mimblewimble team mailing list archive

[Merope Riddle <merope07@xxxxxxxxxxxxxx>]

Myrtle Warren said:
> As far as I can tell, the specific construction of the output hash's preimage has not been determined. If we move forward with this mechanism, it becomes critically important that the hash covers the range proof itself. A situation where the hash resolves ambiguously should be avoided at all costs.

It should be sufficient for the output and its rangeproof to be separately committed to the chain to prevent ambiguity. Committing to rangeproofs, which are witness data and can be ignored (at a trust tradeoff), will reduce flexibility.