Content

  • Introduction

  • What are Confidential Transactions?

  • An Overview of Related Cryptography

  • What can Confidential Transactions do?

  • Final considerations


Introduction

System transparency is often considered a critical factor for the functioning of a blockchain. This means that every node on the network can store a copy and check that no rules are being violated. On many distributed ledgers, anyone can use an online block explorer that allows them to search for blocks, transactions, and addresses.

In terms of privacy, this is not ideal. In a system like Bitcoin, all transactions can be linked to a previous one. Currencies are technically non-fungible, meaning each can be tied to specific transactions. No one can stop you from sending Bitcoin, but they can refuse your transaction if those coins have previously passed through an address on the rejected list.

In the worst case, the lack of fungibility can have a major impact on the very foundations of the system. "Clean" (honest) coins may be awarded, while older ones would be less valuable, given their history.

In terms of privacy, users of the Bitcoin network often suffer from great exposure. Not only can coins be tracked, but also users themselves. They use pseudonyms (they do not disclose names, only public addresses), but this does not guarantee your privacy. There are sophisticated analysis techniques that can accurately group addresses to identify entities on a network.

Confidential Transactions represent a proposed update to make transactions truly private.


What are Confidential Transactions?

Confidential Transactions (CT) were first discussed in 2013 by Blockstream CEO Adam Back. Later, Bitcoin developer Gregory Maxwell increased the use of Confidential Transactions. Maxwell described the problems mentioned in the first section (regarding fungibility and privacy) – and proposed a solution. Amounts transferred could be shielded (hidden) from the wider network, so that only the parties involved in the transaction would know how much had been sent.

Under normal circumstances (with publicly visible transactions), it is easy for a node to verify that the amount received does not exceed the amount sent. If Alice wants to send 0.3 BTC to Bob, she takes an unspent output (let's consider 1 BTC) and divides it into two parts: 0.3 to send to Bob and 0.69 to her (the remainder is used to pay the mining fee).

It's simple math for the other nodes: 1 is greater than 0.3 + 0.69, the signatures are all correct, and Alice's inputs haven't yet been spent elsewhere, so the transaction must be valid. When values ​​are hidden, however, this process is not so trivial. How would it be possible to assess whether an unknown amount is equal to or greater than the sum of two other unknown amounts?


To hide data, encryption is necessary. However, traditional methods are similar to placing documents in a safe: once locked, they become unusable until they are removed from the safe. What we need for Confidential Transactions to work is a digital safe whose contents are not revealed, but whose properties can be verified by an outsider.

The answer lies, specifically, in homomorphic encryption, in a scheme called "Pedersen commitment". This type of encryption allows external users to perform operations on encrypted data (which they cannot see) for various purposes.

A regular hash can be used to confirm data that you want to reveal later. Suppose you want to announce a competition on social media, where whoever guesses your favorite exchange will win a prize of 0.01 BTC. Users may not trust the validity of your competition, claiming that you can simply look at the responses after the close and reveal an exchange that has not been mentioned by anyone.

You could provide your followers with a hash: a sequence of seemingly random numbers and characters that refer to a specific input. Through a function, you transform the information from your exchange to obtain a certain output. We will illustrate with the SHA256 algorithm:


f1624fcc63b615ac0e95daf9ab78434ec2e8ffe402144dc631b055f711225191


Looking at this, you have no idea what the input was. And you can't reverse the function to get it. However, if you know the input was “Binance”, you can easily check if the hash matches what is shown above. This way, your followers have the guarantee that you will not change your answer at the end of the competition – which would produce a totally different output.

Realistically, though, this isn't very safe. Although your followers cannot reverse engineer the algorithm, they could create a list of possible exchanges, obtaining the hash of each one until they find the corresponding one. You can reduce the likelihood of this type of action by adding some random data called a "blinding factor" to the data we will use to create the hash function.

If we use the input “Binance is my favorite exchange, I love it more than any other exchange 2#43Wr”, it will be much more difficult for a user to guess the answer in the way mentioned above (for 0.01 BTC, it would be unlikely for anyone to try).

A "Pedersen commitment" allows us to add inputs behind commits (database changes). As Maxwell illustrates:


C(BF1 + D1) + C(BF2 + D2) = C(BF1 + BF2, D1 + D2)

Where BF is the blinding factor and D is the data


There are a few more steps that involve elliptic curve cryptography and range proofs, but the basic idea is that a user has a "Pedersen commitment" for the address itself. When sending funds, two additional commits are created (one for the address of the user who will receive the change and one for the address of the transfer destination).

No one knows the amount being sent, but it is possible to verify that the commits of the change and the destination address (left side of the Maxwell equation) correctly correspond to the source address (right side of the equation). If the correspondences are correct, the user's transaction is valid, as it can be proven that the inputs are the same as the outputs.


What can Confidential Transactions do?

If Confidential Transactions were implemented on the Bitcoin network, we would have a system with much more privacy. Inputs and outputs would be disguised in the general network and entries in the ledger would be hidden - but nodes would still be able to verify their authenticity. With this significant increase in privacy, Bitcoin could become effectively fungible, as chain analysis would no longer reveal the history of a given unit.

At the moment, the integration of Confidential Transactions into the protocol does not seem likely. With this additional functionality, transactions would be much larger than standard – considering the limited block space, this would only increase demand. This addition would also require a majority of participants to agree to change the code, a traditionally difficult task.


Final considerations

Confidential Transactions have seen some iterations in other cryptocurrencies and alternative chains (sidechains) to Bitcoin. Monero, for example, uses them in combination with structures called "ring signatures" to achieve anonymity and fungibility. The Liquid sidechain and the MimbleWimble protocol also use them to provide greater privacy.

Despite the benefits they provide, Confidential Transactions have a downside. Cryptocurrencies often face scalability and performance issues at the base layer. Therefore, the increase in the size of transactions is far from being a desired change. Still, privacy advocates believe that hiding transaction amounts and preserving user anonymity are essential measures for cryptocurrency to actually operate as a fungible currency.