<blockquote>
  <p>What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount. </p>
</blockquote>

<p>The fact that the receiver wouldn't treat the result as a valid payment.</p>

<p>This is no different from them sending the right amount to the wrong address.</p>

CC BY-SA 3.0
2018-02-10T00:17:17.737Z
I see. Is there any way the receiver could prove that the sender messed up?

In the case of sending to the wrong address, it's fairly easy to demonstrate the address was different, but I'm wondering if the receiver can trivially prove that the payment was invalid? (Because the transaction will "look" valid to the blockchain)
PowerPanda
CC BY-SA 3.0
2018-02-10T00:45:20.387Z
Actually, never mind. I realized the sender can prove he did the right thing by disclosing his ephemeral private key.

Thanks for taking the time!
PowerPanda
CC BY-SA 3.0
2018-02-10T02:12:56.273Z
Well none of this is a transferable proof. You can't prove to someone else that you don't own a particular key. It's up to the other party to prove that it is (for example by requiring you to sign the address with a well-known identity key).
Pieter Wuille
CC BY-SA 3.0
2018-02-10T00:13:57.257Z
2018-02-10T00:13:57.257Z
Pieter Wuille
<p>I'm reading the Confidential Transactions paper, and it says that the blinding factor in the pedersen commitment is derived using a shared secret, but I can't understand what's preventing the sender from cheating a bit. </p>

<p>The sender generates a ephemeral private key, and derives the secret as <code>(ephemeral private key * receivers public key)</code>, and is supposed to pack the ephemeral public key in the transaction, so that the receiver can derive the shared secret <code>(receivers private key * ephemeral public key)</code> and get the blinding factor and derive transaction amount. </p>

<p>What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount. </p>

<p>The sender might be up to mischief, or claim that he sent a transaction (and show the transaction ID as proof), and claim that the receiver (maybe an exchange) is not depositing the right amount. </p>

<confidential-transactions>
In a confidential transaction, what guarantees that the sender packed the correct ephemeral public key for the pederson blinding factor?
PowerPanda
# In a confidential transaction, what guarantees that the sender packed the correct ephemeral public key for the pederson blinding factor?

(Asked by: username_0 on 2018-02-09)

I'm reading the Confidential Transactions paper, and it says that the blinding factor in the pedersen commitment is derived using a shared secret, but I can't understand what's preventing the sender from cheating a bit.

The sender generates a ephemeral private key, and derives the secret as `(ephemeral private key * receivers public key)`, and is supposed to pack the ephemeral public key in the transaction, so that the receiver can derive the shared secret `(receivers private key * ephemeral public key)` and get the blinding factor and derive transaction amount.

What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount.

The sender might be up to mischief, or claim that he sent a transaction (and show the transaction ID as proof), and claim that the receiver (maybe an exchange) is not depositing the right amount.

**Tags:** confidential-transactions


---

## 1 answers

### Answer by username_1 on 2018-02-10. Score: 1 | Accepted answer

> What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount.

The fact that the receiver wouldn't treat the result as a valid payment.

This is no different from them sending the right amount to the wrong address.

> **Comments:**
> **username_0**: I see. Is there any way the receiver could prove that the sender messed up?  In the case of sending to the wrong address, it's fairly easy to demonstrate the address was different, but I'm wondering if the receiver can trivially prove that the payment was invalid? (Because the transaction will "look" valid to the blockchain)  
> **username_0**: Actually, never mind. I realized the sender can prove he did the right thing by disclosing his ephemeral private key.  Thanks for taking the time!  
> **username_1**: Well none of this is a transferable proof. You can't prove to someone else that you don't own a particular key. It's up to the other party to prove that it is (for example by requiring you to sign the address with a well-known identity key).  

---

