mimblewimble team mailing list archive

mimblewimble team

Mailing list archive

Message #00488
Re: Discreet Log Contracts
Hi John,
Thank you for your interest.
> How do Alice and Bob compute this when r must remain Olivia's secret?
I see the confusion. There are two completely different r values, but I
neglected to mark them as such.
Olivia never reveals her r and simply uses it to calculate s1 or s2
(creating an ordinary Schnorr signature)..
The other r is chosen by Alice + Bob (note that I treated them as a single
person C for simplification).
Alice + Bob only need s1 or s2 (not r) from Olivia in order to complete the
signature on one of their two contracts.
Hopefully this clears up the confusion.
Cheers,
Ruben Somsen
On Tue, May 22, 2018 at 10:51 PM, John Tromp <john.tromp@xxxxxxxxx> wrote:
> dear Ruben,
>
> > Olivia will publish "yes" or "no" under her key O and commitment R.
> >
> > This means there are two possible values for S:
> >
> > S1 = R + hash(R, "yes")*O
> > S2 = R + hash(R, "no")*O
> >
> > Alice and Bob create a payment channel under key A + B = C with 1 BTC
> each.
> >
> > They propose two possible channel updates: 2 BTC for Alice if it rains,
> or 2
> > BTC for Bob if it doesn't.
> >
> > The channel update (simplified to single key C) where Alice wins is
> signed
> > with:
> >
> > R1 = r*G + S1
> > s' = r + hash(R1, transaction)*c
>
> How do Alice and Bob compute this when r must remain Olivia's secret?
>
> regards,
> John
>
References