.. DO NOT EDIT.
.. THIS FILE WAS AUTOMATICALLY GENERATED BY SPHINX-GALLERY.
.. TO MAKE CHANGES, EDIT THE SOURCE PYTHON FILE:
.. "api/gallery/privacy/amounts/plot_02_confidential_transactions.py"
.. LINE NUMBERS ARE GIVEN BELOW.

.. only:: html

    .. note::
        :class: sphx-glr-download-link-note

        :ref:`Go to the end <sphx_glr_download_api_gallery_privacy_amounts_plot_02_confidential_transactions.py>`
        to download the full example code or to run this example in your browser via JupyterLite.

.. rst-class:: sphx-glr-example-title

.. _sphx_glr_api_gallery_privacy_amounts_plot_02_confidential_transactions.py:


Confidential transactions: amounts that add up unseen (2015)
============================================================

Gregory Maxwell replaced each amount with a Pedersen commitment
:math:`C = g^v h^r`. Commitments multiply as amounts add, so anyone can
check that nothing is created,

.. math::

   \prod_{\text{in}} C_i = g^{\text{fee}} \prod_{\text{out}} C_j ,

without seeing a single amount. Amounts live modulo the group order
:math:`q`, though, so an output of :math:`q - 1`, which is :math:`-1`,
balances an output one coin too large. Every output therefore carries a
*range proof*: a commitment to each bit, with a ring signature over
:math:`\{C_k, C_k / g^{2^k}\}` showing that one of the two is a pure power
of :math:`h`, so the bit is 0 or 1.

.. GENERATED FROM PYTHON SOURCE LINES 22-28

.. code-block:: Python

    import matplotlib.pyplot as plt

    import blockchainkit as bk

    G = bk.crypto.TEACHING_GROUP








.. GENERATED FROM PYTHON SOURCE LINES 29-32

An honest payment
-----------------
50 coins in; 30 to the payee, 19 back as change, 1 as the fee.

.. GENERATED FROM PYTHON SOURCE LINES 32-39

.. code-block:: Python


    inputs = [bk.crypto.pedersen_commit(50, 1_111)]
    payee = bk.privacy.confidential_output(30, 600, seed=1)
    change = bk.privacy.confidential_output(19, 511, seed=2)
    assert bk.privacy.verify_confidential(inputs, [payee, change], fee=1)
    print("valid; each output proves", payee.range_proof.bits, "bits")





.. rst-class:: sphx-glr-script-out

 .. code-block:: none

    valid; each output proves 16 bits




.. GENERATED FROM PYTHON SOURCE LINES 40-43

Inflation through a negative amount
-----------------------------------
Outputs of 1,000 and -951 balance the 50 coins in, less the fee of 1.

.. GENERATED FROM PYTHON SOURCE LINES 43-54

.. code-block:: Python


    big = bk.privacy.confidential_output(1_000, 700, seed=3)
    minus = bk.crypto.pedersen_commit(G.q - 951, 1_111 - 700)
    assert bk.privacy.commitments_balance(inputs, [big.commitment, minus], fee=1)
    forged = bk.privacy.ConfidentialOutput(minus, change.range_proof)
    assert not bk.privacy.verify_confidential(inputs, [big, forged], fee=1)
    try:
        bk.privacy.prove_range(G.q - 951, 411)
    except ValueError as error:
        print("no range proof for -951:", error)





.. rst-class:: sphx-glr-script-out

 .. code-block:: none

    no range proof for -951: value is not in [0, 2**16)




.. GENERATED FROM PYTHON SOURCE LINES 55-57

Proof size
----------

.. GENERATED FROM PYTHON SOURCE LINES 57-70

.. code-block:: Python


    bits = [4, 8, 16, 24, 32]
    sizes = [
        len(bk.privacy.prove_range(5, 9, b).bit_commitments) * 4 for b in bits
    ]  # Per bit: a commitment, a challenge and two responses.
    fig, ax = plt.subplots(figsize=(6, 4))
    ax.plot(bits, sizes, marker="o")
    ax.set(xlabel="bits of range", ylabel="numbers in the proof")
    ax.set_title("Bitwise range proofs grow linearly")
    fig.tight_layout()

    plt.show()




.. image-sg:: /api/gallery/privacy/amounts/images/sphx_glr_plot_02_confidential_transactions_001.png
   :alt: Bitwise range proofs grow linearly
   :srcset: /api/gallery/privacy/amounts/images/sphx_glr_plot_02_confidential_transactions_001.png
   :class: sphx-glr-single-img





.. GENERATED FROM PYTHON SOURCE LINES 71-77

Exercise
--------
The sender knows every output's blinding factor. Why must the payee
learn its own output's amount and blinding factor, and how does the
payee check what it was paid?
A worked solution is in :doc:`/exercises/privacy`.


.. rst-class:: sphx-glr-timing

   **Total running time of the script:** (0 minutes 0.065 seconds)


.. _sphx_glr_download_api_gallery_privacy_amounts_plot_02_confidential_transactions.py:

.. only:: html

  .. container:: sphx-glr-footer sphx-glr-footer-example

    .. container:: lite-badge

      .. image:: images/jupyterlite_badge_logo.svg
        :target: ../../../../lite/lab/index.html?path=api/gallery/privacy/amounts/plot_02_confidential_transactions.ipynb
        :alt: Launch JupyterLite
        :width: 150 px

    .. container:: sphx-glr-download sphx-glr-download-jupyter

      :download:`Download Jupyter notebook: plot_02_confidential_transactions.ipynb <plot_02_confidential_transactions.ipynb>`

    .. container:: sphx-glr-download sphx-glr-download-python

      :download:`Download Python source code: plot_02_confidential_transactions.py <plot_02_confidential_transactions.py>`

    .. container:: sphx-glr-download sphx-glr-download-zip

      :download:`Download zipped: plot_02_confidential_transactions.zip <plot_02_confidential_transactions.zip>`


.. only:: html

 .. rst-class:: sphx-glr-signature

    `Gallery generated by Sphinx-Gallery <https://sphinx-gallery.github.io>`_