Given a keypair (k,K); the key image is calculated as:
KeyImage = k * H(K)
What is stopping someone from giving a fake K in the hash function?
Add a comment
|
The Schnorr signature construction that is part of the ring signature ensures that the signer of the MLSAG knows the private key k of the public key k*H(K). That part of the signature is verified in the usual way except using the alternate base point H(K) instead of the usual G.
The verifier is the one that calculates that base point H(K) themselves during verification. So although the specified key image may be falsified, a falsified key image would not verify during the r*H(K) + c*keyimage step, because the falsifier controls the key image but not the H(K) point that is used in the r*H(K) part of the verification.
It's not mathematically possible for the signer to come up with a value of r that will successfully verify unless at the verification time the point H(K) is a common factor of both r*H(K) and c*keyimage.
