mimblewimble team mailing list archive
Mailing list archive
Re: Discreet Log Contracts
> Olivia will publish "yes" or "no" under her key O and commitment R.
> This means there are two possible values for S:
> S1 = R + hash(R, "yes")*O
> S2 = R + hash(R, "no")*O
> Alice and Bob create a payment channel under key A + B = C with 1 BTC each.
> They propose two possible channel updates: 2 BTC for Alice if it rains, or 2
> BTC for Bob if it doesn't.
> The channel update (simplified to single key C) where Alice wins is signed
> R1 = r*G + S1
> s' = r + hash(R1, transaction)*c
How do Alice and Bob compute this when r must remain Olivia's secret?