1

How does the wallet check against the key image in a tx that it was them that spent it, given the private/public view and private/public spend?

  • I know they use the private spend key to check against key images, but not sure how – WeCanBeFriends Jun 9 at 21:17
1

If a wallet has received an output in the past, that means the wallet will know the private key for that output. This is the case even if you restore the wallet from seed.

The private key for the output is calculated as x=Hs(8aR||i)+b, where a is the private view key, R is the transaction public key published with the transaction, i is the index of the output in the incoming transaction, b is your private spend key, and Hs() means keccak hash the contents and return a scalar (integer).

The key image is calculated as xHp(Hs(8aR||i)G+B), where G is the agreed-upon base point on the ed25519 curve, B is your public spend key, and Hp() means keccak hash the contents and return a curve point.

The wallet checks if the key image of any previously received output is observed to be attached to any transaction it comes across as it scans the blockchain.

The daemon will reject transactions that are broadcast which contain any previously encountered key images. Although the daemon will not know which specific output referenced in each ring that each key image refers to, it doesn't need to know. All it needs to do is reject duplicates.

  • Would the wallet need to make another query to the node? Since the index i will not be given with the inputs vins – WeCanBeFriends Jun 9 at 21:54
  • @WeCanBeFriends the index would be implied, as the list of key images retrieved by the wallet from the daemon are ordered. It's the order within the transaction, starting from 0, not order in the global list of all outputs in existence. – knaccc Jun 9 at 21:55
  • Oh, I see what you mean. Once the wallet receives a tx, it will calculate the keyImage for it and store it, then use that to look up – WeCanBeFriends Jun 9 at 22:01
  • My initial question was based on the assumption that the wallet did not have the output, so it was spent by a different wallet with the same keys. But I think this is not a reasonable assumption – WeCanBeFriends Jun 9 at 22:02
  • 1
    The wallet, on scanning new blocks, if the output is for you, it creates and caches a key image. So yes, it's on receiving not spending that they are created. Then of course attached to vin[i] when spending. – jtgrassie Jun 9 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.