0

I'm trying to understand how privacy in Monero compares to shielded transactions in Zcash. I understand that with Zcash's zk-Snarks, there's no information about sender, receiver or amount.

I think I understand that with Monero, these data are visible, but obfuscated with "ring signatures" that basically add a bunch of noise so an observer can't detect the signal from the noise. The dancing analogy is that you'll see "me" dancing with many people, but most of what you see isn't really me, so you can't prove that I danced with any one of them. Is that about right?

If so, my question is this: can an observer prove that I didn't pay (or dance with) some recipient X?

I get that the noise might include me dancing with X in which case they cannot disprove it. But what if amidst all the signal and noise, none of it suggested that I might have paid X. Does that not then prove that I did not pay X?

If that is correct, then that certainly seems like information disclosure that makes zk-Snarks superior in privacy.

Improve this question

1 Answer 1

Reset to default
2

The dancing analogy is that you'll see "me" dancing with many people, but most of what you see isn't really me, so you can't prove that I danced with any one of them.

The "dancing" analogy is poor.

Monero has:

  • Sender privacy: Ring signatures
  • Receiver privacy: Stealth addresses
  • Amount privacy: Confidential Transactions

Observers don't know who the sender is (or more specifically which outputs are being spent), due to the ring signatures.

Observers don't know who the receiver is (or more specifically who owns the destination outputs), because they are uniquely created for the destination, with no way of attributing them to specific addresses.

Observers don't know how much was transacted because the amount is encrypted with a shared secret (only the sender or receiver can decrypt).

can an observer prove that I didn't pay (or dance with) some recipient X?

No they cannot. Only you (as the sender), can prove whether or not you actually sent funds.

Does that not then prove that I did not pay X?

No, it does not. Only you (as the sender), can prove whether or not you actually sent funds.

Improve this answer
4
  • I read earlier today that the ring signatures only mixes the sender up with 10 other possible senders. If that's the case, it sounds like I can conclusively prove that X did not send the money if they are not among the ring of senders for this transaction. Is that correct?
    – Andrew Arnott
    Commented May 8, 2021 at 23:04
  • "if they are not among the ring of senders for this transaction" <- in that specific tx.
    – jtgrassie
    Commented May 9, 2021 at 1:24
  • Then by that reasoning, in a set of transactions I may be able to prove a sending address is not included simply because it was not used in any of the ring signatures. I don't know how compromising that information disclosure may be in practice, but it's a nice perk of zk-Snarks in Zcash that senders are completely hidden.
    – Andrew Arnott
    Commented May 10, 2021 at 2:15
  • There are no "sending addresses" on the Monero blockchain. Only outputs. If an output wasn't used in any input ring, (so literally doesn't appear in any tx input ring), you can know it is not spent. The "sender address" (and receiver address for that matter), is "completely hidden" in Monero.
    – jtgrassie
    Commented May 10, 2021 at 2:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.