Hi John, Thank you for your interest.
> How do Alice and Bob compute this when r must remain Olivia's secret? I see the confusion. There are two completely different r values, but I neglected to mark them as such. Olivia never reveals her r and simply uses it to calculate s1 or s2 (creating an ordinary Schnorr signature).. The other r is chosen by Alice + Bob (note that I treated them as a single person C for simplification). Alice + Bob only need s1 or s2 (not r) from Olivia in order to complete the signature on one of their two contracts. Hopefully this clears up the confusion. Cheers, Ruben Somsen On Tue, May 22, 2018 at 10:51 PM, John Tromp <john.tr...@gmail.com> wrote: > dear Ruben, > > > Olivia will publish "yes" or "no" under her key O and commitment R. > > > > This means there are two possible values for S: > > > > S1 = R + hash(R, "yes")*O > > S2 = R + hash(R, "no")*O > > > > Alice and Bob create a payment channel under key A + B = C with 1 BTC > each. > > > > They propose two possible channel updates: 2 BTC for Alice if it rains, > or 2 > > BTC for Bob if it doesn't. > > > > The channel update (simplified to single key C) where Alice wins is > signed > > with: > > > > R1 = r*G + S1 > > s' = r + hash(R1, transaction)*c > > How do Alice and Bob compute this when r must remain Olivia's secret? > > regards, > -John >
-- Mailing list: https://launchpad.net/~mimblewimble Post to : mimblewimble@lists.launchpad.net Unsubscribe : https://launchpad.net/~mimblewimble More help : https://help.launchpad.net/ListHelp
