Grin Transactions - Reading Assignment

Privacy Coins - Ultimate Course
#21

  • Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?
    Because Alice can potentially respend those same funds even though they were sent to Bob.

  • Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?
    The reason Bob can’t immediately broadcast the transaction is that Alice still needs to generate the whole signature of the transaction consisting of both Alice’s partial signature and Bob’s whole signature.

  • What information does the transaction kernel contain?
    The signature of the transaction, the public key associated with the excess blinding factor, the transaction fee, and lock_height.

  • What pieces of information are actually broadcast in a Grin transaction?
    The inputs used, the new outputs, the transaction kernel, the kernel offset.

1 Like
#22

  1. Because Bob’s blinding factor and nonce will enable him to spend the outputs, so Alice cannot be allowed to choose them.

  2. Because Bob must send them back to Alice for her to co-sign before the transaction is broadcast.

  3. (a) The signature of the transaction (s, k * G)

    (b) The public key associated with the “excess blinding factor”

    © the tx fee and lock_height

  4. (a) Inputs used

    (b) Outputs

    © Transaction kernel

    (d) Kernel offset

1 Like
#23

  • Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?
    Because it is the “Bob´s secret” to control the output, that belongs to him.

  • Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?
    Because Alice wants to be sure that his founds are “well spended”, she has to add his Schnoor signature to Bob´s one (both partials) and verify the whole equation.

  • What information does the transaction kernel contain?
    The signature of the transaction / the public key associated with the “excess blinding factor” / the transacion fee / the lock high of the transaction.

  • What pieces of information are actually broadcast in a Grin transaction?
    The inputs used / the new outputs / the transaction kernel / the kernel offset.

1 Like
#24

1 - Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?

Knowing Bob's blinding factor (rr) and nonce (kr), Alice would have the ability to spend the transaction sent to Bob.

2 - Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?

In order to create the first half of a transaction signature, both partial signatures of Alice and Bob are required to be summed. The required second half of the transaction signature is comprised of sum of Alice and Bob’s commitment to their nonces, which neither of them know the other’s true nonce.

3 - What information does the transaction kernel contain?

The transaction kernel contains the proof that no money was printed out of thin air.

	- The signature of the transaction (s, k • G).
	- The public key associated with the “excess blinding factor” (in this case, 25•G). As described above, this can be used to validate s.
	- The transaction fee and lock_height of the transaction. (Note: if this was a Coinbase transaction, neither of these would be present).

4 - What pieces of information are actually broadcast in a Grin transaction?

	- the sum of partial signatures; sr•G = kr + e • rr and ss•G = ks + e • rs 
	- everything in e; e = SHA256( M | (kr • G) + (ks • G) | (rr•G + rs•G) ) 
	- the commitment to the excess blinding factor; (rr•G + rs•G)
	- the commitment to the sum of nonces; (kr • G) + (ks • G) 
	
	is publicly visible to everyone, so anyone can do this verification.
1 Like
#25

  1. Alice can’t choose Bob’s blinding factor or his nonce would me that once the trasnaction is compltete Alice could then go ahead and spend them.

  2. Bob can’t broadcast the transaction as he has only part signed this using the Schnorr signature.

  3. The transaction kernel contains the signature of the transaction, the public key associated with the excess blinding factor plus the transaction fee and lock height of the transaction.

  4. The only pieces of information that are broadcast are inputs used, the new outputs, the transaction kernal and the kernel offset.

1 Like
#26
  1. Otherwise she gets spending rights.
  2. Bob creates half of the key then Alice validates it and adds her half.
  3. The excess blinding factor
  • The inputs used.
  • The new outputs.
  • The transaction kernel.
  • The kernel offset
1 Like
#27

#1 - Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?
Because the she would be also able to spend the money she just send to bob

#2 - Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?
Because Alice has to validate Bob’s partial signature

#3 - What information does the transaction kernel contain?
transaction signature / public key / transaction fee / lock-height

#4 - What pieces of information are actually broadcast in a Grin transaction?
Input / Output / Kernel / Offset

1 Like
#28

  1. She could spend the funds of Bob after sending it to him.

  2. Both of them need to do a partial signatures otherwise the transaction is not valid. The signature includes ks and rs of Alice which she should never give to Bob. It is needed for check whether the transaction is valid or not. The signatures includes the sum of Alice and Bob partial signatures as well as the sum of Alice and Bobs commitment to their nonces (none of them know the exact number nonce from the other one). When you add the partial signatures of Alice and Bob (ss + sr) the entire transaction validity can be proven, because they add up to the commitment to the excess blinding factor.

