55This document provides an overview and introduction to
66the Confidential Assets implementation in Elements. A list of relevant
77RPCs is provided as well as a list of references providing further
8- information.
8+ information.
99
1010A working knowledge of Bitcoin and Elements, familiarity with Elements
1111Remote Procedure Calls (RPCs), and some knowledge of the cryptography
@@ -15,14 +15,14 @@ used in Bitcoin are assumed.
1515## Overview of Confidential Assets
1616
1717Using Elements, the sender of a transaction can hide the amounts and
18- types of assets in a transaction’s outputs, in such a way that:
18+ types of assets in a transaction’s outputs, in such a way that:
1919
20201 . Only the sender and receiver of the transaction can see the actual
2121amounts and types of assets.
22222 . A verifier can prove that all assets coming out of a transaction
23- went into it.
23+ went into it.
24243 . The amounts and assets of the outputs may be revealed to a third
25- party, by the receiver or by the sender.
25+ party, by the receiver or by the sender.
2626
2727This feature is called Confidential Assets. To create a confidential
2828assets transaction, the recipient generates a Confidential Address and
@@ -34,10 +34,10 @@ transaction's outputs at will. The unblinding process is called
3434"rewinding", or "rewinding the range proof", and requires the private
3535blinding key of the confidential address. Either the sender or a
3636receiver may also share a blinding key with a third party, enabling
37- them to view, but not to spend, the transaction's outputs.
37+ them to view, but not to spend, the transaction's outputs.
3838
3939Confidential Assets transactions do not conceal the transaction ids or indexes on
40- the inputs (the transaction graph is public, as it is with Bitcoin).
40+ the inputs (the transaction graph is public, as it is with Bitcoin).
4141
4242A Confidential Transaction must also include an explicit (unblinded)
4343fee output, paid in the sidechain's default asset (L-BTC for Liquid).
@@ -75,7 +75,7 @@ having to see the actual value.
7575When assets are blinded in a transaction, a verifier cannot see which
7676input assets are sent to which outputs. A Surjection proof [ ^ 2 ] allows
7777a verifier to prove that an output’s asset appears in at least one
78- input, without revealing the actual asset type. In other words, the
78+ input, without revealing the actual asset type. In other words, the
7979mapping from input assets to the output asset must be an "onto" function, or a
8080"surjection". Every blinded transaction output has a Surjection
8181proof.
@@ -123,14 +123,14 @@ possible to send more than 21 million in any one unconfidential output. The ran
123123proof parameters are not part of consensus, and may be overridden and
124124adjusted using the ` ct_bits ` elements configuration parameter. Reducing
125125the number of bits will reduce the size of a transaction, and also
126- reduce the maximum provable value of any output.
126+ reduce the maximum provable value of any output.
127127
128128An Elements range proof is a Borromean ring signature [ ^ 4 ] over
129129possible values of each digit in the base 4 representation of an
130130output value. Each digit requires the storage of 4+1 elliptic curve
131131points. Not including a fixed size header for the range proof, the
132132space required for a range proof in Elements is approximately 80 bytes
133- per bit of precision (default 52).
133+ per bit of precision (default 52).
134134
135135The [ secp256k1-zkp range proof implementation] ( https://github.com/BlockstreamResearch/secp256k1-zkp/blob/master/include/secp256k1_rangeproof.h )
136136supports a maximum range of 64 bits. A range proof supporting a 64 bit
@@ -159,12 +159,12 @@ A confidential address combines a segwit address and a public blinding
159159key into a single checksummed string. This address format is called
160160"blech32" and is based on the "bech32" format that was introduced for
161161segwit. Liquid production addresses use the prefix "lq1". Liquid
162- regtest (elementsregtest) addresses use the prefix "el1".
162+ regtest (elementsregtest) addresses use the prefix "el1".
163163
164164By default, the Elements RPC ` getnewaddress ` will return a
165165confidential address. A non-confidential segwit address and a public
166166blinding key may be combined with the RPC ` createblindedaddress ` to
167- create a confidential address.
167+ create a confidential address.
168168
169169See the python script [ ../test/functional/test_framework/liquid_addr.py] ( ../test/functional/test_framework/liquid_addr.py )
170170for a reference implementation of blech32 addresses.
@@ -173,7 +173,7 @@ for a reference implementation of blech32 addresses.
173173## Workflow Considerations
174174
175175The steps for manually creating a confidential transaction using
176- Elements RPCs are as follows:
176+ Elements RPCs are as follows:
177177
1781781 . ` createrawtransaction ` – adds inputs and outputs to an empty
179179transaction. Any outputs using confidential addresses will be blinded.
