Given a keypair (k,K); the key image is calculated as:
KeyImage = k * H(K)
What is stopping someone from giving a fake K
in the hash function?
Monero Stack Exchange is a question and answer site for developers and users of the secure, private and untraceable cryptocurrency Monero. It only takes a minute to sign up.
Sign up to join this communityGiven a keypair (k,K); the key image is calculated as:
KeyImage = k * H(K)
What is stopping someone from giving a fake K
in the hash function?
The Schnorr signature construction that is part of the ring signature ensures that the signer of the MLSAG knows the private key k
of the public key k*H(K)
. That part of the signature is verified in the usual way except using the alternate base point H(K)
instead of the usual G
.
The verifier is the one that calculates that base point H(K)
themselves during verification. So although the specified key image may be falsified, a falsified key image would not verify during the r*H(K) + c*keyimage
step, because the falsifier controls the key image but not the H(K)
point that is used in the r*H(K)
part of the verification.
It's not mathematically possible for the signer to come up with a value of r
that will successfully verify unless at the verification time the point H(K)
is a common factor of both r*H(K)
and c*keyimage
.