# How does the ring sig work: practical explanation?

Is the following correct?:

If I received 5 XMR from Bob, then I wanted to send this 5 XMR to Alice.

Would I create a tx with the input as the 5 XMR from Bob with one output as 5 XMR to alice. Then look for another tx, fetch K inputs and outputs from that tx along with their public keys.

Then add those K inputs as inputs to my tx, along with the corresponding outputs for them. Because if we do not fetch the outputs, then inputs-outputs-fees != 0 and it would be rejected.

The tx is then signed with the ring signature using fetched keys + signer as the ring.

Interim Question: What is stopping me from fetching old inputs plus my own fresh input, then creating new outputs of my choosing, which spend the old inputs + my own? It would be valid since the keyImage I use will be the one for my new input, while the total would add up to my input + old inputs

Then look for another tx, fetch K inputs and outputs from that tx along with their public keys.

You simply find decoy outputs from anywhere on the blockchain. You'd never only choose decoys from a single transaction.

Then add those K inputs as inputs to my tx, along with the corresponding outputs for them

There is no need to match inputs and outputs from other transactions. The ring signature proves that for at least one combination of inputs, the inputs balance out with the outputs and fees.

• If we do not match the decoy inputs to outputs in the tx, will it not be balanced? As in inputs-outputs-fees would not equal zero. Oct 7, 2018 at 12:47
• Am I correct in saying that we fetch decoy inputs to put into the new tx? The alternative would be to fetch to decoy tx's and sign multiple txs Oct 7, 2018 at 12:50
• You don't need the inputs-outputs-fees to match except for in one particular combination of the outputs (the ones you're really spending). All RingCT outputs are given a global sequential index, and random indices are selected so that those outputs can be referenced as decoy inputs in a transaction. The algorithm never looks at transactions - it looks directly at outputs. Oct 7, 2018 at 13:29
• How does the algorithm know which tx's are decoys and therefore we should not do the `input-output-fees` calculation? If I can summarise what you have said, when we add the decoys, we only need to add their inputs because the algorithm knows they are decoys and therefore they are only used for ring signature privacy. Oct 7, 2018 at 18:50
• I think I understand now. In this way, if we add more inputs the verifier will have to check more combinations to find the correct zero PC. Thanks for riding this out, I will read more papers and be back pretty soon :) Oct 8, 2018 at 14:14