@@ -202,45 +202,45 @@ zero-valued output.
202202An asset issuance creates a non-zero amount of a new asset, and zero
203203or more reissuance token that may be used to create more of the same
204204asset at a later time. Reissuance tokens are also called "inflation
205- keys".
205+ keys".
206206
207207In Elements, there are four types of transaction inputs:
208208
2092091 . "typical" inputs that spend UTXOs
2102102 . coinbase inputs
2112113 . peg-ins
212- 4 . asset issuances/reissuances.
212+ 4 . asset issuances/reissuances.
213213
214214An asset issuance input defines the ID of a new asset, some non-zero amount
215215of the asset to be issued, and zero or more reissuance tokens. While
216216the ID of the asset must be explicit (it is a property derived
217217from the issuance itself), the amount of the asset issued and the
218- number of reissuance tokens may be blinded in the input.
218+ number of reissuance tokens may be blinded in the input.
219219
220220An asset reissuance input issues an additional amount of an existing
221221asset. The ID of the asset being reissued cannot be blinded, but the
222- amount of additional asset being created can be blinded in the input.
222+ amount of additional asset being created can be blinded in the input.
223223
224224The range proofs for an input's issuance and reissuance amounts are
225- stored in the input witness.
225+ stored in the input witness.
226226
227227The non-fee outputs of an issuance transaction, as in any transaction
228228in Elements, may be blinded. There will be at least one output for the
229229new asset, an explicit (unblinded) output for the transaction fee, an
230230optional change output, and optionally at least one output for
231- reissuance tokens.
231+ reissuance tokens.
232232
233233See the elements transaction format document
234234[ elements-tx-format.md] ( ./elements-tx-format.md ) for more information.
235235
236236The private key used to blind the amount of an issuance or reissuance
237237input may be revealed or imported into an Elements wallet, using the
238238RPCs ` dumpissuanceblindingkey ` or ` importissuanceblindingkey ` ,
239- respectively.
239+ respectively.
240240
241241In summary, the id of an issued or reissued asset is always explicit,
242242but the issued amounts and destinations may be blinded and kept
243- confidential.
243+ confidential.
244244
245245
246246## Partially Signed Elements Transactions (PSET)
@@ -249,21 +249,21 @@ Partially Signed Bitcoin Transactions (PSBT) is a document standard
249249that allows multiple parties to construct and sign a bitcoin
250250transaction offline, before broadcasting it. Elements expands on PSBT
251251to provide support for assets and confidential transactions, with
252- Partially Signed Elements Transactions (PSET).
252+ Partially Signed Elements Transactions (PSET).
253253
254254Several Elements RPCs provide support for working with PSETs. Note
255255that the PSET RPCs in Elements retain "psbt" in their names of RPCs
256- adapted from Bitcoin core.
256+ adapted from Bitcoin core.
257257
258258A description of PSET is outside the scope of this document. Please
259259see [ pset.mediawiki] ( ./pset.mediawiki ) for more information.
260260
261261
262262## Elements RPCs
263263
264- RPCs that are directly related to Confidential Transactions are listed
265- here in the groups listed in the Elements help text. Note that some raw
266- transaction RPCs appear in the Wallet section. See the Elements RPC help
264+ RPCs that are directly related to Confidential Transactions are listed
265+ here in the groups listed in the Elements help text. Note that some raw
266+ transaction RPCs appear in the Wallet section. See the Elements RPC help
267267for details on parameters and invocation.
268268
269269
@@ -306,7 +306,7 @@ Blinds the outputs of a raw transaction (as might be created by
306306` rawblindrawtransaction `
307307Blinds the outputs of a raw transaction (as might be created by
308308` createrawtransaction ` ). This RPC requires that all blinding factors be
309- provided explicitly.
309+ provided explicitly.
310310
311311
312312### Wallet - Keys and Addresses
@@ -315,28 +315,28 @@ provided explicitly.
315315By default, generates a confidential address encoded as blech32 (see
316316"Confidential Addresses" section above). The public key is embedded in
317317the address along with the ScriptPubKey. A confidential address is a
318- tuple (confidential_key, unconfidential address).
318+ tuple (confidential_key, unconfidential address).
319319
320320` getaddressinfo `
321321Displays the (public) confidential and unconfidential properties of an address.
322322
323323` dumpblindingkey `
324324Reveals the private blinding key for a confidential address. A
325325third-party will need this key to unblind transactions (see
326- "Third-party Unblinding" below).
326+ "Third-party Unblinding" below).
