From 770fc7b49927bb106f793c9ffb2431fcf7cda097 Mon Sep 17 00:00:00 2001 From: wintercooled Date: Tue, 24 Mar 2020 10:40:52 +0000 Subject: [PATCH 1/5] maximum confidential amount adjustment --- features/confidential-transactions/index.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/features/confidential-transactions/index.md b/features/confidential-transactions/index.md index 7ff20fe..5b42ce7 100644 --- a/features/confidential-transactions/index.md +++ b/features/confidential-transactions/index.md @@ -90,13 +90,11 @@ elements-cli sendrawtransaction $TX The implementation of Confidential Transactions as it appears in Elements has some important limitations to be aware of. -The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. Subsequently, there is a "minimum confidential amount" around 0.0001, and a "maximum confidential amount" that is 232 times the minimum amount. - -Digits smaller than the minimum will be revealed to observers; for example, if the minimum is 0.0001, a transaction output of 123.456789 will look like "?.????89". The tiny amount of information about the value leaked in this way is unlikely to be important, but be aware that this could allow observers to "follow" coins by linking subsequent transactions with identical amounts. All values can be rounded to the minimum to avoid revealing information in this way if preferred. +The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. Subsequently, the default "maximum confidential amount" is just over 45 million (45,035,996.27370496). For assets that are pegged to Bitcoin, such as L-BTC on the Liquid network, it is impossible to exceed 2^52 satoshis. For other Issued Assets it may be possible to exceed the maximum confidential amount by repeatedly reissuing the asset and then spending an amount greater than the limit in a single transaction, and so the limitation should be noted. A transaction output larger than the maximum will reveal the order of magnitude of the amount to observers, and will also reveal additional digits at the bottom of the amount. -For example, if the maximum is 500k, then all outputs under that amount will look the same, but an output between 500k and 5M will be visible as such to observers (but not the exact amount within that range), and will also reveal one additional digit of the low end of the amount. Revealing the range in this way could be a very significant privacy leak; splitting such extremely large transactions to keep them under the maximum confidential amount is strongly recommended. +For example, if the maximum is 45 million, then all outputs under that amount will look the same, but an output between 45 million and 450 million will be visible as such to observers (but not the exact amount within that range), and will also reveal one additional digit of the low end of the amount. Revealing the range in this way could be a very significant privacy leak; splitting such extremely large transactions to keep them under the maximum confidential amount is strongly recommended. ### Find out more about Confidential Transactions From d3de4d456d9c12a338e547d837b50872d5908402 Mon Sep 17 00:00:00 2001 From: wintercooled Date: Wed, 25 Mar 2020 09:52:10 +0000 Subject: [PATCH 2/5] refer to 52 bits as default --- features/confidential-transactions/index.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/features/confidential-transactions/index.md b/features/confidential-transactions/index.md index 5b42ce7..d0aaf35 100644 --- a/features/confidential-transactions/index.md +++ b/features/confidential-transactions/index.md @@ -90,11 +90,11 @@ elements-cli sendrawtransaction $TX The implementation of Confidential Transactions as it appears in Elements has some important limitations to be aware of. -The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. Subsequently, the default "maximum confidential amount" is just over 45 million (45,035,996.27370496). For assets that are pegged to Bitcoin, such as L-BTC on the Liquid network, it is impossible to exceed 2^52 satoshis. For other Issued Assets it may be possible to exceed the maximum confidential amount by repeatedly reissuing the asset and then spending an amount greater than the limit in a single transaction, and so the limitation should be noted. +The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. The default blinding precision is 52-bits, which will cover any value up to 2^52 satoshi. The default equates to a maximum amount of just over 45 million. For assets that are pegged to Bitcoin, such as L-BTC on the Liquid network, this provides cover for all possible pegged asset transactions. It should be noted that for Issued Assets it is possible to exceed the default maximum confidential amount by repeatedly reissuing the asset and then spending an amount greater than the limit in a single transaction. A transaction output larger than the maximum will reveal the order of magnitude of the amount to observers, and will also reveal additional digits at the bottom of the amount. -For example, if the maximum is 45 million, then all outputs under that amount will look the same, but an output between 45 million and 450 million will be visible as such to observers (but not the exact amount within that range), and will also reveal one additional digit of the low end of the amount. Revealing the range in this way could be a very significant privacy leak; splitting such extremely large transactions to keep them under the maximum confidential amount is strongly recommended. +For example, if the user uses the default blinding precision of 52 bits, then all outputs under that amount will look the same, but an output between 45 million and 450 million will be visible as such to observers (but not the exact amount within that range), and will also reveal one additional digit of the low end of the amount. Revealing the range in this way could be a very significant privacy leak; splitting such extremely large transactions to keep them under the maximum confidential amount is strongly recommended. ### Find out more about Confidential Transactions From f28120d3bad03bdcb0de35a559c05de83fe7e3d3 Mon Sep 17 00:00:00 2001 From: wintercooled Date: Wed, 25 Mar 2020 11:09:08 +0000 Subject: [PATCH 3/5] remove dash --- features/confidential-transactions/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/features/confidential-transactions/index.md b/features/confidential-transactions/index.md index d0aaf35..e2300cf 100644 --- a/features/confidential-transactions/index.md +++ b/features/confidential-transactions/index.md @@ -90,7 +90,7 @@ elements-cli sendrawtransaction $TX