6

A one time address is supposed to be, well, used only once.

If you send two transactions to the same one time address, will both transactions be accepted into the block chain? I know that if they were, only one would be spendable.

  • In Monero a public can be and should be re-use. It is a radically different cryptocurrency than Bitcoin. Hopefully someone more knowledgeable will be able to extend on that. – ant Bldel Aug 13 '16 at 17:38
  • @antBldel I know. I'm talking about the one time-addresses, which shouldn't be reused. I know standard addresses are fine to reuse. – PyRulez Aug 13 '16 at 17:41
  • To clarify, the question is about one-time addresses, i.e. stealth addresses, which are different than the public addresses. The public addresses can be reused freely, whereas the steatlh addresses cannot. – dEBRUYNE Aug 13 '16 at 17:46
  • @dEBRUYNE Or at least they shouldn't. On reddit we where talking about, for example, what would happen if someone uses bad rng. – PyRulez Aug 13 '16 at 17:50
4

First, to clarify again, the question is about one-time addresses, i.e. stealth addresses, which are different than the public addresses. The public addresses can be reused freely, whereas the stealth addresses cannot. For consistency, I'll only use the term stealth address (one-time address) in this answer.

To answer your question, we first need a bit of background. In Monero, key images prevent double spending in the blockchain. Key images are generated by the receiver (Bob) of a transaction, to see if the outputs that belong to him are spendable. Or to put differently, if they aren't already spent. The receiver wants to verify this, because he will most likely want to spend his funds somewhere in the future. From core-team member luigi1111's article:

To check if P is spent, Bob computes its "key image" and queries the blockchain to see if it is marked as spent. Key image I = xHp(P).

Note that P is Bob's stealth address, with P = Hs(rA)G + B.

Where:

  • P -- the final stealth address (one-time output key, the destination where funds will actually be sent);
  • Hs* -- a hashing algorithm that returns a scalar (i.e., the hash output is interpreted as an integer and reduced modulo l);
  • r -- the new random scalar Alice chose for this transaction;
  • A -- Bob's public view key;
  • G -- the standard Ed25519 base point;
  • B -- Bob's public spend key.

From the formulas we can infer that, if the sender (Alice) uses the same stealth address of the receiver (Bob) for two transactions, Bob's outputs of one of the transactions will be burned. That is, both transactions will generate the same key image for Bob. Therefore, only Bob's outputs of one of the transactions are subsequently spendable. Now back to your question, given that stealth addresses are randomly generated, is it highly unlikely that Alice received the funds she has subsequently sent to Bob on a reused stealth address as well. Therefore, the key images generated by Alice are unique and she would be able to send two different transactions to the same stealth address of Bob, which thus will both be accepted into the blockchain.

I previously mentioned that stealth addresses are randomly generated and therefore should not be able to collide, or put differently, reused. One may ask themselves, how would a stealth address appear twice? To answer this, I'll use the comment of reddit user TheKing01:

Technically, stealth address reuse is already possible if you're dumb. A sender can use a one time address more than once if they aren't careful. (It does help though that it is happening all inside simplewallet, so their is no chance for human error in this regard. Either using third party buggy clients or using a bad random number generator could be a problem though).

There is a good way to prevent this type of failure though; simply check if the one time address you are using is already on the block chain (this can be done automatically). If it is, you know there is a problem.

  • 1
    I'm TheKing01 :) – PyRulez Aug 13 '16 at 20:23
  • Good to know! Did my post sufficiently answer your question? – dEBRUYNE Aug 13 '16 at 20:30
  • yeah. I was wondering if the Monero blockchain would reject the transaction, which I think you answered. – PyRulez Aug 13 '16 at 20:31
  • In my example it will reject the outputs of one of Bob's transactions, but will accept both of Alice's transaction. – dEBRUYNE Aug 13 '16 at 20:33
  • Does this mean all key images are stored somewhere forever, for new key images to be checked against? – bekah Dec 11 '16 at 23:28
1

If two outputs are sent to the same one time address, they will be accepted by the blockchain. However, only one of them may be spent. It is equivalent to burning coins. The wallet is setup so that, if it detects this, the largest value output is used (assuming the first one is not spent before the second one arrives).

  • 1
    Huh, it would be a good idea to change that (so that the block chain rejects one of them). – PyRulez Aug 13 '16 at 19:35
  • The blockchain will reject the smallest one if the receiver tries to subsequently spend them. – dEBRUYNE Aug 13 '16 at 19:51
  • 2
    The network will reject a spend of the second one. The creation of the second output is still accepted, and is arguably something that would be best forbidden. Whether the smallest one is the one that's prevented depends on whether the first one is already spent when the second one is received. – user36303 Aug 13 '16 at 21:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.