The task is something like this. Alice must send Bob the money, but so that the amount remains hidden.
How can this be done if only "hiding" balances are stored in the blockchain? How can I prove to someone that my balance is positive after the transfer?
In other words, how can I prove to someone that the number x >0, if the person only knows the "hiding" of this number, say, g^x, where g is the generator of some elliptic curve. Prove without revealing x.
I know how snarks are constructed: R1 CS-> AP -> weil pairing, I know how this problem would be solved if x were known and not hidden.
For example, we represent x = sum(u_i*2^i) write in R1 CS another u_i u_i = u_i and thus prove that all u_i = 0 or 1
what's next? some very simple dumb guy. if x was known, we would have written it just in r1 cs as a public input and would have quietly checked something like
v2 = u11+u22 v3 = v2+u32^2 ... vn = u_(n-1) + u_n2^(n-1)
and would add public input vn = x
and so what to do?
