Grin Transactions - Reading Assignment

[tony1999]

1. Because knowing those values will allow Alice to manipulate the funds even after she has sent them to him.
2. Because Bob can partially sign the transaction using his Schnorr signature. Alice then needs to add her signature to the transaction to create the full signature of the transaction.
3. The signature of the transaction (s, kxG), the public key associated with the “excess blinding factor” (in this case, 25xG - As described above, this can be used to validate s), and the transaction fee and lock_height of the transaction (Note: if this was a Coinbase transaction, neither of these would be present).
4. The information broadcasted includes the inputs used, the new outputs, the TXN kernel and the kernel offset.

[Timbalasian]

Because blinding factors would allow Alice to have access to Bob’s transaction.

You can’t broadcast the transaction without a complete set of set of signatures and blinding factors.

• The signature of the transaction (s, k • G) ; The public key associated with the “ excess blinding factor ”; The transaction fee and lock_height of the transaction.

• The inputs used.

• The new outputs.

• The transaction kernel.

• The kernel offset

[moragarcia75]

1. Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?

Alice could spend the funds she just sent even after she sent them.

2. Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?

He needs Alice partial signature to create the signature of the entire transaction.

3. What information does the transaction kernel contain?

• The signature of the transaction (s, k • G).

• The public key associated with the “excess blinding factor” (in this case, 25•G). As described above, this can be used to validate s.

• The transaction fee and lock_height of the transaction. (Note: if this was a Coinbase transaction, neither of these would be present).

4. What pieces of information are actually broadcast in a Grin transaction?

• The inputs used.

• The new outputs.

• The transaction kernel.

• The kernel offset.

[Konzaih]

1.) if she knew, she could control funds after having sent them
2.) Because he has to send his data back to Alice for her to create a Group Signature
3.) -sig of trx -pub key -trx fee -trx lock-height
4.) -inputs used -new outputs -trx kernel -kernel offset

[Randallcrum]

1. If Alice knows Bob’s blinding factor and nonce, she could sign/spend on his behalf in the future for the funds she is sending now.
2. Bob returns his partial signature which contains a commitment to his nonce to Alice. On receiving it, she can generate the signature of the transaction which includes the both of their commitments to their nonces. Neither knows the other’s, but Bob’s commitment proves that he knows his and that commitment gets included in the signature.
3. Mining inputs, unspent transactions, and transaction kernels.
4. used inputs, new outputs, transaction kernels, and kernel offsets.

[Sunshine52816]

1. Because if she had the bling factor, she could act on the funds even if they are in Bob´s wallet

2. Because he only choses his part and Alice has to verify if the blinding factors match or add up before broadcasting and realizing the tx

3. a) The signature of the transaction (s, k • G) .
   b) The public key associated with the “ excess blinding factor ”
   c) The transaction fee and lock height of the transaction.

4. The information that is broadcasted is witch inputs are new outputs, the tx kernel and kernel offset

[PabloAAAJ]

1. Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?

Because in that case, Alice would know Bob’s blinding factor and nonce, allowing her to spend his funds

2. Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?

Bob can’t broadcast the transaction, because Alice’s signature is missing.
He sends to Alice his partial signature to be added to Alice’s partial signature and create the complete signature of the entire transaction.

3. What information does the transaction kernel contain?

• The signature of the transaction (s, k • G).
• The public key associated with the “excess blinding factor”
• The transaction fee and lock_height of the transaction

4. What pieces of information are actually broadcast in a Grin transaction?

The only things broadcast to the network from the transaction are:

• The inputs used
• The new outputs
• The transaction kernel
• The kernel offset

[jordanv]

1. Because alice would have control over the sent funds.

2. Because bob needs alice to verify and sign off on the information received back

3. Signature, Public Key + Excess blinding factor + Trandsaction fee +Lock height

4. Inputs used + new outputs +TX Kernel + Kernel offset

[makinitnow]

1. Alice can’t choose Bob’s blinding factor (rr) and nonce (kr) for him because Bob generates the Schnorr challenge (e) to generate his Schnorr signature (sr, partial signature) for the transaction, it will eventually be added to Alice’s partial signature to create the signature of the entire transaction.
   Alice now has everything she needs to also compute e , the Schnorr challenge for this transaction, locally. After having computed e locally, Alice can then validate Bob’s partial signature .
   Bob is the one who has to know his commitment to the nonce (krG) and the blinding factor (rrG).

