<p>Only the overall commitment (<em>P</em>) is revealed. <em>G</em> and <em>H</em> are constants known to everyone. <em>x</em> (the blinding factor) and <em>a</em> (the value) are secret.</p>
<blockquote>
<p>if xG is a private value the CT paper tell: can be proven to be a commitment to a zero by just signing a hash of the commitment with the commitment as the public or if if you want to prove a=1 make C' = C - 1H and then sign the hash of C'. How signing C or C' can I prove the value and also how can I verify a sign if I dont know xG?</p>
</blockquote>
<p>You can only sign with a point if it's a known multiple of <em>G</em>. By definition, a signature with private key <em>k</em> can be verified with public key <em>kG</em>. If <em>P = xG + aH</em> with <em>a</em> nonzero, it is impossible to find a <em>k</em> such that <em>kG = xG + aH</em> - that would require knowing the ratio between <em>G</em> and <em>H</em> (and <em>H</em> is constructed in such a way that this ratio is unknown to everyone).</p>

CC BY-SA 3.0
2017-05-22T09:36:40.097Z
Thanks! If I've understand .. suppose we 've got a commitment C to 1 (C=xG+H) in a set [0-1]. Then make two commitment:
P0 = C=xG+H and P1= C-1H = xG+H-h=xG.
If I want to use this commitment as sign's public key I can do it only for P1 beacause dont know the logaritm of P0?
Bartok
CC BY-SA 3.0
2017-05-22T17:06:02.803Z
You got it. The DL of P1 (wrt G) is x, but the DL of P0 wrt G is not known (to anyone).
Pieter Wuille
CC BY-SA 4.0
2017-05-18T18:20:52.300Z
2021-02-07T21:40:30.900Z
2021-02-07T21:40:30.900Z
Pieter Wuille
<p>I've some doubt about Greg Maxwell Confidential transaction and hope someone can help to make it clear.
A commitment using Elliptic Curve math is:</p>

<pre><code>                                  P=xG + aH
</code></pre>

<p>where G,H are public value and x,a are private.</p>

<p>My questions are:</p>

<ol>
<li><code>xG</code> is public or private value?</li>
<li>if <code>xG</code> is a public value  why an attacker cannot simply  make a brute force attack trying all possible value of <code>a</code> checking for the equality with the P value?</li>
<li>if <code>xG</code> is a private value the CT paper tell: <code>can be proven to be a commitment to a zero by just signing a hash of the commitment with the commitment as the public</code> or if if you want to prove <code>a=1</code> make <code>C' = C - 1H</code>
and then sign the hash of <code>C'</code>. How signing <code>C</code> or <code>C'</code> can I prove the value and also how can I verify a sign if I dont know <code>xG</code>?</li>
</ol>

<cryptography><confidential-transactions>
Range proof's Confidential Transaction understanding
Bartok
# Range proof's Confidential Transaction understanding

(Asked by: username_0 on 2017-05-18)

I've some doubt about Greg Maxwell Confidential transaction and hope someone can help to make it clear.
A commitment using Elliptic Curve math is:
                                  P=xG + aH

where G,H are public value and x,a are private.
My questions are:

xG is public or private value?
if xG is a public value  why an attacker cannot simply  make a brute force attack trying all possible value of a checking for the equality with the P value?
if xG is a private value the CT paper tell: can be proven to be a commitment to a zero by just signing a hash of the commitment with the commitment as the public or if if you want to prove a=1 make C' = C - 1H
and then sign the hash of C'. How signing C or C' can I prove the value and also how can I verify a sign if I dont know xG?

**Tags:** cryptography, confidential-transactions


---

## 1 answers

### Answer by username_1 on 2017-05-18. Score: 3 | Accepted answer

Only the overall commitment (*P*) is revealed. *G* and *H* are constants known to everyone. *x* (the blinding factor) and *a* (the value) are secret.

> if xG is a private value the CT paper tell: can be proven to be a commitment to a zero by just signing a hash of the commitment with the commitment as the public or if if you want to prove a=1 make C' = C - 1H and then sign the hash of C'. How signing C or C' can I prove the value and also how can I verify a sign if I dont know xG?

You can only sign with a point if it's a known multiple of *G*. By definition, a signature with private key *k* can be verified with public key *kG*. If *P = xG + aH* with *a* nonzero, it is impossible to find a *k* such that *kG = xG + aH* - that would require knowing the ratio between *G* and *H* (and *H* is constructed in such a way that this ratio is unknown to everyone).

> **Comments:**
> **username_0**: Thanks! If I've understand .. suppose we 've got a commitment C to 1 (C=xG+H) in a set [0-1]. Then make two commitment: P0 = C=xG+H and P1= C-1H = xG+H-h=xG. If I want to use this commitment as sign's public key I can do it only for P1 beacause dont know the logaritm of P0?  
> **username_1**: You got it. The DL of P1 (wrt G) is x, but the DL of P0 wrt G is not known (to anyone).  

---

