How does the wallet check against the key image in a tx that it was them that spent it, given the private/public view and private/public spend?

  • I know they use the private spend key to check against key images, but not sure how Jun 9, 2019 at 21:17

1 Answer 1


If a wallet has received an output in the past, that means the wallet will know the private key for that output. This is the case even if you restore the wallet from seed.

The private key for the output is calculated as x=Hs(8aR||i)+b, where a is the private view key, R is the transaction public key published with the transaction, i is the index of the output in the incoming transaction, b is your private spend key, and Hs() means keccak hash the contents and return a scalar (integer).

The key image is calculated as xHp(Hs(8aR||i)G+B), where G is the agreed-upon base point on the ed25519 curve, B is your public spend key, and Hp() means keccak hash the contents and return a curve point.

The wallet checks if the key image of any previously received output is observed to be attached to any transaction it comes across as it scans the blockchain.

The daemon will reject transactions that are broadcast which contain any previously encountered key images. Although the daemon will not know which specific output referenced in each ring that each key image refers to, it doesn't need to know. All it needs to do is reject duplicates.

  • Would the wallet need to make another query to the node? Since the index i will not be given with the inputs vins Jun 9, 2019 at 21:54
  • @WeCanBeFriends the index would be implied, as the list of key images retrieved by the wallet from the daemon are ordered. It's the order within the transaction, starting from 0, not order in the global list of all outputs in existence.
    – knaccc
    Jun 9, 2019 at 21:55
  • Oh, I see what you mean. Once the wallet receives a tx, it will calculate the keyImage for it and store it, then use that to look up Jun 9, 2019 at 22:01
  • My initial question was based on the assumption that the wallet did not have the output, so it was spent by a different wallet with the same keys. But I think this is not a reasonable assumption Jun 9, 2019 at 22:02
  • 1
    The wallet, on scanning new blocks, if the output is for you, it creates and caches a key image. So yes, it's on receiving not spending that they are created. Then of course attached to vin[i] when spending.
    – jtgrassie
    Jun 9, 2019 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.