Intermediary Accounts

as defined in QuisQuis by Mieklejohn (2018)


Accounts from InputInputInput → Input' are shuffled with a specific permutation ψ1\psi_1 s.t. the sender account is on index [1][1], receiver accounts are on index [2,t][2,t] and rest of the accounts, that are part of the anonymity set, over the index [t+1,n][t+1,n].

InputInput accounts are then updated using a vector of random scalar values τ\vec{\tau} for all the public keys in the input and a single random scalar ρ1\rho_1, for all the zero balance commitments using the updated public keys.

Inputi=UpdateAcc(Inputψ1(i),0);(τ,ρ1)Input'_i=UpdateAcc(Input_{\psi_{1(i)}}, 0); (\vec{\tau},\rho_1)

The property of UpdateAcc()UpdateAcc() guarantees that the updated accounts cannot be linked back to their parent accounts.


Public keys from the InputInput' accounts are used to commit on a value vectorv=(v,+v,0,0,...,0) s.t. ivi=0\vec{v}=(-v,+v,0,0,...,0) \ s.t. \ \sum_i{v_i}=0 , where v\vec{v} is arranged in the same permutation ψ1\psi_1 as InputInput'.


In QuisQuis, they use the same random scalar to commit on equal values in AccδAcc_\delta and AccϵAcc_\epsilon.


Epsilon accounts are also a commitment over v=(v,+v,0,0,...,0)\vec{v}=(-v,+v,0,0,...,0)but with globally available generator points g and h . These accounts help the verifier to check the dot product of all commitments is an identity elements s.t.

i=1nComϵi=(1,1)\prod_{i=1}^{n} {Com_{\epsilon_i}}=(1,1)

In order for the above to be true, the prover does a trick with the blinding factor, where it sets the last random scalar as rn=i=1n1rir_n=-\sum_{i=1}^{n-1}r_i .


Intuitively, these accounts are the product of the commitments from InputInput'and AccδAcc_\deltas.t. CominputComδComoutputCom_{input'} \cdot Com_\delta → Com_{output'}. The public keys for all three account types remain the same pkinput=pkϵ=pkoutputpk_{input'}=pk_{\epsilon}=pk_{output'} .

For example, if value in sender's InputInput'account is 55 and the value committed in the AccδAcc_\deltais 2-2. Then the dot product of the above commitments will result in a commitment of v=52=3v=5-2=3 following the additive homomorphic property of the commitments.

Last updated