1
$\begingroup$

For a university project, I am currently implementing the RingCT Ring signatures as used in Monero (before the introduction of Bulletproofs) as laid out in this paper. To close the ring we calculate the last $s$ like this: (where $\alpha$ is the random value initially chosen and $l$ is the order of the elliptic curve group) $$s_j = α − c_j· x_j \bmod l $$

So as I understand the modulo in this case only applies to the $$c_j· x_j$$ otherwise we might get an out of range scalar, but then if this value is bigger then $\alpha$ it could happen that the $s$ is negative? Do I need another modulos here or do I understand something incorrectly?

$\endgroup$
2
$\begingroup$

All of the arithmetic is done modulo $l$ here. The notation is slightly confusing—I would have written it as: $$s_j \equiv \alpha - c_j\cdot x_j \pmod l.$$ It may not actually matter whether the integer representative you choose for the scalar is positive or negative; there are many equivalent choices of scalar that will yield the same result when you multiply a curve point by them. (But the specific algorithm you use to compute scalar multiplication may impose constraints on the integer, like being positive and below a certain size.)

$\endgroup$
  • $\begingroup$ I see thanks. Yes, I already thought so but then you would have to make sure that the other s values, calculated randomly can be negative too, otherwise, you might be giving away for which key you signed. $\endgroup$ – Jakob Abfalter May 21 '19 at 9:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.