Founder @HathorNetwork
- Tweets246
- Following124
- Followers1.1K
- Likes103
ALT Math challenge 2 (Pedersen commitments): Be the quantum computer. A commitment is C = v·H + r·G, and nobody knows h with H = h·G. A quantum computer would find it. What it means: old amounts stay hidden in the commitments. But whoever knows h can mint coins that pass every check, range proofs included: an inflation attack. Puzzle: find h, then mint. The curve is y² = x³ + 7 mod p = 2⁶¹ − 1 (it has 43·q points). G and H have prime order q = 53624256071278747. Alice's coin C is worth 1. G = (1217468943615328232, 2065245357365722203). H = (121249104770771710, 552385845561251560). C = 1·H + r·G with r = 1234567890123456. Attack: turn C into two coins worth more than 1 in total. Find C₁ = v₁·H + r₁·G and C₂ = v₂·H + r₂·G with C₁ + C₂ = C and 1 ≤ v₁, v₂ < 1000. Reply with v₁, r₁, v₂, r₂. @msbrogli
ALT Solution 1, Pedersen Commitments. Step 1: C₁ = C₂ means (r₂ − r₁)·G = v₁·H₁ − v₂·H₂. Step 2: G generates the group, so H₁ = k₁·G and H₂ = k₂·G for some k₁, k₂; the proof only needs them to exist. G has prime order q, so C₁ = C₂ exactly when r₂ − r₁ ≡ v₁k₁ − v₂k₂ (mod q). Step 3: let X = r₂ − r₁ and t = v₁k₁ − v₂k₂. X is uniform mod q: r₂ is uniform and independent of r₁, so for each r₁ every value of X comes from exactly one r₂. The number t is fixed: it depends only on the amounts and tokens, not on r₁, r₂. Result: P(C₁ = C₂) = P(X = t) = 1/q, for any amounts and tokens. What it means: unlike a plain hash of the amount, equal amounts do not give equal commitments. Two payments of 40 USDT collide with probability only 1/q, about 2⁻²⁵⁶ on secp256k1. This alone does not prove that a commitment reveals nothing about its amount. That takes a stronger result: perfect hiding. Sources: Pedersen 1991; Confidential Assets, 2017. @msbrogli
ALT Solution 1, Pedersen Commitments. Step 1: C₁ = C₂ means (r₂ − r₁)·G = v₁·H₁ − v₂·H₂. Step 2: G generates the group, so H₁ = k₁·G and H₂ = k₂·G for some k₁, k₂; the proof only needs them to exist. G has prime order q, so C₁ = C₂ exactly when r₂ − r₁ ≡ v₁k₁ − v₂k₂ (mod q). Step 3: let X = r₂ − r₁ and t = v₁k₁ − v₂k₂. X is uniform mod q: r₂ is uniform and independent of r₁, so for each r₁ every value of X comes from exactly one r₂. The number t is fixed: it depends only on the amounts and tokens, not on r₁, r₂. Result: P(C₁ = C₂) = P(X = t) = 1/q, for any amounts and tokens. What it means: unlike a plain hash of the amount, equal amounts do not give equal commitments. Two payments of 40 USDT collide with probability only 1/q, about 2⁻²⁵⁶ on secp256k1. This alone does not prove that a commitment reveals nothing about its amount. That takes a stronger result: perfect hiding. Sources: Pedersen 1991; Confidential Assets, 2017. @msbrogli
ALT Pedersen Commitments Challenge 1. Let G generate a group of prime order q, and let H₁, H₂ be the points of their tokens (the same token or two different ones). Fix any amounts v₁, v₂, and pick r₁, r₂ independently and uniformly at random mod q. Commitments: C₁ = v₁·H₁ + r₁·G and C₂ = v₂·H₂ + r₂·G. Prove that P(C₁ = C₂) = 1/q. What it means: unlike a plain hash of the amount, equal amounts do not give equal commitments. Two payments of 40 USDT collide with probability only 1/q, about 2⁻²⁵⁶ on secp256k1. This alone does not prove that a commitment reveals nothing about its amount. That takes a stronger result: perfect hiding. Answer in the replies. @msbrogli
ALT Pedersen Commitments Challenge 1. Let G generate a group of prime order q, and let H₁, H₂ be the points of their tokens (the same token or two different ones). Fix any amounts v₁, v₂, and pick r₁, r₂ independently and uniformly at random mod q. Commitments: C₁ = v₁·H₁ + r₁·G and C₂ = v₂·H₂ + r₂·G. Prove that P(C₁ = C₂) = 1/q. What it means: unlike a plain hash of the amount, equal amounts do not give equal commitments. Two payments of 40 USDT collide with probability only 1/q, about 2⁻²⁵⁶ on secp256k1. This alone does not prove that a commitment reveals nothing about its amount. That takes a stronger result: perfect hiding. Answer in the replies. @msbrogli
ALT Level 6: hide the network. The Sent from line changed from 203.0.113.42 (Alice's home) to via Tor. Amounts, tokens, recipients and origin stay hidden as in level 5.
ALT Grid titled Six levels of privacy. Rows: amount, token, recipient, origin, your IP address. Columns: level 1 transparent to level 6 network. Each level hides one more row, from the amount at level 2 to the IP address at level 6. The last row, time, number of inputs and outputs, and fee, stays visible at every level. Below: Most levels add proofs that every node checks. Which level would you pay that cost for?
ALT Checklist titled: If you pay on a public chain. 1. Pay from a small spending wallet. The barista sees its balance, not your savings; the transfer that filled it still links them. 2. Receive each payment on a new address. It takes more than one lookup; the funding still links it. 3. Send through your own node or Tor. Your wallet's default server sees your IP address and your wallet address. Bottom line: They make the trail longer. They don't hide it.
