I am working on monero synchronization on an ARM cortex m4 microcontroller and I got stuck with computing key image. As a testing data I created a fresh wallet A and a fresh wallet B. I funded wallet A with some amount, then I did a swipe_all and sent all funds to wallet B. Now am trying to compute the same key image as I got from the swipe_all transaction.

Key image should be computed like this:

I = x * Hp(P)

where x is output's private key, Hp is a hash_to_point function and P is an output.

This is a mininero's implementation of hash_to_ec, which I m trying to rewrite in C:

def hash_to_ec(key):
    #takes a hash and turns into a point on the curve
    #In MININERO, I'm not using the byte representation
    #So this function is superfluous
    h = hash_to_scalar(key, len(key))
    point = ge_scalarmult_base(h)
    return ge_mul8(point)

My testing data, I have tx's privkey x and output P (I know this P is mine):

x:  39f60ab67a49c086d5c31a37cd503fdf0867b57410e7df370a981a1828b0790e
P:  dbf2922ecf49468ab09cf70fc4294de5036f2befaaaa14e0a108a0f5dd13128a

I want to compute a key image out of that. I divided it into two steps, [1] hash_to_point and [2] multiply with x:

[1] hash_to_point function:
   [1.1] At first  I take P and compute hash_to_scalar (keccak256 and
         then reduce32, this looks working well), output is here:

   [1.2] After that I multiply it on a curve with a base point G, 
         output is here:

   [1.3] Now I multiply it with 8, then do a modulo with a prime
         p25519p25519 = (2**255 - 19), output is here:

[2] Now I should get a keyImage by taking an output from [1.3], 
    treating it as an Y-coordinate of a point on a curve, and 
    multiplying this point with x. Output is here (Y-coordinate):

[3] But the keyImage of this output which I later spent and found 
    on a blockchain is this:

Please, could somebody run a working code on my data and help me to find the point of failure? I am quite lost here.. Many thanks in advance!

1 Answer 1


The hash_to_ec function in Mininero is not the same as the one used in the Monero C codebase. You need to use hashToPointCN from Mininero instead. See https://github.com/monero-project/mininero/blob/master/mininero.py#L238

If you're looking for the C version of this, you can find it named hash_to_ec here: https://github.com/monero-project/monero/blob/8f6f674753bae7494e1ee4569004947d47a4e983/src/crypto/crypto.cpp#L481 (and also see the generate_key_image function below it)

Also note that x is the output private key of the output P, and not the transaction private key. The transaction private key is not something that the recipient will have visibility of or will ever need to know, as it is something normally kept secret by the sender. I checked the x and P values you stated, and P does equal xG, so you are using the correct value of x.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.