# Why not use bLSAG for one input instead of MLSAG?

AFAIK MLSAG is being used for one input because of a privacy problem. Why not just use bLSAG, since in the MRL005 it says that MLSAG is better once we have > 1 sets of keys.

MLSAG allows us to include more than just the set of keys. We can thus use both keys and commitments.

Quoting the paper:

An MLSAG is essentially similar to the LSAG’s described in [8], but rather than having a ring signature on a set of n keys, instead, an MLSAG is a ring signature on a set of n key-vectors.

Currently we use RCTTypeSimple, which creates a signature for each input ring. Each ring contains public keys and commitments. This means we are creating a signature on a matrix whereby each column represents an input that has two rows. The first row contains the key, the second the commitment. A "matrix" is another way of saying "set of n key-vectors".

• Yes, but afaik mlsag is being used for one input at a time due to the shared index bug. In that ring, we prove that we know one of the keys that sign it. I imagine it is like a mxn matrix, where each row of keys is assigned to an input and we need to prove that we know the secret keys to an entire column. Apr 28 '19 at 9:43
• Yes this is correct, there is one sig per input ring, but note they also link the key images - MLSAG incorporates both keys and Pedersen commitments. Apr 28 '19 at 11:57
• Not sure I understand. The MLSAG is used to sign each input individually, how would the keyImages be linked? For n inputs, we would have n signatures each with their own keyImages afaiu Apr 28 '19 at 12:38
• From your quote, an MLSAG signature on 1 key vector is the same as a signature of n keys, where n is the size of the key vector Apr 28 '19 at 12:46
• If you look at how mlsag is used in Monero, you'll see that both keys and commitments are used. Not just keys or just commitments. The quote doesn't state 1 key vector, it says "on a set of n key-vectors". Also recall how you link the key image, the zero commitment. Apr 28 '19 at 13:03