5
5
This document provides an overview and introduction to
6
6
the Confidential Assets implementation in Elements. A list of relevant
7
7
RPCs is provided as well as a list of references providing further
8
- information.
8
+ information.
9
9
10
10
A working knowledge of Bitcoin and Elements, familiarity with Elements
11
11
Remote Procedure Calls (RPCs), and some knowledge of the cryptography
@@ -15,14 +15,14 @@ used in Bitcoin are assumed.
15
15
## Overview of Confidential Assets
16
16
17
17
Using Elements, the sender of a transaction can hide the amounts and
18
- types of assets in a transaction’s outputs, in such a way that:
18
+ types of assets in a transaction’s outputs, in such a way that:
19
19
20
20
1 . Only the sender and receiver of the transaction can see the actual
21
21
amounts and types of assets.
22
22
2 . A verifier can prove that all assets coming out of a transaction
23
- went into it.
23
+ went into it.
24
24
3 . The amounts and assets of the outputs may be revealed to a third
25
- party, by the receiver or by the sender.
25
+ party, by the receiver or by the sender.
26
26
27
27
This feature is called Confidential Assets. To create a confidential
28
28
assets transaction, the recipient generates a Confidential Address and
@@ -34,10 +34,10 @@ transaction's outputs at will. The unblinding process is called
34
34
"rewinding", or "rewinding the range proof", and requires the private
35
35
blinding key of the confidential address. Either the sender or a
36
36
receiver may also share a blinding key with a third party, enabling
37
- them to view, but not to spend, the transaction's outputs.
37
+ them to view, but not to spend, the transaction's outputs.
38
38
39
39
Confidential Assets transactions do not conceal the transaction ids or indexes on
40
- the inputs (the transaction graph is public, as it is with Bitcoin).
40
+ the inputs (the transaction graph is public, as it is with Bitcoin).
41
41
42
42
A Confidential Transaction must also include an explicit (unblinded)
43
43
fee output, paid in the sidechain's default asset (L-BTC for Liquid).
@@ -75,7 +75,7 @@ having to see the actual value.
75
75
When assets are blinded in a transaction, a verifier cannot see which
76
76
input assets are sent to which outputs. A Surjection proof [ ^ 2 ] allows
77
77
a verifier to prove that an output’s asset appears in at least one
78
- input, without revealing the actual asset type. In other words, the
78
+ input, without revealing the actual asset type. In other words, the
79
79
mapping from input assets to the output asset must be an "onto" function, or a
80
80
"surjection". Every blinded transaction output has a Surjection
81
81
proof.
@@ -123,14 +123,14 @@ possible to send more than 21 million in any one unconfidential output. The ran
123
123
proof parameters are not part of consensus, and may be overridden and
124
124
adjusted using the ` ct_bits ` elements configuration parameter. Reducing
125
125
the number of bits will reduce the size of a transaction, and also
126
- reduce the maximum provable value of any output.
126
+ reduce the maximum provable value of any output.
127
127
128
128
An Elements range proof is a Borromean ring signature [ ^ 4 ] over
129
129
possible values of each digit in the base 4 representation of an
130
130
output value. Each digit requires the storage of 4+1 elliptic curve
131
131
points. Not including a fixed size header for the range proof, the
132
132
space required for a range proof in Elements is approximately 80 bytes
133
- per bit of precision (default 52).
133
+ per bit of precision (default 52).
134
134
135
135
The [ secp256k1-zkp range proof implementation] ( https://github.com/BlockstreamResearch/secp256k1-zkp/blob/master/include/secp256k1_rangeproof.h )
136
136
supports a maximum range of 64 bits. A range proof supporting a 64 bit
@@ -159,12 +159,12 @@ A confidential address combines a segwit address and a public blinding
159
159
key into a single checksummed string. This address format is called
160
160
"blech32" and is based on the "bech32" format that was introduced for
161
161
segwit. Liquid production addresses use the prefix "lq1". Liquid
162
- regtest (elementsregtest) addresses use the prefix "el1".
162
+ regtest (elementsregtest) addresses use the prefix "el1".
163
163
164
164
By default, the Elements RPC ` getnewaddress ` will return a
165
165
confidential address. A non-confidential segwit address and a public
166
166
blinding key may be combined with the RPC ` createblindedaddress ` to
167
- create a confidential address.
167
+ create a confidential address.
168
168
169
169
See the python script [ ../test/functional/test_framework/liquid_addr.py] ( ../test/functional/test_framework/liquid_addr.py )
170
170
for a reference implementation of blech32 addresses.
@@ -173,7 +173,7 @@ for a reference implementation of blech32 addresses.
173
173
## Workflow Considerations
174
174
175
175
The steps for manually creating a confidential transaction using
176
- Elements RPCs are as follows:
176
+ Elements RPCs are as follows:
177
177
178
178
1 . ` createrawtransaction ` – adds inputs and outputs to an empty
179
179
transaction. Any outputs using confidential addresses will be blinded.