The implementation of Confidential Transactions as it appears in Elements has some important limitations to be aware of. -The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. The default blinding precision is 52-bits, which will cover any value up to 2^52 satoshi. The default equates to a maximum amount of just over 45 million. For assets that are pegged to Bitcoin, such as L-BTC on the Liquid network, this provides cover for all possible pegged asset transactions. It should be noted that for Issued Assets it is possible to exceed the default maximum confidential amount by repeatedly reissuing the asset and then spending an amount greater than the limit in a single transaction. +The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. The default blinding precision is 52 bits, which will cover any value up to 2^52 satoshi. The default equates to a maximum amount of just over 45 million. For assets that are pegged to Bitcoin, such as L-BTC on the Liquid network, this provides cover for all possible pegged asset transactions. It should be noted that for Issued Assets it is possible to exceed the default maximum confidential amount by repeatedly reissuing the asset and then spending an amount greater than the limit in a single transaction. A transaction output larger than the maximum will reveal the order of magnitude of the amount to observers, and will also reveal additional digits at the bottom of the amount. From 7630fae378e00cde1665dab72d17b6328163658c Mon Sep 17 00:00:00 2001 From: wintercooled Date: Tue, 7 Apr 2020 12:57:19 +0100 Subject: [PATCH 4/5] Notes on default max tx amount --- features/confidential-transactions/index.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/features/confidential-transactions/index.md b/features/confidential-transactions/index.md index e2300cf..185cfb7 100644 --- a/features/confidential-transactions/index.md +++ b/features/confidential-transactions/index.md @@ -88,13 +88,13 @@ elements-cli sendrawtransaction $TX ### Limitations -The implementation of Confidential Transactions as it appears in Elements has some important limitations to be aware of. +The implementation of Confidential Transactions, as it appears in Elements, has some important limitations to be aware of. -The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. The default blinding precision is 52 bits, which will cover any value up to 2^52 satoshi. The default equates to a maximum amount of just over 45 million. For assets that are pegged to Bitcoin, such as L-BTC on the Liquid network, this provides cover for all possible pegged asset transactions. It should be noted that for Issued Assets it is possible to exceed the default maximum confidential amount by repeatedly reissuing the asset and then spending an amount greater than the limit in a single transaction. +The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. The default blinding precision is currently 52 bits, which will cover any value up to 2^52 satoshi, which equates to a maximum amount of just over 45 million. As the maximum amount that can be transacted is inherited from Bitcoin, and set at 21 million, this currently provides cover for all asset transactions. -A transaction output larger than the maximum will reveal the order of magnitude of the amount to observers, and will also reveal additional digits at the bottom of the amount. +A transaction output larger than the maximum value set by the blinding precision will reveal the order of magnitude of the amount to observers, and will also reveal additional digits at the bottom of the amount, so care must be taken if you alter the default value. -For example, if the user uses the default blinding precision of 52 bits, then all outputs under that amount will look the same, but an output between 45 million and 450 million will be visible as such to observers (but not the exact amount within that range), and will also reveal one additional digit of the low end of the amount. Revealing the range in this way could be a very significant privacy leak; splitting such extremely large transactions to keep them under the maximum confidential amount is strongly recommended. +For example, if a user chooses a lower blinding precision than the default in their own Elements implementation, or an increased maximum transaction amount, then all outputs under the limit will look the same, but an output over the amount will be visible as such to observers. Although the exact amount will not be revealed, the order or magnitue over the maximum will. Revealing the range in this way could be a very significant privacy leak; splitting such extremely large transactions to keep them under the maximum confidential amount is strongly recommended. ### Find out more about Confidential Transactions From 5d1f823a9492e65975cd2f310ee3652cf50e79db Mon Sep 17 00:00:00 2001 From: wintercooled Date: Wed, 8 Apr 2020 09:50:18 +0100 Subject: [PATCH 5/5] unit clarification --- features/confidential-transactions/index.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/features/confidential-transactions/index.md b/features/confidential-transactions/index.md index 185cfb7..346ca52 100644 --- a/features/confidential-transactions/index.md +++ b/features/confidential-transactions/index.md @@ -90,7 +90,7 @@ elements-cli sendrawtransaction $TX The implementation of Confidential Transactions, as it appears in Elements, has some important limitations to be aware of. -The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. The default blinding precision is currently 52 bits, which will cover any value up to 2^52 satoshi, which equates to a maximum amount of just over 45 million. As the maximum amount that can be transacted is inherited from Bitcoin, and set at 21 million, this currently provides cover for all asset transactions. +The implementation only hides a certain number of the digits of the amount of each transaction output, dependent on the range proof's "blinding coverage" at a desired precision level. The default blinding precision is currently 52 bits, which will cover any value up to 2^52 satoshi, which equates to a maximum amount of just over 45 million BTC equivalent units. As the maximum amount that can be transacted is inherited from Bitcoin, and set at 21 million BTC equivalent units, this currently provides cover for all asset transactions. A transaction output larger than the maximum value set by the blinding precision will reveal the order of magnitude of the amount to observers, and will also reveal additional digits at the bottom of the amount, so care must be taken if you alter the default value.