The Wikipedia article on Ring signatures states that

CryptoNote implements O(n) ring signature scheme by Fujisaki and Suzuki in p2p payments to achieve sender's untraceability.

More efficient algorithms have appeared recently. There are schemes with the sublinear size of the signature,[1] as well as with constant size.[2]

Would these more efficient algorithms be usable for Monero (through a hard-fork) to reduce or even avoid the increase in size of high-mixin transactions?

[1] Fujisaki, Eiichiro (2011). "Sub-linear size traceable ring signatures without random oracles".

[2] Au, Man Ho; Liu, Joseph K.; Susilo, Willy; Yuen, Tsz Hon (2006). "Constant-Size ID-Based Linkable and Revocable-iff-Linked Ring Signature".

1 Answer 1


This was answered by core-team member smooth on Reddit:

First one has a trusted setup. I don't know what issues there might be with the other one. I remember the MRL guys look at some sublinear ring sig at one point a year or two ago and it had high minimum size, such that it would only be useful for very large mix sets. That could still be an improvement overall but not necessarily a huge one so it wasn't highly prioritized.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.