2. Because Alice has to compute e locally in order to allow the broadcasting of the transaction.

3. The transaction kernel contains the information we use to validate the transaction:

• the signature of the transaction,
• the public key associated with the excess blinding factor,
• the transaction fee and lock_height of the transaction.
  (not present for Coinbase transactions).

4. Pieces of information broadcast to the network in a Grin transaction

• the inputs used,
• the new outputs,
• the transaction kernel,
• the kernel offset.

[Cosmin_Fechet]

1. Because Alice could then spend the funds of Bob after sending it to him.

2. Both parties must sign the transaction with their partial signature to complete the transaction.

3. a. The signature of the transaction (s, k • G).
   b. The public key associated with the “excess blinding factor” (in this case, 25•G). As described above, this can be used to validate s.
   c. The transaction fee and lock_height of the transaction. (Note: if this was a Coinbase transaction, neither of these would be present).

4. a. The inputs used.
   b. The new outputs.
   c. The transaction kernel.
   d. The kernel offset (which I didn’t cover here).

[Pavlo]

1. Because she will be able to spend the money she send to Bob.
2. Because he requires Alices signature to complete the transaction and prove that no money was generated out of thin air by this transaction.
3. The following information is stored in the kernel:

• The signature of the transaction (s, k • G) .
• The public key associated with the “ excess blinding factor ”. As described above, this can be used to validate s .
• The transaction fee and lock_height of the transaction.

4. The only things broadcast to the network from the transaction are:

• The inputs used.
• The new outputs.
• The transaction kernel.
• The kernel offset (which I didn’t cover here).

[Nboland]

1)That would give Alice the power to take Bob’s funds
2)Because Alice needs to verify Bob’s commitments to his Nonce and blinding factor and validate his signature
3) The signature of the transaction
The public key associated with the excess blinding factor
The transaction fee and lock_height* of the transaction.
4)Inputs, new outputs, transaction kernel and kernel offset.

[Maggie]

1. To prove validity of the entire transaction, it also requires Bob’s partial signature which to be created by a commitment and Schnorr signature.

2. Because transaction is still pending for Bob to send partial signature back to Alice for validation before Alice could generate her partial signature to complete the transaction signature.

3. The transaction kernel contains the signature of the transaction, the public key associated with the excess blinding factor, the transaction fee and the lock_height of the transaction.

4. The inputs used, the new outputs, the transaction kernel, and the kernel offset.

[SweetNetworker]

1. If Alice chose Bob’s blinding factor and nonce she would be able to take the funds just transferred to Bob and use them again.

2. Alice needs to complete the transaction by signing.

3. • the signature of the transaction
   • the public key associated with the excess blinding factor
   • the transaction fee and lock_height of the transaction
4. • the inputs used
   • the new outputs
   • the transaction kernel
   • the kernel offset

[gunnarseay]

1.) Alice can’t choose Bob’s blinding factor (rr) and nonce (kr) for him because she would be able to double-spend the funds she sent to Bob (spend them after the initial send).
2.) Bob can’t broadcast the transaction afterwards because a commitment from both sides (including Alice) needs to be held in order for the transaction to be fully carried out. Alice only has constructed a partial signature, which means in order to spend output 1, she needs to know the value of the input as well as the blinding factor of the input.
3.) The information contained in the transaction kernel is the final signature of the transaction (s, k G), the public key associated with the “excess blinding factor”, and the transaction fee/lock height.
4.) The pieces of information that are actually broadcasted in a Grin transaction are the inputs used, the new outputs, the transaction kernel (information within shown above), and the kernel offset.

[jak]

Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?

Alice can’t choose Bob’s blinding factor, because if she did then she would be able to re-spend his funds, even after she we to make an outbound transaction to him.

Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?

It is mathematically required the Bob generate a Schnorr Signature for the transaction, sr (r being for recipient). The transaction will then be completed with Alice’s partial signature in order to broadcast a valid transaction

What information does the transaction kernel contain?

The transaction kernel contains 3 pieces of information:

1. The signature of the transaction (s, k • G),
2. The public key associated with the excess blinding factor - used to validate validate s, and
3. The transaction fee and lock_height (in non-coinbase transactions).

