield the same result when you multiply a curve point by them. (But the specific algorithm you use to compute scalar multiplication may impose constraints on the integer, like being positive and below a certain size.)