.. DO NOT EDIT.
.. THIS FILE WAS AUTOMATICALLY GENERATED BY SPHINX-GALLERY.
.. TO MAKE CHANGES, EDIT THE SOURCE PYTHON FILE:
.. "api/gallery/privacy/amounts/plot_03_ringct.py"
.. LINE NUMBERS ARE GIVEN BELOW.

.. only:: html

    .. note::
        :class: sphx-glr-download-link-note

        :ref:`Go to the end <sphx_glr_download_api_gallery_privacy_amounts_plot_03_ringct.py>`
        to download the full example code or to run this example in your browser via JupyterLite.

.. rst-class:: sphx-glr-example-title

.. _sphx_glr_api_gallery_privacy_amounts_plot_03_ringct.py:


RingCT: hiding the input and the amounts together (2016)
========================================================

Shen Noether's Ring Confidential Transactions combined Monero's ring
signatures with confidential amounts. Each ring member is a one-time key
:math:`P_i` and an amount commitment :math:`C_i`. A second column proves
the amounts balance for the same member that signs: its keys are

.. math::

   Z_i = \frac{C_i}{g^{\text{fee}} \prod_j C^{\text{out}}_j},

which is :math:`h^z` for the real input alone, when its amount equals the
outputs plus the fee. One ring of challenges over both columns, an MLSAG
signature, proves the signer knows the key of some :math:`P_i` and the
:math:`z` of the same :math:`Z_i`. The key image of :math:`P_i` blocks a
second spend.

.. GENERATED FROM PYTHON SOURCE LINES 22-30

.. code-block:: Python

    import dataclasses

    import matplotlib.pyplot as plt

    import blockchainkit as bk

    G = bk.crypto.TEACHING_GROUP








.. GENERATED FROM PYTHON SOURCE LINES 31-33

Spending one of eleven outputs
------------------------------

.. GENERATED FROM PYTHON SOURCE LINES 33-48

.. code-block:: Python


    secrets = list(range(5_001, 5_012))
    amounts = [12, 40, 7, 90, 25, 60, 3, 44, 18, 75, 33]
    blindings = [900 + i for i in range(11)]
    ring = [
        (G.public(x), bk.crypto.pedersen_commit(v, r))
        for x, v, r in zip(secrets, amounts, blindings, strict=True)
    ]
    real = 5
    tx = bk.privacy.ringct_spend(
        ring, real, secrets[real], amounts[real], blindings[real], [(45, 111), (13, 222)], fee=2, bits=8
    )
    assert bk.privacy.verify_ringct(tx)
    print("valid RingCT spend; key image", tx.signature.key_image)





.. rst-class:: sphx-glr-script-out

 .. code-block:: none

    valid RingCT spend; key image 465450653415610991




.. GENERATED FROM PYTHON SOURCE LINES 49-51

What the signature rules out
----------------------------

.. GENERATED FROM PYTHON SOURCE LINES 51-63

.. code-block:: Python


    assert not bk.privacy.verify_ringct(dataclasses.replace(tx, fee=1))
    try:
        bk.privacy.ringct_spend(ring, 3, secrets[3], amounts[3], blindings[3], [(45, 1), (13, 2)], 2)
    except ValueError as error:
        print("member 3 holds 90, not 60:", error)
    again = bk.privacy.ringct_spend(
        ring, real, secrets[real], amounts[real], blindings[real], [(58, 333)], fee=2, bits=8, seed=9
    )
    assert again.signature.key_image == tx.signature.key_image
    print("a second spend of the same output repeats the key image")





.. rst-class:: sphx-glr-script-out

 .. code-block:: none

    member 3 holds 90, not 60: the input amount must equal the outputs plus the fee
    a second spend of the same output repeats the key image




.. GENERATED FROM PYTHON SOURCE LINES 64-66

Every member gets two responses
-------------------------------

.. GENERATED FROM PYTHON SOURCE LINES 66-77

.. code-block:: Python


    fig, ax = plt.subplots(figsize=(7, 3.5))
    for column, name in enumerate(("key column", "amount column")):
        ax.scatter(range(11), [r[column] / G.q for r in tx.signature.responses], label=name)
    ax.set(xlabel="ring member", ylabel="response / q", ylim=(0, 1))
    ax.set_title("Which member was spent, and for how much? Hidden")
    ax.legend()
    fig.tight_layout()

    plt.show()




.. image-sg:: /api/gallery/privacy/amounts/images/sphx_glr_plot_03_ringct_001.png
   :alt: Which member was spent, and for how much? Hidden
   :srcset: /api/gallery/privacy/amounts/images/sphx_glr_plot_03_ringct_001.png
   :class: sphx-glr-single-img





.. GENERATED FROM PYTHON SOURCE LINES 78-84

Exercise
--------
Why does RingCT need the second column at all? Show that a transaction
with a correct key-column signature but outputs worth more than the
real input fails verification.
A worked solution is in :doc:`/exercises/privacy`.


.. rst-class:: sphx-glr-timing

   **Total running time of the script:** (0 minutes 0.068 seconds)


.. _sphx_glr_download_api_gallery_privacy_amounts_plot_03_ringct.py:

.. only:: html

  .. container:: sphx-glr-footer sphx-glr-footer-example

    .. container:: lite-badge

      .. image:: images/jupyterlite_badge_logo.svg
        :target: ../../../../lite/lab/index.html?path=api/gallery/privacy/amounts/plot_03_ringct.ipynb
        :alt: Launch JupyterLite
        :width: 150 px

    .. container:: sphx-glr-download sphx-glr-download-jupyter

      :download:`Download Jupyter notebook: plot_03_ringct.ipynb <plot_03_ringct.ipynb>`

    .. container:: sphx-glr-download sphx-glr-download-python

      :download:`Download Python source code: plot_03_ringct.py <plot_03_ringct.py>`

    .. container:: sphx-glr-download sphx-glr-download-zip

      :download:`Download zipped: plot_03_ringct.zip <plot_03_ringct.zip>`


.. only:: html

 .. rst-class:: sphx-glr-signature

    `Gallery generated by Sphinx-Gallery <https://sphinx-gallery.github.io>`_