BSIP: 1201 (unassigned)
    Title: New operations for Confidential Asset (CA) transactions
    Authors: Christopher J. Sanborn
    Status: Draft
    Type: Protocol
    Created: 2018-01-29
    Discussion: <url>


## Abstract

Confidential Assets (CA) [[2]](#see-also) extends Confidential Transactions (CT) [[1]](#see-also) to include asset hiding.  The BitShares network already understands and validates CT transactions, but is not yet capable of validating CA transactions.  The transaction format will need minor to moderate updating and the validation routines will likewise need updating. We propose to either (a) update op-code 39, 49, and 41 to be CA capable, or (b) define new opcodes for CA stealth operations.  The latter option probably affords a cleaner upgrade path.  The old opcodes should then be disfavored for user wallet use.

## Motivation

A user maintains value-blinded balances on the BitShares blockchain as a collection of Pedersen commitments, which are EC curve points that obscure their committed values by adding a secret blinding factor.  By keeping the blinding factor secret, the user keeps their balance secret.  Meanwhile, balances can be transferred, subdivided, or combined, provided the sum of blinding factors for all inputs to a transaction are equal to the sum of blinding factors of all outputs of a transaction.  A user wishing to un-blind and "claim" a balance contained in a Pedersen commitment may do so by revealing the blinding factor for that commitment, which then allows the network to verify the committed amount.

A commitment C is given mathematically by *C = value * G + blinding_factor * H*, where G and H are separate curve point generators with no known divisor between them.

BitShares is a multi-asset chain.  The Pedersen commitments implemented in Stealth Phase I commit only to a value amount, and nothing more.  For the network to understand *which* asset is represented by a commitment, a plaintext metadata field is associated with the Graphene object for the commitment, containing the asset ID of the blinded asset.  This means that the asset type of an individual blinded balance is publicly knowable.

Confidential Assets (CA) introduces a method for using a hash of the object ID as a confounding factor similar to the blinding factor, such that, unless one already knows the asset represented by a particular Pedersen commitment, one cannot determine the asset from inspection alone.  Furthermore, amounts of differing assets can be combined into a single commitment, so that even by tracing the history of a given commitment, one cannot simply divine the asset type by back-tracing to the point where a public asset was blinded.  When a user wishes to un-blind an asset, he may do so by providing both the blinding and asset factors for the commitment, so that the network can confirm the contents thereof.

By allowing commitments of differing assets to be mixed together, we achieve two points for privacy: (1) we increase the available mix-in set for diffusion of transaction history, and (2) we make it more difficult for blockchain analysis to determine which assets are being operated on in any given transaction (the more assets involved in the history of a particular commitment, the greater the uncertainty of what the commitment contains).

## Rationale
## Specifications
## Discussion
## Summary for Shareholders
## Copyright

This document is placed in the public domain.

## See Also

[1] Confidential Transactions (Greg Maxwell) - https://people.xiph.org/~greg/confidential_values.txt

[2] Confidential Assets (Poelstra, et. al.) - https://blockstream.com/bitcoin17-final41.pdf