Let's say I run a charity that wants to show people how much money comes in and out of my Monero wallet. If I export the key images, is it safe to publish them on my website, or does doing so open up the possibility that somebody may break my wallet's encryption and steal my funds?
Basically, are key images safe to share with the public?
Every fund is associated with its output public key P = x G and the secret key x is ultimately the only thing needed for spending the fund (i.e., for generating a valid signature), just like Bitcoin.
A key image I = x Hash(P) where Hash(.) is a hash function that maps arbitrary data to a curve point, is merely needed to prevent double spending while maintaining the sender's anonymity. If you publish your view key, people can know those public keys P belonging to you, but cannot tell if the outputs are spent or not because key images I cannot be known from P alone. Publishing key images (that are signed with P) allows people to see if the relevant outputs are spent or not, i.e., to know the correct balance. However, it's impossible to know the secret key x from P or I.
So the answer is yes, it's absolutely safe to publish your key images. It just has the intended effect of letting people know the current balance of your wallet, and no one can steal your fund.
