The ring signatures construction in Monero is based on the Traceable Ring Signature by Fujisaki and Suzuki (PKC '07).

Since in their traceable ring signature construction, the anonymity of the ring signer is revoked (,ie, the exact public key of that person is exposed by the trace algorithm) if he signs two different messages with the same tag (which implies same ring since the tag contains the random issue and the set of public keys, which is the ring), I was curious if the same is true for Monero transactions? So in other words, my question is if in Monero transactions, a sender creates two ring signatures of two different messages keeping the ring same, will his anonymity be revoked and his public key exposed?

I ask this because I was trying to get more intuition why exculpability (instead of standard unforgeability) is required for ring signatures suitable for Monero? Why standard linkable ring signatures is not enough?

  • If there were no exculpability in Monero, you could spend the same output twice (by signing two mostly different rings where the double-spent output existed in both rings) an no one would know. – knaccc Oct 9 at 16:28

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.