How does Monero verify a tx outputs key image?

Question

I'm new to Monero and I'm trying to get to grips on transactions compared to BTC.

What I'm trying to understand is - what prevents a transaction using a completely random string for 'x' within I = xHp(P) when generating the TXO key image?

Is the key image generated with the spending TXOs private key, and that key is then passed into the ring signature function, which will sign the transaction assuming one of the public keys given, was used to generate the key image?

Any guidance in helping me understand the mechanism intuitively would be much appreciated.

Answer 1

Intuitively:

You are spending an output P, where P=xG. You spend an output by providing a signature proving you know the private key x corresponding to the public key P.

If you also declare the key image I=xHp(P) as part of the transaction, you are declaring a public key I with private key x.

You are correct that in isolation, transaction verifiers cannot know you have declared the correct key image.

However, when you provide your signature proving you know x for P, you extend the signature to simultaneously prove you know x for I, in a way such that mathematically, the combined proof would only verify if both values of x were the same.

Thus, you have proven that the key image was calculated using the same private key x that applied to the output one-time public key.

You can't use just any value of Hp(P), since the verifier calculates that themselves based on the P you are spending, and uses that calculated value to verify the signature.

For the math, see page 30 of Zero to Monero