Monero uses a Pedersen commitment $yG + bH$ to obfuscate the value of a transaction, where $b$ is the value and $y$ is the blinding factor.

For the receiver to know both variables, it uses a Diffie-Hellman key exchange to share a secret $rK$, where $r$ is a randomness chosen by the sender and $K$ is a public key of the receiver. $R = rG$ is public and sent as part of the transaction. The sender computes the following (the $amount$ is also sent in the transaction and $H$ is a hash function):

$$ y = H(“commitment mask”, H(rK)) $$ $$ amount = b xor H("amount", H(rK)) $$

The receiver is able to compute $y$ and $b$ using $R$ and his private key $k$.

My questions are: can this be considered an encryption/decryption scheme and is it already known or is it original to Monero? If the latter, how can we prove its security?

Source: https://web.getmonero.org/library/Zero-to-Monero-2-0-0.pdf, page 45

  • 1
    $\begingroup$ This looks like a spin on ECIES tailored to the needs of Monero using a commitment scheme as symmetric encryption. Using a commitment scheme instead of normal authenticated encryption is indeed highly unusual. Now the follow-up question would be whether the use of a commitment scheme (and its extra dlog assumption) would allow us to relax security assumptions in other places of the scheme / give (what?) strong security notion as a result. $\endgroup$
    – SEJPM
    Feb 11 at 11:36
  • $\begingroup$ So the scheme is at least as secure as ECIES? $\endgroup$
    – Fiono
    Feb 11 at 12:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.