mimblewimble team mailing list archive

[John Tromp <john.tromp@xxxxxxxxx>]

dear Ruben,

> Olivia will publish "yes" or "no" under her key O and commitment R.
>
> This means there are two possible values for S:
>
> S1 = R + hash(R, "yes")*O
> S2 = R + hash(R, "no")*O
>
> Alice and Bob create a payment channel under key A + B = C with 1 BTC each.
>
> They propose two possible channel updates: 2 BTC for Alice if it rains, or 2
> BTC for Bob if it doesn't.
>
> The channel update (simplified to single key C) where Alice wins is signed
> with:
>
> R1 = r*G + S1
> s' = r + hash(R1, transaction)*c

How do Alice and Bob compute this when r must remain Olivia's secret?

regards,
-John