<blurt4949:matrix.org> RE: ring signature based relative locks (monero-project/research-lab #161), this is probably an incredibly dumb question, but why couldn't you use a rangeproof instead? Have the spend authorization sign L = jH + xG like in this proposal, but use BP+ to show R_h*H - L = (R_h - j)*H + (-x)*G, where (R_ [... too long, see mrelay.p2pool.observer/e/qJr_2JkLbVBNS0RX ]

<blurt4949:matrix.org> please explain to me, don't shoot

@blurt4949 how do you tie the lock to the membership proof? The ring sig idea works because you have to sign the root hash and lock index together.

Do you mean R_h as in the root hash's blinded lock index? I'm not sure how that would work

How it would work without revealing R_h* which is a privacy leak

<blurt4949:matrix.org> I may have misunderstood the point of the proposal. Is the core of it to enable payment channels though this feature, or to implement the feature itself one use of which is payment channels? If it's the feature itself we're after then yeah my idea is moot. Sorry if I wasn't being clear.

<blurt4949:matrix.org> What I was talking about was basically a private equivalent to nLockTime, which AFAIU would also allow for payment channels.

<blurt4949:matrix.org> (UkoeHB: )

<blurt4949:matrix.org> Maybe I'm wrong though, that's a very very real possibility lol

Relative locks is the feature, however that's implemented. One use is payment channels.

It seems like your idea reveals which root hash is used while hiding the specific lock depth, but that leaks a range of possible lock values. For it to be a relative lock, you'd need to specify and sign a 'max lock depth' that your range proof can use and that consensus can use to check the referenced root hash.

@blurt4949:matrix.org The equivalent of nLockTime is not sufficient for payment channels. You need the equivalent of nSequence, which needs to tie to the FCMP root because Monero hides the true spend, unlike Bitcoin, where you can simply check the apend age and compare to nSequence.

<blurt4949:matrix.org> > The equivalent of nLockTime is not sufficient for payment channels. You need the equivalent of nSequence

<blurt4949:matrix.org> I see, thank you for this explanation

<jpk68:matrix.org> Has the mx25519 library been audited?