11

Many Bitcoin users have been taught never to reuse addresses. Why is address reuse less important for Monero?

Strictly from a privacy perspective what are the advantages and disadvantages of creating a new Monero address for each payment request?

Improve this question

2 Answers 2

Reset to default
12

Monero/Cryptonote addresses are conceptually similar to Bitcoin's stealth addresses. The Cryptonote Whitepaper describes Cryptonote addresses in the following way:

We propose a solution allowing a user to publish a single address and receive unconditional unlinkable payments. The destination of each CryptoNote output (by default) is a public key, derived from recipient’s address and sender’s random data. The main advantage against Bitcoin is that every destination key is unique by default (unless the sender uses the same data for each of his transactions to the same recipient). Hence, there is no such issue as “address reuse” by design and no observer can determine if any transactions were sent to a specific address or link two addresses together.

The key thing to note is that no observer can link two addresses together. However, it is possible for the sender to link payments together if the receiver re-uses addresses.

For example, if you withdraw from ExchangeA using AddressA, and then go on to issue another withdrawal from ExchangeA using AddressA, the exchange will easily be able to link these two withdrawals together by simply comparing the withdrawal addresses (even if you used different accounts). Furthermore, if ExchangeA is cooperating with ExchangeB, it would be possible for both exchanges to link address-reusing withdrawals together.

Additionally, even if the sender is not cooperating with other entities in order to link transactions together, it is still possible for the sender to unwittingly link transactions together if their software is poorly implemented and erroneously re-uses the same random data for multiple transactions. Basically, the receiver is relying on the sender to generate good random data in order to generate a one-time key. If the sender fails to use good random data, then the "one-time" key isn't "one-time", and transactions can possibly be linked.

So, for maximum protection against linkability, it's a good idea to generate a new addresses for transactions that you don't want linked.

Improve this answer
7
  • 1
    It should be noted that, in the case of random reuse, the receiver wallet will mark the outputs as unspendable. This should be seen by the receiver as the sender not paying.
    – user36303
    Commented Jul 20, 2016 at 18:30
  • Exact re-use can be detected, but if the sender chooses a low-entropy random value, it won't be detected by the receiver's wallet, but it will be susceptible to observer linkability.
    – Stephen McCarthy
    Commented Jul 20, 2016 at 18:50
  • Could you expand on what data may be recoverable by an observer, if two transactions use low entropy (assuming the sender is not complicit in trying to leak, since the sender can leak everything out of band anyway) ? In particular, do you see a better way than to brute force all pairs of txes (ie, is there a telltale something that can be detected relatively quickly to keep the brute forcing to those "promising" pairs) ?
    – user36303
    Commented Jul 20, 2016 at 19:03
  • The sender generates the one-time key, which involves choosing a random value, 'r'. If 'r' is truly random, then observers will not be able to determine that value of the one-time key. However, if 'r' is low entropy (due to the sender having a broken RNG for example), then observers would be able to determine the value of the one-time key, which could enable observers to link transactions to addresses. It likely would require brute-forcing, however if the entropy of the RNG is low enough, then brute-forcing would be feasible.
    – Stephen McCarthy
    Commented Jul 20, 2016 at 19:27
  • This would be possible only if the attacker has a set of addresses handy to brute force against, right ?
    – user36303
    Commented Jul 20, 2016 at 19:58
5

Addresses reuse is discouraged for receiving XMR in some cases because it would be obvious to link the address to the same person or entity. Thats the only case you want to use multiple addresses as linking transactions to or from your address inside the blockchain is next to impossible, thanks to ring signatures you'll always have plausible deniability.

Improve this answer
1
  • 3
    Ring signatures don't really help there. It's protocol level one time addresses that make address reuse not vulnerable.
    – user36303
    Commented Jul 20, 2016 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.