<p>The blinding key is a shared secret among the receiver and the sender.</p>

<p>Typically the Diffie-Hellman key exchange is intiated by the sender <a href="http://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/" rel="nofollow noreferrer">ECDH</a>, given that he already has knowledge of the receivers public key in a secure manner. The blinding key itself is not public knowledge, but the sender includes a one-time/temporary/ephemeral public key along with the transaction. The temporary public key is used in <a href="http://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/" rel="nofollow noreferrer">the ECDH key exchange scheme</a> (receiver public key + temporary public key -> shared secret) to create the blind key.</p>

<p>There is no need for a private channel, the temporary public key can be public knowledge. The receiver however has to generate the shared secret themselves.</p>

CC BY-SA 3.0
2017-10-24T04:41:32.433Z
Thanks. I am still confused about how to generate the first commitment since its input must come from the block reward -- coinbase which is explicit. When the inputs are all plain-text amount, how to make the CT outputs?
N.aN
CC BY-SA 3.0
2018-02-10T00:14:37.320Z
What's stopping the sender from packing a different ephemeral public key in the transaction? If he packs a different public key, the transaction will still validate, but the receiver won't be able to actually receive the money, right?
PowerPanda
CC BY-SA 3.0
2018-02-10T15:32:25.150Z
@PowerPanda correct. Disclosing the shared blinding factor and its public key variant (blinding factor x, public blind key = xG) would result in a complete failure of the CT scheme. The network will validate the transaction, as it is mathematically correct but the receiver should not accept the transaction.
Penquin
CC BY-SA 3.0
2017-10-21T17:52:21.567Z
2017-10-21T17:52:21.567Z
Penquin
<p>I have a small question about confidential transactions. In it, a secret random blinding key is used to generate a Pedersen commitment. Is that mean that the recipient's blinding key is determined by the sender, and sender deliver the blinding key to the recipient in private channel? </p>

<p>My question may be stupid. It would be great if anyone could shed some light on this.</p>

<confidential-transactions>
About confidential transactions blinding key
N.aN
# About confidential transactions blinding key

(Asked by: username_0 on 2017-10-20)

I have a small question about confidential transactions. In it, a secret random blinding key is used to generate a Pedersen commitment. Is that mean that the recipient's blinding key is determined by the sender, and sender deliver the blinding key to the recipient in private channel?

My question may be stupid. It would be great if anyone could shed some light on this.

**Tags:** confidential-transactions


---

## 1 answers

### Answer by username_1 on 2017-10-21. Score: 1

The blinding key is a shared secret among the receiver and the sender.

Typically the Diffie-Hellman key exchange is intiated by the sender [ECDH](http://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/), given that he already has knowledge of the receivers public key in a secure manner. The blinding key itself is not public knowledge, but the sender includes a one-time/temporary/ephemeral public key along with the transaction. The temporary public key is used in [the ECDH key exchange scheme](http://andrea.corbellini.name/2015/05/30/elliptic-curve-cryptography-ecdh-and-ecdsa/) (receiver public key + temporary public key -> shared secret) to create the blind key.

There is no need for a private channel, the temporary public key can be public knowledge. The receiver however has to generate the shared secret themselves.

> **Comments:**
> **username_0**: Thanks. I am still confused about how to generate the first commitment since its input must come from the block reward -- coinbase which is explicit. When the inputs are all plain-text amount, how to make the CT outputs?  
> **username_2**: What's stopping the sender from packing a different ephemeral public key in the transaction? If he packs a different public key, the transaction will still validate, but the receiver won't be able to actually receive the money, right?  
> **username_1**: @username_2 correct. Disclosing the shared blinding factor and its public key variant (blinding factor x, public blind key = xG) would result in a complete failure of the CT scheme. The network will validate the transaction, as it is mathematically correct but the receiver should not accept the transaction.  

---

