<blockquote>
  <p>If the network doesn't know transaction amounts, how can it verify a transaction?</p>
</blockquote>

<p>That's exactly what Pedersen commitments allow you to do.</p>

<p>Each of the outputs contains a commitment P(v,r) = v<em>H + r</em>G, where v is the value and r is the blinding factr. The network does not know v or r, but does know P(v,r) (and H and G, which are constant).</p>

<p>Pedersen commitments have the property that they're linear in both arguments. This means that P(v1,r1) + P(v2,r2) = P(v1+v2,r1+r2).</p>

<p>For every transaction, a network rule requires that the sum of the output's commitments equals the sum of the commitments of the outputs spent by the inputs. This means that the sum of the output's values must equal the sum of the input's values, and that the sum of the blinding factors must equal the sum of the input's blinding factors.</p>

<p>The range proofs are there to prevent overflow in the value addition.</p>

<blockquote>
  <p>It doesn't know whether the account balance is sufficient.</p>
</blockquote>

<p>There is no 'account' balance in Bitcoin. Transactions create outputs by burning outputs created by other transactions. Your wallet shows the sum of the values of all outputs you can spend. The only requirement is that a transaction does not create more in outputs than it burns in its inputs.</p>

<blockquote>
  <p>How can the network even know account balances when the amount of incoming transactions is hidden?</p>
</blockquote>

<p>It can't. The purpose of Confidential Transaction is to prevent the network from knowing anything about anyone's balances. The only necessity is that individual wallets are able to determine how much they're able to spend. In CT that is solved by sending that information in encrypted form along with the transaction, with the receiver's public key.</p>

CC BY-SA 3.0
2017-05-21T00:17:56.793Z
Ah, now I get it! I always thought that in order do verify the blockchain, nodes would determine balances for each public key from incoming and outgoing transactions. And I thought transaction inputs were public keys of accounts, not outputs of other transactions. Now everything makes sense. Thanks!
Michael Jung
CC BY-SA 3.0
2017-05-20T22:30:08.987Z
2017-05-20T22:35:21.560Z
2017-05-20T22:35:21.560Z
Pieter Wuille
<p>I'm currently trying to understand how confidential transactions would work. I think I was able follow all the explanations about Pedersen commitments and the range checks, but I'm still missing one piece of the puzzle: If the network doesn't know transaction amounts, how can it verify a transaction? It doesn't know whether the account balance is sufficient. How can the network even know account balances when the amount of incoming transactions is hidden?</p>

<p>It would be great if anyone could shed some light on this. </p>

<confidential-transactions>
Confidential transactions: how can they be verified by the network?
Michael Jung
# Confidential transactions: how can they be verified by the network?

(Asked by: username_0 on 2017-05-20)

I'm currently trying to understand how confidential transactions would work. I think I was able follow all the explanations about Pedersen commitments and the range checks, but I'm still missing one piece of the puzzle: If the network doesn't know transaction amounts, how can it verify a transaction? It doesn't know whether the account balance is sufficient. How can the network even know account balances when the amount of incoming transactions is hidden?

It would be great if anyone could shed some light on this.

**Tags:** confidential-transactions


---

## 1 answers

### Answer by username_1 on 2017-05-20. Score: 1 | Accepted answer

> If the network doesn't know transaction amounts, how can it verify a transaction?

That's exactly what Pedersen commitments allow you to do.

Each of the outputs contains a commitment P(v,r) = v*H + r*G, where v is the value and r is the blinding factr. The network does not know v or r, but does know P(v,r) (and H and G, which are constant).

Pedersen commitments have the property that they're linear in both arguments. This means that P(v1,r1) + P(v2,r2) = P(v1+v2,r1+r2).

For every transaction, a network rule requires that the sum of the output's commitments equals the sum of the commitments of the outputs spent by the inputs. This means that the sum of the output's values must equal the sum of the input's values, and that the sum of the blinding factors must equal the sum of the input's blinding factors.

The range proofs are there to prevent overflow in the value addition.

> It doesn't know whether the account balance is sufficient.

There is no 'account' balance in Bitcoin. Transactions create outputs by burning outputs created by other transactions. Your wallet shows the sum of the values of all outputs you can spend. The only requirement is that a transaction does not create more in outputs than it burns in its inputs.

> How can the network even know account balances when the amount of incoming transactions is hidden?

It can't. The purpose of Confidential Transaction is to prevent the network from knowing anything about anyone's balances. The only necessity is that individual wallets are able to determine how much they're able to spend. In CT that is solved by sending that information in encrypted form along with the transaction, with the receiver's public key.

> **Comments:**
> **username_0**: Ah, now I get it! I always thought that in order do verify the blockchain, nodes would determine balances for each public key from incoming and outgoing transactions. And I thought transaction inputs were public keys of accounts, not outputs of other transactions. Now everything makes sense. Thanks!  

---