What pieces of information are actually broadcast in a Grin transaction?

The pieces of information which are actually broadcasted to the network from a transaction are:

1. The inputs used,
2. The new outputs,
3. The transaction kernel (^^ info above ^^), and
4. The kernel offset

[SDMRDEL7890]

1. Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him ? : If Alice knew Bob’s blinding factor and nonce she would be able extract the funds she has transferred to Bob.

2. Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce? : Bob generates e (Partial signature) Schnorr signature for transaction, sr ( r for recipient). Even though its Bob’s complete signature, we call this Bob’s partial signature, because it will eventually be added to Alice’s partial signature to create the signature of the entire transaction.

3. What information does the transaction kernel contain? :

• The signature of the transaction (s, k • G).
• The public key associated with the “excess blinding factor” (in this case, 25•G). As described above, this can be used to validate s.
• The transaction fee and lock_height of the transaction. (Note: if this was a Coinbase transaction, neither of these would be present).

4. What pieces of information are actually broadcast in a Grin transaction?

• The inputs used.
• The new outputs.
• The transaction kernel.
• The kernel offset.

[Devo]

1. Why can’t Alice choose Bob’s binding factor (rr) and nonce (kr) for him?
   If Alice knew Bob’s blinding factor (rr) and nonce (kr) she could take the transferred funds to Bob, even once the transaction has been completed.

2. Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?
   Because Alice needs to partially-sign the transaction first so it can be broadcasted onto the network when Bob partially-sign the transaction through his Schnorr signature.

3. What information does the transaction kernel contain?

• The signature of the transaction (s, k x G).
• The public key associated with the “excess blinding factor” (in the case, 25xG). This can be used to validate s.
• The transaction fee and lock_height of the transaction. (Note: if this was Coinbase transaction, neither of these would be present).

4. What pieces of information are actually broadcast in a Grin transaction?

• The inputs used.
• The new outputs.
• The transaction kernel.
• The kernel offset.

[hmpbkj]

1. When Alice creates a partial transaction and sends it to Bob, the transaction includes a “commitment” to the inputs and outputs of the transaction, as well as a “blinding factor” (also known as a “nonce”) that is used to obscure the specifics of the transaction. However, the transaction does not include the specific details of the inputs and outputs, or the specific values of the blinding factor and nonce.

2. Bob can choose his own blinding factor and nonce when he receives the partial transaction from Alice, and use these values to construct a valid transaction that spends the output created by Alice. However, he cannot simply broadcast the transaction as-is, because the transaction kernel (which is included in the transaction and contains information about the inputs and outputs of the transaction) has been constructed using Alice’s blinding factor and nonce.

3. The transaction kernel contains a “commitment” to the inputs and outputs of the transaction, as well as a “signature” that is created using the blinding factor and nonce. In order to spend the output, Bob must use his own blinding factor and nonce to create a new signature for the transaction kernel, which he can then include in the transaction when he broadcasts it.

4. When a Grin transaction is broadcast, the transaction kernel (including the commitment and signature) is included, as well as the specific details of the inputs and outputs (including the addresses of the parties involved and the amounts being transferred). The transaction also includes the specific values of the blinding factor and nonce that were used to construct the transaction.

[Joeyj007]

• Why can’t Alice choose Bob’s blinding factor (rr) and nonce (kr) for him?
  This would be like knowing someone’s private key so Alice could potentially steal Bob’s funds.

• Alice constructs a partial transaction and sends it to Bob. Why can’t Bob broadcast the transaction after choosing his blinding factor and nonce?
  Bob uses e to generate his Schnorr signature for the transaction, sr ( r for recipient ). Though it is the entirety of Bob’s signature, we call this Bob’s partial signature, because it will eventually be added to Alice’s partial signature to create the signature of the entire transaction.

• What information does the transaction kernel contain?

The following information is stored in the kernel:

• The signature of the transaction (s, k • G) .

• The public key associated with the “ excess blinding factor*.

• The transaction fee and lock_height of the transaction.

• What pieces of information are actually broadcast in a Grin transaction?
  The only things broadcast to the network from the transaction are:

• The inputs used.

• The new outputs.

• The transaction kernel.

• The kernel offset