10

Many Bitcoin users have been taught never to reuse addresses. Why is address reuse less important for Monero?

Strictly from a privacy perspective what are the advantages and disadvantages of creating a new Monero address for each payment request?

11

Monero/Cryptonote addresses are conceptually similar to Bitcoin's stealth addresses. The Cryptonote Whitepaper describes Cryptonote addresses in the following way:

We propose a solution allowing a user to publish a single address and receive unconditional unlinkable payments. The destination of each CryptoNote output (by default) is a public key, derived from recipient’s address and sender’s random data. The main advantage against Bitcoin is that every destination key is unique by default (unless the sender uses the same data for each of his transactions to the same recipient). Hence, there is no such issue as “address reuse” by design and no observer can determine if any transactions were sent to a specific address or link two addresses together.

The key thing to note is that no observer can link two addresses together. However, it is possible for the sender to link payments together if the receiver re-uses addresses.

For example, if you withdraw from ExchangeA using AddressA, and then go on to issue another withdrawal from ExchangeA using AddressA, the exchange will easily be able to link these two withdrawals together by simply comparing the withdrawal addresses (even if you used different accounts). Furthermore, if ExchangeA is cooperating with ExchangeB, it would be possible for both exchanges to link address-reusing withdrawals together.

Additionally, even if the sender is not cooperating with other entities in order to link transactions together, it is still possible for the sender to unwittingly link transactions together if their software is poorly implemented and erroneously re-uses the same random data for multiple transactions. Basically, the receiver is relying on the sender to generate good random data in order to generate a one-time key. If the sender fails to use good random data, then the "one-time" key isn't "one-time", and transactions can possibly be linked.

So, for maximum protection against linkability, it's a good idea to generate a new addresses for transactions that you don't want linked.

  • 1
    It should be noted that, in the case of random reuse, the receiver wallet will mark the outputs as unspendable. This should be seen by the receiver as the sender not paying. – user36303 Jul 20 '16 at 18:30
  • Exact re-use can be detected, but if the sender chooses a low-entropy random value, it won't be detected by the receiver's wallet, but it will be susceptible to observer linkability. – Stephen McCarthy Jul 20 '16 at 18:50
  • Could you expand on what data may be recoverable by an observer, if two transactions use low entropy (assuming the sender is not complicit in trying to leak, since the sender can leak everything out of band anyway) ? In particular, do you see a better way than to brute force all pairs of txes (ie, is there a telltale something that can be detected relatively quickly to keep the brute forcing to those "promising" pairs) ? – user36303 Jul 20 '16 at 19:03
  • The sender generates the one-time key, which involves choosing a random value, 'r'. If 'r' is truly random, then observers will not be able to determine that value of the one-time key. However, if 'r' is low entropy (due to the sender having a broken RNG for example), then observers would be able to determine the value of the one-time key, which could enable observers to link transactions to addresses. It likely would require brute-forcing, however if the entropy of the RNG is low enough, then brute-forcing would be feasible. – Stephen McCarthy Jul 20 '16 at 19:27
  • This would be possible only if the attacker has a set of addresses handy to brute force against, right ? – user36303 Jul 20 '16 at 19:58
5

Addresses reuse is discouraged for receiving XMR in some cases because it would be obvious to link the address to the same person or entity. Thats the only case you want to use multiple addresses as linking transactions to or from your address inside the blockchain is next to impossible, thanks to ring signatures you'll always have plausible deniability.

  • 3
    Ring signatures don't really help there. It's protocol level one time addresses that make address reuse not vulnerable. – user36303 Jul 20 '16 at 7:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.