Help needed with calculating a key image

Question

I am working on monero synchronization on an ARM cortex m4 microcontroller and I got stuck with computing key image. As a testing data I created a fresh wallet A and a fresh wallet B. I funded wallet A with some amount, then I did a swipe_all and sent all funds to wallet B. Now am trying to compute the same key image as I got from the swipe_all transaction.

Key image should be computed like this:

I = x * Hp(P)

where x is output's private key, Hp is a hash_to_point function and P is an output.

This is a mininero's implementation of hash_to_ec, which I m trying to rewrite in C:

def hash_to_ec(key):
    #takes a hash and turns into a point on the curve
    #In MININERO, I'm not using the byte representation
    #So this function is superfluous
    h = hash_to_scalar(key, len(key))
    point = ge_scalarmult_base(h)
    return ge_mul8(point)

My testing data, I have tx's privkey x and output P (I know this P is mine):

x:  39f60ab67a49c086d5c31a37cd503fdf0867b57410e7df370a981a1828b0790e
P:  dbf2922ecf49468ab09cf70fc4294de5036f2befaaaa14e0a108a0f5dd13128a

I want to compute a key image out of that. I divided it into two steps, [1] hash_to_point and [2] multiply with x:

[1] hash_to_point function:
   [1.1] At first  I take P and compute hash_to_scalar (keccak256 and
         then reduce32, this looks working well), output is here:
         5845a60b165d38e30a7af2232069333d9b5b5305632a6b004fce31ad708b1b05

   [1.2] After that I multiply it on a curve with a base point G, 
         output is here:
         c886e669ea11a42317797b008fd053717887505c59a2dd26c4d2ca12efe3ac77

   [1.3] Now I multiply it with 8, then do a modulo with a prime
         p25519p25519 = (2**255 - 19), output is here:
         c02a325db0e8c21957d0931f01499be9d9dc9a2a1853590378728e69855bdc28

[2] Now I should get a keyImage by taking an output from [1.3], 
    treating it as an Y-coordinate of a point on a curve, and 
    multiplying this point with x. Output is here (Y-coordinate):
    322af4d8e6250d3f4a2de39462569bc43d88701d810aeb531871045dd858f8b7

[3] But the keyImage of this output which I later spent and found 
    on a blockchain is this:
    40c13470bce4d81ab1d7a38d78e0d73daee6f26d206891bbe6bf9efedabc1a62

Please, could somebody run a working code on my data and help me to find the point of failure? I am quite lost here.. Many thanks in advance!

Answer 1

The hash_to_ec function in Mininero is not the same as the one used in the Monero C codebase. You need to use hashToPointCN from Mininero instead. See https://github.com/monero-project/mininero/blob/master/mininero.py#L238

If you're looking for the C version of this, you can find it named hash_to_ec here: https://github.com/monero-project/monero/blob/8f6f674753bae7494e1ee4569004947d47a4e983/src/crypto/crypto.cpp#L481 (and also see the generate_key_image function below it)

Also note that x is the output private key of the output P, and not the transaction private key. The transaction private key is not something that the recipient will have visibility of or will ever need to know, as it is something normally kept secret by the sender. I checked the x and P values you stated, and P does equal xG, so you are using the correct value of x.