<p>In Elements Alpha, output "amounts" consist of 3 pieces of data:</p>

<ul>
<li>The Petersen commitment to the value, blinded by the blinding factor.</li>
<li>The range proof, which can publicly prove that the value is within range [0..2^32-1] units (satoshis) without revealing anything about the blinding factor.</li>
<li>An ECDH ephemeral public key of the sender.</li>
</ul>

<p>The latter is where the solution lies. Every confidential transactions address contains an ECDH public key of the receiver (the <em>blinding key</em>), in addition to normal P2PKH or P2SH data.</p>

<p>When a CT transaction is sent, the sender chooses an <em>ECDH ephemeral private key</em>, and combines it with the blinding key to derive a <em>blinding seed</em>. This seed is used as a basis for the random number generator to create the range proof. The public version of the ephemeral key is then written in the 3rd field of the amount.</p>

<p>When the receiver sees this ECDH ephemeral public key, he combines it with his private blinding key, to derive the same seed as the sender used. Using this same seed, he can "unwind" the range proof, and decode the secret information that was used when creating it: the value and the blinding factor. There is in fact space for another 2 kilobytes of data in the range proof, only visible to the receiver (or anyone holding the private blinding key).</p>

CC BY-SA 3.0
2016-08-19T05:03:06.003Z
By the random number for creating range proof you are referring to the commitment's blinding factor? Blinding factor in the ring signature proves the range proof as far as i know. If so then the blinding factor is generated from the seed? May I know what the seed is exactly?
abeikverdi
CC BY-SA 3.0
2016-08-19T06:57:56.243Z
If the range proof only covers values up to 2^32-1 does that mean you can't send more than ~42.9… bitcoins with CT?
Murch
CC BY-SA 3.0
2016-08-19T08:31:45.253Z
@abeikverdi No, the seed value is not the blinding factor. It is the base for the randomness that goes into the ring signatures inside the range proofs. By making the randomness deterministic, the receive can "undo" the range proof by knowing what randomness goes into it.
Pieter Wuille
CC BY-SA 3.0
2016-08-19T08:33:20.470Z
@Murch The range can actually be chosen to be anything between 2 and 64 bits of randomness, but that range is public. So you can use a larger range, but that gives an indication you're transacting more. Of course, you can always use larger ranges even when transacting small values, but this increases the price.
Pieter Wuille
CC BY-SA 3.0
2016-08-18T21:08:05.863Z
2016-08-18T21:08:05.863Z
Pieter Wuille
<p>In confidential transaction proposed by Maxwell, instead of transaction amounts we use pedersen commitments to hide the amount and add the range proof to the transaction to prevent overflow. A simple commitment with one input and one output C1 and C2 is as follow: (Ignore the fee for simplicity)</p>

<pre><code>C1 = C2 =&gt; BF1*G + a*H = BF2*G + a*H 
</code></pre>

<p>where in this example <code>BF1 = BF2</code> obviously since it only has one input and output. <br />
How does the sender send the amount and blinding factor to the receiver? Receiver can check if the amount is correct! I noticed Maxwell said they use ECDH. I assume there is no additional communication channel for ECDH. Then how does the sender get receivers public key? and does sender need to reveal both blinding factor and amount in the ECDH?</p>

<confidential-transactions><ecdh>
Sending confidential transaction amount to the receiver
abeikverdi
# Sending confidential transaction amount to the receiver

(Asked by: username_0 on 2016-08-16)

In confidential transaction proposed by Maxwell, instead of transaction amounts we use pedersen commitments to hide the amount and add the range proof to the transaction to prevent overflow. A simple commitment with one input and one output C1 and C2 is as follow: (Ignore the fee for simplicity)

```
C1 = C2 => BF1*G + a*H = BF2*G + a*H 

```

where in this example `BF1 = BF2` obviously since it only has one input and output.   
How does the sender send the amount and blinding factor to the receiver? Receiver can check if the amount is correct! I noticed Maxwell said they use ECDH. I assume there is no additional communication channel for ECDH. Then how does the sender get receivers public key? and does sender need to reveal both blinding factor and amount in the ECDH?

**Tags:** confidential-transactions, ecdh


---

## 1 answers

### Answer by username_1 on 2016-08-18. Score: 4 | Accepted answer

In Elements Alpha, output "amounts" consist of 3 pieces of data:

* The Petersen commitment to the value, blinded by the blinding factor.
* The range proof, which can publicly prove that the value is within range [0..2^32-1] units (satoshis) without revealing anything about the blinding factor.
* An ECDH ephemeral public key of the sender.

The latter is where the solution lies. Every confidential transactions address contains an ECDH public key of the receiver (the *blinding key*), in addition to normal P2PKH or P2SH data.

When a CT transaction is sent, the sender chooses an *ECDH ephemeral private key*, and combines it with the blinding key to derive a *blinding seed*. This seed is used as a basis for the random number generator to create the range proof. The public version of the ephemeral key is then written in the 3rd field of the amount.

When the receiver sees this ECDH ephemeral public key, he combines it with his private blinding key, to derive the same seed as the sender used. Using this same seed, he can "unwind" the range proof, and decode the secret information that was used when creating it: the value and the blinding factor. There is in fact space for another 2 kilobytes of data in the range proof, only visible to the receiver (or anyone holding the private blinding key).

> **Comments:**
> **username_0**: By the random number for creating range proof you are referring to the commitment's blinding factor? Blinding factor in the ring signature proves the range proof as far as i know. If so then the blinding factor is generated from the seed? May I know what the seed is exactly?  
> **username_2**: If the range proof only covers values up to 2^32-1 does that mean you can't send more than ~42.9… bitcoins with CT?  
> **username_1**: @username_0 No, the seed value is not the blinding factor. It is the base for the randomness that goes into the ring signatures inside the range proofs. By making the randomness deterministic, the receive can "undo" the range proof by knowing what randomness goes into it.  
> **username_1**: @username_2 The range can actually be chosen to be anything between 2 and 64 bits of randomness, but that range is public. So you can use a larger range, but that gives an indication you're transacting more. Of course, you can always use larger ranges even when transacting small values, but this increases the price.  

---

