<blockquote>
  <p>What if C and C' are commitments to 0 and -1? Then if I can sign, that means the ring signature is a proof is over {0,-1}.</p>
</blockquote>

<p>To create a signature, the public key must be a known multiple of G. That multiple is known as the private key. When a point has a nonzero H term in it, no signature with that point as public key can be created. In order to write r<em>G+v</em>H as a multiple k of G, k = r + v*(G/H). H is constructed in such a way that nobody knows the ratio between G and H. As a result, r<em>G+v</em>H can only be a known multiple of G when v = 0.</p>

<p>As a result, you can only sign for public keys that are points which are commitments to the value 0.</p>

<p>A ring signature means you're picking multiple points as public key, and signing for 1 of them, without revealing which one.</p>

<p>So if C is a commitment to 0, and thus C' a commitment to -1, you absolutely can create a ring signature with {C, C'} as public keys. But it's due to the presence of C there.</p>

<blockquote>
  <p>I'm probably missing something, so please tell me, why can't the amount be -1 in this proof?</p>
</blockquote>

<p>There is no 'value' in the proof. There is a choice of two values. The signer only proves he can sign for one of them, and verifiers cannot know which one he meant.</p>

CC BY-SA 3.0
2017-06-01T17:57:44.963Z
I get this part. I'm not getting why a ring signature over {0,1} is known to the verifier as a signature over {0,1} and not {-1,0}. When the signer gives C, how does the verifier know it's a commitment to 0?
Jimmy Song
CC BY-SA 3.0
2017-06-01T20:50:10.773Z
The verifier knows that C is a commitment to 0 or to 1, because if C was anything else, neither of {C, C' = C - H} would be a commitment to 0, and thus nobody could have signed for it. The presence of the signature proves that one of pubkeys in the ring was actually a commitment to 0 and nothing else.
Pieter Wuille
CC BY-SA 3.0
2017-06-01T21:53:44.400Z
ok, I think I got it. It's because the verifier calculates C-H, and it's not from the signer. That's the part that I was missing. I thought the signer gave C and C-H. Thanks!
Jimmy Song
CC BY-SA 3.0
2017-06-02T00:24:36.630Z
Indeed! The verifier computes C'. Glad it got cleared up.
Pieter Wuille
CC BY-SA 3.0
2017-06-01T16:30:57.130Z
2017-06-01T16:30:57.130Z
Pieter Wuille
<p>From the <a href="https://www.elementsproject.org/elements/confidential-transactions/investigation.html" rel="nofollow noreferrer">confidential transactions article</a>:</p>

<blockquote>
  <p><code>C' = C - 1H</code> Then I provide a ring signature over <code>{C, C’}</code>.</p>
  
  <p>If C was a commitment to 1 then I do not know its discrete log, but C’
  becomes a commitment to 0 and I do know its discrete log (just the
  blinding factor). If C was a commitment to 0 I know its discrete log,
  and I don’t for C’. If it was a commitment to any other amount, none
  of the result will be zero and I won’t be able to sign.</p>
</blockquote>

<p>What if C and C' are commitments to 0 and -1? Then if I can sign, that means the ring signature is a proof is over <code>{0,-1}</code>. I'm probably missing something, so please tell me, why can't the amount be -1 in this proof?</p>

CC BY-SA 3.0
2017-06-01T16:04:37.997Z
I don't understand your question. The quote literally states what happens if C is a commitment to 0.
Pieter Wuille
CC BY-SA 3.0
2017-06-01T16:12:22.930Z
Just edited it, maybe clearer? May also be showing my misunderstanding. I'm wondering why C, C' proves a commitment to 0 or 1 and not -1, 0.
Jimmy Song
<confidential-transactions>
How does a range proof bound lower at 0 and not -1?
Jimmy Song
# How does a range proof bound lower at 0 and not -1?

(Asked by: username_0 on 2017-06-01)

From the [confidential transactions article](https://www.elementsproject.org/elements/confidential-transactions/investigation.html):

> `C' = C - 1H` Then I provide a ring signature over `{C, C’}`.
>
> If C was a commitment to 1 then I do not know its discrete log, but C’
> becomes a commitment to 0 and I do know its discrete log (just the
> blinding factor). If C was a commitment to 0 I know its discrete log,
> and I don’t for C’. If it was a commitment to any other amount, none
> of the result will be zero and I won’t be able to sign.

What if C and C' are commitments to 0 and -1? Then if I can sign, that means the ring signature is a proof is over `{0,-1}`. I'm probably missing something, so please tell me, why can't the amount be -1 in this proof?

**Tags:** confidential-transactions

> **Comments:**
> **username_1**: I don't understand your question. The quote literally states what happens if C is a commitment to 0.  
> **username_0**: Just edited it, maybe clearer? May also be showing my misunderstanding. I'm wondering why C, C' proves a commitment to 0 or 1 and not -1, 0.  

---

## 1 answers

### Answer by username_1 on 2017-06-01. Score: 1 | Accepted answer

> What if C and C' are commitments to 0 and -1? Then if I can sign, that means the ring signature is a proof is over {0,-1}.

To create a signature, the public key must be a known multiple of G. That multiple is known as the private key. When a point has a nonzero H term in it, no signature with that point as public key can be created. In order to write r*G+v*H as a multiple k of G, k = r + v\*(G/H). H is constructed in such a way that nobody knows the ratio between G and H. As a result, r*G+v*H can only be a known multiple of G when v = 0.

As a result, you can only sign for public keys that are points which are commitments to the value 0.

A ring signature means you're picking multiple points as public key, and signing for 1 of them, without revealing which one.

So if C is a commitment to 0, and thus C' a commitment to -1, you absolutely can create a ring signature with {C, C'} as public keys. But it's due to the presence of C there.

> I'm probably missing something, so please tell me, why can't the amount be -1 in this proof?

There is no 'value' in the proof. There is a choice of two values. The signer only proves he can sign for one of them, and verifiers cannot know which one he meant.

> **Comments:**
> **username_0**: I get this part. I'm not getting why a ring signature over {0,1} is known to the verifier as a signature over {0,1} and not {-1,0}. When the signer gives C, how does the verifier know it's a commitment to 0?  
> **username_1**: The verifier knows that C is a commitment to 0 or to 1, because if C was anything else, neither of {C, C' = C - H} would be a commitment to 0, and thus nobody could have signed for it. The presence of the signature proves that one of pubkeys in the ring was actually a commitment to 0 and nothing else.  
> **username_0**: ok, I think I got it. It's because the verifier calculates C-H, and it's not from the signer. That's the part that I was missing. I thought the signer gave C and C-H. Thanks!  
> **username_1**: Indeed! The verifier computes C'. Glad it got cleared up.  

---

