user76599: I'm reading the Confidential Transactions paper, and it says that the blinding factor in the pedersen commitment is derived using a shared secret, but I can't understand what's preventing the sender from cheating a bit. 
The sender generates a ephemeral private key, and derives the secret as (ephemeral private key * receivers public key), and is supposed to pack the ephemeral public key in the transaction, so that the receiver can derive the shared secret (receivers private key * ephemeral public key) and get the blinding factor and derive transaction amount. 
What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount. 
The sender might be up to mischief, or claim that he sent a transaction (and show the transaction ID as proof), and claim that the receiver (maybe an exchange) is not depositing the right amount. 

user208: 
What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount. 

The fact that the receiver wouldn't treat the result as a valid payment.
This is no different from them sending the right amount to the wrong address.

76599: <p>I'm reading the Confidential Transactions paper, and it says that the blinding factor in the pedersen commitment is derived using a shared secret, but I can't understand what's preventing the sender from cheating a bit. </p>

<p>The sender generates a ephemeral private key, and derives the secret as <code>(ephemeral private key * receivers public key)</code>, and is supposed to pack the ephemeral public key in the transaction, so that the receiver can derive the shared secret <code>(receivers private key * ephemeral public key)</code> and get the blinding factor and derive transaction amount. </p>

<p>What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount. </p>

<p>The sender might be up to mischief, or claim that he sent a transaction (and show the transaction ID as proof), and claim that the receiver (maybe an exchange) is not depositing the right amount. </p>
 208: <blockquote>
  <p>What guarantees that the sender packed the right ephemeral public key? What's stopping the sender from packing a different ephemeral public key, preventing the receiver from figuring out the blinding factor and the transaction amount. </p>
</blockquote>

<p>The fact that the receiver wouldn't treat the result as a valid payment.</p>

<p>This is no different from them sending the right amount to the wrong address.</p>
