Multisig output

[popov-vladimir]

Alice has an input AIC with value vai with blinding factor rai
Bob has and input BIC with value vib with blinding factor rbi
They generate a multisig (output) commitment MC with a blinding factor rm = ram + rbm, such that MC = H*(vam+vbm) + G*(ram+rbm) = H*vm + MR = APC + BPC. Besides from multisig Alice and Bob create change outputs CAO, CBO

1. Alice calculates partial commitment APC = H * vam + G * ram, bulletproof for ACO = ACO_proof, partial excess = G*(ram+rac-rai)

2. Alice calculates partial signature APS = (ka*G,ka + e*(ram+rac-rai))

3. Alice calculate common nonce CN for later bulletproofs generation

4. Alice sends Bob APC,APS, CN

5. Bob calculates partial commitment BPC = H * vbm + G * rbm

6. Bob calculates MC = APC + BPC, bulletproof for BCO = BCO_proof

7. Bob calculates TB1,TB2 = bullet_proof_multisig(MC, CN, rbm)

8. Bob sends TB1, TB2, MC to Alice

9. Alice calculates TA1,TA2 = bullet_proof_multisig(MC, CN, ram)

10. Alice calculates Tau_X_A = bullet_proof_multisig(MC, CN, ram)

11. Alice sends Tau_X_A,ACO_proof to Bob

12. Bob calculates Tau_X_B

13. Bob calculate Tau_X = Tau_X_A + Tau_X_B

14. Bob calculates partial signature BPS = (kb*G,kb + e*(rbm+rbc-rbi))

15. Bob calculates final signature FS = BPS + APS

16. Bob publishes TX:

{
    "Inputs": ["AIC", "BIC"],
    "Outputs" : [{
        "Commitment":"MC",
        "proof":"Tau_X"
    },
    {
        "Commitment":"ACO",
        "proof:":"CAO_proof"
    },
    {
        "Commitment":"BCO",
        "proof":"CBO_proof"
    }],
    "Kernel" :{
        "Signature":"FS",
        "excess":"excess"
    }
}