@@ -202,45 +202,45 @@ zero-valued output.
202
202
An asset issuance creates a non-zero amount of a new asset, and zero
203
203
or more reissuance token that may be used to create more of the same
204
204
asset at a later time. Reissuance tokens are also called "inflation
205
- keys".
205
+ keys".
206
206
207
207
In Elements, there are four types of transaction inputs:
208
208
209
209
1 . "typical" inputs that spend UTXOs
210
210
2 . coinbase inputs
211
211
3 . peg-ins
212
- 4 . asset issuances/reissuances.
212
+ 4 . asset issuances/reissuances.
213
213
214
214
An asset issuance input defines the ID of a new asset, some non-zero amount
215
215
of the asset to be issued, and zero or more reissuance tokens. While
216
216
the ID of the asset must be explicit (it is a property derived
217
217
from the issuance itself), the amount of the asset issued and the
218
- number of reissuance tokens may be blinded in the input.
218
+ number of reissuance tokens may be blinded in the input.
219
219
220
220
An asset reissuance input issues an additional amount of an existing
221
221
asset. The ID of the asset being reissued cannot be blinded, but the
222
- amount of additional asset being created can be blinded in the input.
222
+ amount of additional asset being created can be blinded in the input.
223
223
224
224
The range proofs for an input's issuance and reissuance amounts are
225
- stored in the input witness.
225
+ stored in the input witness.
226
226
227
227
The non-fee outputs of an issuance transaction, as in any transaction
228
228
in Elements, may be blinded. There will be at least one output for the
229
229
new asset, an explicit (unblinded) output for the transaction fee, an
230
230
optional change output, and optionally at least one output for
231
- reissuance tokens.
231
+ reissuance tokens.
232
232
233
233
See the elements transaction format document
234
234
[ elements-tx-format.md] ( ./elements-tx-format.md ) for more information.
235
235
236
236
The private key used to blind the amount of an issuance or reissuance
237
237
input may be revealed or imported into an Elements wallet, using the
238
238
RPCs ` dumpissuanceblindingkey ` or ` importissuanceblindingkey ` ,
239
- respectively.
239
+ respectively.
240
240
241
241
In summary, the id of an issued or reissued asset is always explicit,
242
242
but the issued amounts and destinations may be blinded and kept
243
- confidential.
243
+ confidential.
244
244
245
245
246
246
## Partially Signed Elements Transactions (PSET)
@@ -249,21 +249,21 @@ Partially Signed Bitcoin Transactions (PSBT) is a document standard
249
249
that allows multiple parties to construct and sign a bitcoin
250
250
transaction offline, before broadcasting it. Elements expands on PSBT
251
251
to provide support for assets and confidential transactions, with
252
- Partially Signed Elements Transactions (PSET).
252
+ Partially Signed Elements Transactions (PSET).
253
253
254
254
Several Elements RPCs provide support for working with PSETs. Note
255
255
that the PSET RPCs in Elements retain "psbt" in their names of RPCs
256
- adapted from Bitcoin core.
256
+ adapted from Bitcoin core.
257
257
258
258
A description of PSET is outside the scope of this document. Please
259
259
see [ pset.mediawiki] ( ./pset.mediawiki ) for more information.
260
260
261
261
262
262
## Elements RPCs
263
263
264
- RPCs that are directly related to Confidential Transactions are listed
265
- here in the groups listed in the Elements help text. Note that some raw
266
- transaction RPCs appear in the Wallet section. See the Elements RPC help
264
+ RPCs that are directly related to Confidential Transactions are listed
265
+ here in the groups listed in the Elements help text. Note that some raw
266
+ transaction RPCs appear in the Wallet section. See the Elements RPC help
267
267
for details on parameters and invocation.
268
268
269
269
@@ -306,7 +306,7 @@ Blinds the outputs of a raw transaction (as might be created by
306
306
` rawblindrawtransaction `
307
307
Blinds the outputs of a raw transaction (as might be created by
308
308
` createrawtransaction ` ). This RPC requires that all blinding factors be
309
- provided explicitly.
309
+ provided explicitly.
310
310
311
311
312
312
### Wallet - Keys and Addresses
@@ -315,28 +315,28 @@ provided explicitly.
315
315
By default, generates a confidential address encoded as blech32 (see
316
316
"Confidential Addresses" section above). The public key is embedded in
317
317
the address along with the ScriptPubKey. A confidential address is a
318
- tuple (confidential_key, unconfidential address).
318
+ tuple (confidential_key, unconfidential address).
319
319
320
320
` getaddressinfo `
321
321
Displays the (public) confidential and unconfidential properties of an address.
322
322
323
323
` dumpblindingkey `
324
324
Reveals the private blinding key for a confidential address. A
325
325
third-party will need this key to unblind transactions (see
326
- "Third-party Unblinding" below).
326
+ "Third-party Unblinding" below).
