7

When you are signing a Monero transaction, do you sign the transaction itself, or do you hash the transaction and then sign that?

migrated from crypto.stackexchange.com Sep 12 '16 at 9:59

This question came from our site for software developers, mathematicians and others interested in cryptography.

9

In the interest of pedantry (and since I can't comment -_-):

  1. You sign the hash of the transaction prefix. In Monero that is everything but the signatures.

  2. (at the above answer) Monero relies on ed25519, not EdDSA. EdDSA is a particular signature system (completely absent in Monero). Monero's ring signatures are presently the Fujisaki-Suzuki variety, implemented in the ed25519 curve.

One additional quibble: in Monero's ring signatures, the hash doesn't actually have "mathematical" transformations applied--it is rather hashed again along with a bunch of other data--so one actually could "sign" an arbitrary-length message instead of a hash of said message.

  • 1
    If your signed an arbitrary message, would the blockchain accept it? – PyRulez Sep 14 '16 at 23:54
  • 1
    No. The daemon's check function will check the signature against the hash. I only mean that function could work as such, not that the blockchain does. – Luigi Sep 14 '16 at 23:59
  • 1
    I'm confused... RE: "Monero relies on ed25519, not EdDSA. EdDSA is a particular signature system (completely absent in Monero)." Wikipedia seems to indicate the opposite -- that ed25519 is a particular type of EdDSA. What am I missing here? – Jonathan Cross Sep 28 '17 at 18:42
  • Yeah, terminology issues. I use ed25519 to refer to the curve, and I'm not sure if any other term makes more sense. Ed25519 could also refer to EdDSA on this particular curve, which would be the wiki definition AFAIK. However, we use the curve only and no part of the signature algorithm. – Luigi Dec 27 '17 at 0:29
7

All¹ asymmetric signature protocols calculate a hash of the message and then apply the “mathematical” transformation to this hash. This includes EdDSA which Monero relies on. The reason is that all those mathematical transformations work on fixed-size numbers (of about a few hundred bits). Hashing condenses the information into this fixed size, with the property that it is effectively impossible² to have two messages (here, two transaction logs) with the same hash, hence a signature only validates one particular message.

The use of a hash (or at least a function with some of the properties of a hash: condensing information while being effectively injective) is intrinsic in any form of blockchain, where the signature of a transaction also validates all the history of the system that made this transaction possible (e.g. a debit has to validate all the transactions that credited the amount to the debited account) but the signature size should not grow as the history grows.

¹ At least all the ones I've heard of, and doing otherwise would be surprising.
² I.e. if it's possible then the hash function is considered badly broken.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.