Twilight
Search…
Intermediary Accounts
as defined in QuisQuis by Mieklejohn et.al. (2018)

InputInput'

Accounts from
InputInputInput → Input'
are shuffled with a specific permutation
ψ1\psi_1
s.t. the sender account is on index
[1][1]
, receiver accounts are on index
[2,t][2,t]
and rest of the accounts, that are part of the anonymity set, over the index
[t+1,n][t+1,n]
.
InputInput
accounts are then updated using a vector of random scalar values
τ\vec{\tau}
for all the public keys in the input and a single random scalar
ρ1\rho_1
, for all the zero balance commitments using the updated public keys.
Inputi=UpdateAcc(Inputψ1(i),0);(τ,ρ1)Input'_i=UpdateAcc(Input_{\psi_{1(i)}}, 0); (\vec{\tau},\rho_1)
The property of
UpdateAcc()UpdateAcc()
guarantees that the updated accounts cannot be linked back to their parent accounts.

AccδAcc_\delta

Public keys from the
InputInput'
accounts are used to commit on a value vector
v=(v,+v,0,0,...,0) s.t. ivi=0\vec{v}=(-v,+v,0,0,...,0) \ s.t. \ \sum_i{v_i}=0
, where
v\vec{v}
is arranged in the same permutation
ψ1\psi_1
as
InputInput'
.
Accδ=(pkiinput,Comiinput(vi,ri))Acc_\delta=(pk_{i_{input'}},Com_{i_{input'}}(v_i,r_i))
In QuisQuis, they use the same random scalar to commit on equal values in
AccδAcc_\delta
and
AccϵAcc_\epsilon
.

AccϵAcc_\epsilon

Epsilon accounts are also a commitment over
v=(v,+v,0,0,...,0)\vec{v}=(-v,+v,0,0,...,0)
but with globally available generator points g and h . These accounts help the verifier to check the dot product of all commitments is an identity elements s.t.
i=1nComϵi=(1,1)\prod_{i=1}^{n} {Com_{\epsilon_i}}=(1,1)
In order for the above to be true, the prover does a trick with the blinding factor, where it sets the last random scalar as
rn=i=1n1rir_n=-\sum_{i=1}^{n-1}r_i
.

OutputOutput'

Intuitively, these accounts are the product of the commitments from
InputInput'
and
AccδAcc_\delta
s.t.
CominputComδComoutputCom_{input'} \cdot Com_\delta → Com_{output'}
. The public keys for all three account types remain the same
pkinput=pkϵ=pkoutputpk_{input'}=pk_{\epsilon}=pk_{output'}
.
For example, if value in sender's
InputInput'
account is
55
and the value committed in the
AccδAcc_\delta
is
2-2
. Then the dot product of the above commitments will result in a commitment of
v=52=3v=5-2=3
following the additive homomorphic property of the commitments.
Last modified 1yr ago
Copy link
Contents