327327
328328` dumpissuanceblindingkey `
329329Reveals the private blinding key that was used to blind the amounts on
330- an issuance input. This key is required when using reissuance tokens.
330+ an issuance input. This key is required when using reissuance tokens.
331331
332332` dumpmasterblindingkey `
333333Reveals the wallet's master blinding key from which all blinding keys for generated addresses are derived. See SLIP-007.
334334
335335` importaddress `
336336A confidential address may be imported at any time. However, in order
337337to unblind outputs for a confidential address, it is necessary to also
338- import the blinding key for that address' public blinding key
339- (called "confidential_key" in the RPC help).
338+ import the blinding key for that address' public blinding key
339+ (called "confidential_key" in the RPC help).
340340See the ` importblindingkey ` RPC.
341341
342342` importblindingkey `
@@ -345,7 +345,7 @@ Imports the private blinding key associated with an address.
345345` importissuanceblindingkey `
346346Imports a private blinding key that may be used to unblind the amounts
347347on an issuance input or to reissue additional amounts of an asset (using
348- reissuance tokens).
348+ reissuance tokens).
349349
350350` importmasterblindingkey `
351351*** Use with caution!*** Importing a master blinding key into a wallet will
@@ -371,10 +371,10 @@ A third-party may be granted the ability to unblind the amounts and
371371assets in a confidential transaction, without being able to spend the
372372transaction’s UTXOs. Using Elements, the third-party would create a
373373"watch-only wallet" for the addresses in question, and import the
374- private blinding keys for those addresses.
374+ private blinding keys for those addresses.
375375
376376Let's suppose that Alice has sent a confidential transaction to
377- Bob. Bob wants Victor to be able to see what and how much was sent.
377+ Bob. Bob wants Victor to be able to see what and how much was sent.
378378
379379Victor, with Bob’s help, creates a watch-only wallet in Elements:
380380
@@ -388,19 +388,19 @@ Victor, with Bob’s help, creates a watch-only wallet in Elements:
388388
389389Once the blinding key is imported, the Elements wallet will treat the
390390Confidential address address as watch-only, and its outputs will be
391- visible in transaction details and in the wallet balance.
391+ visible in transaction details and in the wallet balance.
392392
393393Please note that if Bob reuses an address A, Victor will also be able
394- to see the amounts and values in any transaction sending to A.
394+ to see the amounts and values in any transaction sending to A.
395395
396396Alternatively, a watch-only wallet may import the master blinding key
397397of another wallet. The watch-only wallet would then be able to view
398398the UTXOs for any confidential address created by the original
399- wallet.
399+ wallet.
400400
401- Anyone with the blinding key for an output's confidential address can rewind
401+ Anyone with the blinding key for an output's confidential address can rewind
402402the rangeproof for the output, and reveal the blinding factors and actual amounts and
403- assets that were committed to.
403+ assets that were committed to.
404404
405405Please see the [ Elements Project
406406tutorial] ( https://elementsproject.org/elements-code-tutorial/advanced-examples )
@@ -412,7 +412,7 @@ for examples of how to unblind with Elements.
412412An Elements wallet has a "master blinding key", from which all
413413blinding keys for that wallet are deterministically derived. A
414414blinding key for an address is generated as `HMAC_SHA256(master
415- blinding key, <address ScriptPubKey >)`. See SLIP-0077 [ ^ 6 ] .
415+ blinding key, <address ScriptPubKey >)`. See SLIP-0077 [ ^ 6 ] .
416416
417417Each confidential address has an associated confidential_key, which is
418418a public key embedded in the address and used by the sender to create
@@ -424,7 +424,7 @@ key" for the address.
424424
425425See
426426[ contrib/assets_tutorial/assets_tutorial.py] ( ../contrib/assets_tutorial/assets_tutorial.py )
427- for examples of using confidential transactions with assets.
427+ for examples of using confidential transactions with assets.
428428
429429See
430430[ test/functional/feature_confidential_transactions.py] ( ../test/functional/feature_confidential_transactions.py )
@@ -462,9 +462,9 @@ Wuille, Greg Maxwell. *Bulletproofs: Short Proofs for Confidential
462462Transactions and
463463More.* https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8418611
464464Retrieved 2023-03-08.
465-
465+
4664666 . SLIP-077 Proposal for wallet blinding key
467- derivation. https://github.com/satoshilabs/slips/blob/master/slip-0077.md
467+ derivation. https://github.com/satoshilabs/slips/blob/master/slip-0077.md
468468
469469
470470## See Also
0 commit comments