Quote from: DumbFruit on June 17, 2015, 04:10:11 PM

Quote from: CCT

The required commitments are an order of magnitude smaller than those proposed for Confidential Transactions, hide the whole value rather than only the mantissa, and do not depend on ring signatures.

I thought that CT represented the entire value in the mantissa, so isn't this a distinction without a difference?

Quote from: Mixles on June 17, 2015, 11:23:38 PM

Quote from: gmaxwell on June 11, 2015, 02:04:02 AM

Inputs do not have an exponent. The exponent is a property of the range proof, not of the values themselves. They work by scaling the basis the proof operates over.

I'm not 100% sure of the CT method, but it sounds like some information about the exponent is exposed to make the proofs shorter (you could keep it secret at a big cost). Maybe not the input magnitude, but the proof exponent range is public, and that selection, can itself give some information away. This is why CT is targeted at smaller 32-bit numbers.

Quote from: gmaxwell on June 18, 2015, 12:30:07 AM

Between the soundness and efficiency improvements I went from thinking the probability of deployment of CT in bitcoin proper (rather than just in sidechains) was low but non-zero to-- with your scheme-- a view that its even likely eventually.

Am I interpreting this correctly that on the surface analysis Sumcoin (aka CCT) appears to be more sound than Blockstream's CT because in theory it appears to reveal less side channel information. However, in order for Sumcoin (CCT) to do this properly, then it needs to use a sum of three squares NIZKP and thus much of the efficiency gains are lost?

And thus it (and Blockstream's CT) probably wouldn't ever realistically make it into any serious coin (e.g. Bitcoin core chain) that has scaling issues (which is just about everything PoW right now)?