327
327
328
328
` dumpissuanceblindingkey `
329
329
Reveals the private blinding key that was used to blind the amounts on
330
- an issuance input. This key is required when using reissuance tokens.
330
+ an issuance input. This key is required when using reissuance tokens.
331
331
332
332
` dumpmasterblindingkey `
333
333
Reveals the wallet's master blinding key from which all blinding keys for generated addresses are derived. See SLIP-007.
334
334
335
335
` importaddress `
336
336
A confidential address may be imported at any time. However, in order
337
337
to unblind outputs for a confidential address, it is necessary to also
338
- import the blinding key for that address' public blinding key
339
- (called "confidential_key" in the RPC help).
338
+ import the blinding key for that address' public blinding key
339
+ (called "confidential_key" in the RPC help).
340
340
See the ` importblindingkey ` RPC.
341
341
342
342
` importblindingkey `
@@ -345,7 +345,7 @@ Imports the private blinding key associated with an address.
345
345
` importissuanceblindingkey `
346
346
Imports a private blinding key that may be used to unblind the amounts
347
347
on an issuance input or to reissue additional amounts of an asset (using
348
- reissuance tokens).
348
+ reissuance tokens).
349
349
350
350
` importmasterblindingkey `
351
351
*** Use with caution!*** Importing a master blinding key into a wallet will
@@ -371,10 +371,10 @@ A third-party may be granted the ability to unblind the amounts and
371
371
assets in a confidential transaction, without being able to spend the
372
372
transaction’s UTXOs. Using Elements, the third-party would create a
373
373
"watch-only wallet" for the addresses in question, and import the
374
- private blinding keys for those addresses.
374
+ private blinding keys for those addresses.
375
375
376
376
Let's suppose that Alice has sent a confidential transaction to
377
- Bob. Bob wants Victor to be able to see what and how much was sent.
377
+ Bob. Bob wants Victor to be able to see what and how much was sent.
378
378
379
379
Victor, with Bob’s help, creates a watch-only wallet in Elements:
380
380
@@ -388,19 +388,19 @@ Victor, with Bob’s help, creates a watch-only wallet in Elements:
388
388
389
389
Once the blinding key is imported, the Elements wallet will treat the
390
390
Confidential address address as watch-only, and its outputs will be
391
- visible in transaction details and in the wallet balance.
391
+ visible in transaction details and in the wallet balance.
392
392
393
393
Please note that if Bob reuses an address A, Victor will also be able
394
- to see the amounts and values in any transaction sending to A.
394
+ to see the amounts and values in any transaction sending to A.
395
395
396
396
Alternatively, a watch-only wallet may import the master blinding key
397
397
of another wallet. The watch-only wallet would then be able to view
398
398
the UTXOs for any confidential address created by the original
399
- wallet.
399
+ wallet.
400
400
401
- Anyone with the blinding key for an output's confidential address can rewind
401
+ Anyone with the blinding key for an output's confidential address can rewind
402
402
the rangeproof for the output, and reveal the blinding factors and actual amounts and
403
- assets that were committed to.
403
+ assets that were committed to.
404
404
405
405
Please see the [ Elements Project
406
406
tutorial] ( https://elementsproject.org/elements-code-tutorial/advanced-examples )
@@ -412,7 +412,7 @@ for examples of how to unblind with Elements.
412
412
An Elements wallet has a "master blinding key", from which all
413
413
blinding keys for that wallet are deterministically derived. A
414
414
blinding key for an address is generated as `HMAC_SHA256(master
415
- blinding key, <address ScriptPubKey >)`. See SLIP-0077 [ ^ 6 ] .
415
+ blinding key, <address ScriptPubKey >)`. See SLIP-0077 [ ^ 6 ] .
416
416
417
417
Each confidential address has an associated confidential_key, which is
418
418
a public key embedded in the address and used by the sender to create
@@ -424,7 +424,7 @@ key" for the address.
424
424
425
425
See
426
426
[ contrib/assets_tutorial/assets_tutorial.py] ( ../contrib/assets_tutorial/assets_tutorial.py )
427
- for examples of using confidential transactions with assets.
427
+ for examples of using confidential transactions with assets.
428
428
429
429
See
430
430
[ test/functional/feature_confidential_transactions.py] ( ../test/functional/feature_confidential_transactions.py )
@@ -462,9 +462,9 @@ Wuille, Greg Maxwell. *Bulletproofs: Short Proofs for Confidential
462
462
Transactions and
463
463
More.* https://ieeexplore.ieee.org/stamp/stamp.jsp?tp=&arnumber=8418611
464
464
Retrieved 2023-03-08.
465
-
465
+
466
466
6 . SLIP-077 Proposal for wallet blinding key
467
- derivation. https://github.com/satoshilabs/slips/blob/master/slip-0077.md
467
+ derivation. https://github.com/satoshilabs/slips/blob/master/slip-0077.md
468
468
469
469
470
470
## See Also
0 commit comments