I've some doubt about Greg Maxwell Confidential transaction and hope someone can help to make it clear. A commitment using Elliptic Curve math is:
P=xG + aH
where G,H are public value and x,a are private.
My questions are:
xGis public or private value?- if
xGis a public value why an attacker cannot simply make a brute force attack trying all possible value ofachecking for the equality with the P value? - if
xGis a private value the CT paper tell:can be proven to be a commitment to a zero by just signing a hash of the commitment with the commitment as the publicor if if you want to provea=1makeC' = C - 1Hand then sign the hash ofC'. How signingCorC'can I prove the value and also how can I verify a sign if I dont knowxG?