  3. The transaction kernel contains the signature of the transaction, the public key associated with the excess blinding factor and the transaction fee as well as lock height (Together it is a proof that no money was printed out of thin air.=

  4. The inputs used, the new outputs, the transaction kernel, the kernel offset

1 Like
#29
  1. Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?
  • Because knowing the blinding factor and the nonce for an output mean that Alice will be able to spend this output after the transfer.
  1. Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?
  • Both parties must sign the transaction with their partial signature to complete the transaction.
  1. What information does the transaction kernel contain?
  • The signature of the transaction (s, k • G) .
  • The public key associated with the “ excess blinding factor ” (in this case, 25•G ).
  • The transaction fee and lock_height of the transaction.
  1. What pieces of information are actually broadcast in a Grin transaction?
  • The inputs used.
  • The new outputs.
  • The transaction kernel.
  • The kernel offset
1 Like
#30

image
image805×853 273 KB

1 Like
#31

  1. Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?
    Otherwise Allice would be able to get the funds of Bob.

  2. Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?
    Because Bob has no complete transaction, can only partially sign the transaction which will than be signed by alice.

  3. What information does the transaction kernel contain?
    The remaining transaction without the outputs. It contains information about the signature.

  4. What pieces of information are actually broadcast in a Grin transaction?

  • new outputsm the transaction kernal and the kernal offset
1 Like
#32

1. Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?
She would be able to spend the tx, even after sending the funds to Bob.

2. Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?
Both signatures are needed for a valid tx.

3. What information does the transaction kernel contain?

  • Signature of the tx

  • Public key associated with the excess blinding factor

  • Tx fee & lock_height of the tx

4. What pieces of information are actually broadcast in a Grin transaction?

  • Inputs used

  • New outputs

  • Tx kernel

  • Kernel offset

1 Like
#33
  • This is the only way to keep the Alice from abusing Bob and taking his Grin.
  • Because Alice needs to verify Bob’s commitment to his nonce (KrG) and his commitment to the blinding factor (rrG). And, validate Bob’s partial signature (sr) by multiplying it by generator G.
  • Signature of the Tx (s, k • G ), public key associated with the excess blinding factor ( 25•G ) which can be used to validate s, plus transaction fee and block height (none present in Coinbase Tx)
  • The inputs used, the new outputs, transaction kernel and transaction kernel offset.
#34

What is a lock_height? It is mentioned a number of times but not explained.

1 Like
#35

It’s okay. I’ve got it. The lock_height is the block number at which the transaction becomes valid.

1 Like
#36

  1. Alice can’t choose Bob’s blinding factor (rr) and nonce (kr) for him because if Alice knew them she would have enough information to spend the funds she has just sent to Bob.

  2. Bob can’t broadcast Alice’s partial transaction after choosing his blinding factor and nonce because he has created only half the signature of the transaction. Alice needs to verify that his blinding factor combined with her’s add up to make the correct total of excess blinding factor. She has to validate Bob’s partial signature.

  3. The information contained in the transaction kernel is; a) the signature of the transaction, b) the public key associated with the “excess blinding factor”, c) the transaction fee and lock_height.

  4. The pieces of information broadcast in GRIN transaction are; a) the inputs used, b) the new outputs, c) the transaction kernel and d) the kernel offset.

1 Like
#37
  1. Why else would she be able to spend the money she sent to Bob.
  2. Bob is able to enter only his signature part, the partial one. Alice will then insert her partial signature to obtain a complete signature. After that, Alice will have to do other things, which Bob can’t do.
  3. The kernel contains the following information:
    the signing of the transaction, the public key associated with the “excess blinding factor”, the transaction fee and lock_height of the transaction.
  4. The information broadcast in a Grin transaction is:
    The inputs used.
    The new outputs.
    The transaction kernel.
    The kernel offset
1 Like
#38

  1. Alice can not choose Bob’s blinding factor (rr) and nonce (kr) for him because that is the information needed to spend the the funds she just sent to Bob. Therefore Bob has to choose those factors.

  2. Bob cannot broadcast Alice’s partial transaction after choosing his blinding factor and nonce because he has only created half of the signature of the transaction. Alice needs to verify that his blinding factor combined with her’s add up to make the correct total of excess blinding factors. She has to validate Bob’s partial signature.

  3. The information contained in the transaction kernel is
    a) the signature of the transaction
    b) the public key associated with the excess blinding factor
    c) the transaction fee and lock height

  4. The pieces of information that are actually broadcast in a GRIN transaction are
    a) the inputs used
    b) the new outputs
    c) the transaction kernel
    d) the kernel offset

1 Like
#39
  1. Because Alice would be able to access the funds afterwards and double spend.
  2. Alice needs to validate Bob’s partial signature.
  3. tx signature, public key, tx fee, and the lock height.
  4. Inputs used, New Outputs, Tx kernel, and kernel offset.
#40
  1. Because if Alice chooses Bob’s blinding factor and nonce she would be able to take the funds she has just transferred to Bob for her own usage again.
  2. Because before doing that, Alice also needs to sign the transaction.
  3. The transaction kernel contains the signature of the transaction, the public key associated with the excess blinding factor, the transaction fee, and the lock_height.
  4. Inputs, Outputs, transaction kernel, and the kernel offset.