When committing to proofs using p2c it would be nice to hide to blockchain observers which one is the output effectively committing to data.
From a very basic discussion between me and @giacomozucco, our first idea was to use the amount sent to the first output mod the number of outputs: unfortunately, since the amount is not really random and generally has many zeros at its least significant digits, it would mean that either 90% of the proofs are committed to in the first output itself, or we would see really strange looking amounts like 0.05000001.
Another possibility could be to use fees instead of the amount paid: the idea is that fees are already "strange-looking" because of fee estimation software. Adding one or two satoshis won't hurt anyone but could allow the sender to choose which output to use for the commitment.
dr-orlovsky
commented
5 years ago
When committing to proofs using p2c it would be nice to hide to blockchain observers which one is the output effectively committing to data.
From a very basic discussion between me and @giacomozucco, our first idea was to use the amount sent to the first output mod the number of outputs: unfortunately, since the amount is not really random and generally has many zeros at its least significant digits, it would mean that either 90% of the proofs are committed to in the first output itself, or we would see really strange looking amounts like
0.05000001.Another possibility could be to use fees instead of the amount paid: the idea is that fees are already "strange-looking" because of fee estimation software. Adding one or two satoshis won't hurt anyone but could allow the sender to choose which output to use for the commitment.