Ring Confidential Transactions

The five-minute read

One action, walked through

1. The sender opens their own outputs, which are commitments plus the secrets only they know.
2. They select decoy outputs from the chain. Those decoys are also commitments. The sender does not know the decoys' amounts, and does not need to.
3. They build new output commitments for the recipient and for any change.
4. A range proof is attached so every new amount is in range, and the ring signature shows one input set balances the outputs.
5. The network verifies the proofs and records a key image. It never writes the amount into a public column.

The argument, unpacked

What has to be true

• The commitment scheme is binding and hiding under the stated assumptions.
• Range proofs are sound. A broken range proof is an inflation bug, not a privacy bug.
• Rings are large enough, and decoy selection is not itself a fingerprint.
• Fees and other public fields cannot be used to reconstruct the hidden amounts.

What happened after the paper

Monero deployed RingCT and later replaced the range proofs to shrink transactions. Ring size became mandatory. Those parameter changes are subsequent decisions. This paper is the argument that amounts can sit inside the ring at all.

What to check before you use the idea

• Is the anonymity set a ring of a stated size, or a global note pool?
• Which range proof is verified, and what is its size on the wire?
• Can a public fee, a unique denomination, or a timing pattern undo the hidden amount?
• What stops a negative output from creating value?

Terms

Confidential transaction

A transaction whose amounts are commitments. Solvency is checked without revealing the numbers.

Range proof

A proof that a committed number lies between zero and a maximum, so it cannot be negative or unbounded.

RingCT

The combination of a ring signature with confidential amounts, so both the signer and the values stay off the public columns.

Binding

The property that a commitment cannot be opened to two different amounts. Without it, the proof of balance is theatre.

The problem the paper names

CryptoNote-style rings hide which output was spent. They do not hide the amount. If denominations are visible, or if amounts are unique, the ring is easier to peel apart. The paper treats amount privacy as part of the signature, not as encryption bolted on beside it.

What the design proposes

• Commitments hide values. The signature proves the commitments in a ring are well formed.
• A range proof keeps a hidden amount from being negative or overflowing.
• The network still sees enough to reject a double-spend and to check that inputs cover outputs plus the fee.

How the mechanism is specified

• Confidential transactions (the Greg Maxwell construction on Bitcoin) are combined with a ring so the real input is not identified.
• The verifier checks a single statement: some input in the ring opens consistently, and value is conserved.
• Fees can remain public so the inclusion market still works.

What this page does not treat as proven

• This is not a Monero 'project white paper' in the ICO sense. It is the amount-privacy note the project adopted.
• Later Monero changes, including proof systems after this note, are not described here.
• Ring size and decoy selection still dominate practical privacy, and the paper does not pick a production policy.

Why a venture studio still reads it

A payments venture that publishes amounts 'for analytics' does not have this design. If the amount must be visible to a named party, that view should be a key or a reporting channel, not a return to a fully public ledger by default.