5

I am aware that a similar question has been asked, but it doesn't go into the details of whether in the wallet level the individual user will be able to send rct and non-rct transactions, and wheather it will be possible to migrate each non-rct output to a rct output in their single transaction, instead of having to visibly mix all the user's non-rct outputs one last time in a sweep_all transaction? Even now I think it is kind of bad that it is not possible for the user to decide explicitly what outputs could go together, and which ones shouldn't, and I realize that after ringCT that concern will be mute, but I was hoping for the most privacy concious transition into rct possible.

user141
  • 3,337
  • 14
  • 34

1 Answers1

2

If you have unspent outputs from non-rct transactions, they are mixed with other non-rct transaction outputs in the same manner as before (an attempt is made to find a mixin number of other outputs of same amount). Then, the amounts of each output in the new rct-transaction are separately "masked". Each verifier (all other nodes), create an "identity" commitment for the inputs to verify no XMR was created in the process - this is identical to how miner outputs now work.

A picture might help, two unspent transactions with mixin 2:

[input amt: 2]--
                \
[input amt: 2]----[ring signature] --+
                /                    |
[input amt: 2]--                     |
                                     |
                                     +--[proof: (inputs - outputs) == 0]--+ 
                                     |                                    |
[input amt: 5]--                     |                                    |
                \                    |                                    |
[input amt: 5]----[ring signature] --+                                    |
                /                                                         |
[input amt: 5]--                                  [output amt: ?] ----    |  
                                                                      \   |
                                                  [output amt: ?]---------+
                                                                      /
                                                  [output amt: ?] ----

I omitted transaction fees in this diagram (irrelevant for this discussion) - the 3 outputs must add up to 7 but the actual amounts are masked. So basically, the inputs to the transaction behave identical to pre-rct transactions, but the amount in each output is hidden.

So no sweep is necessary, until you have unmixable pre-rct unspent outputs. And even then, it is possible to do a transaction/sweep where the amounts in the input ring do not match (but this has not been implemented AFAIK).

Lee Clagett
  • 906
  • 6
  • 10