It's an interesting question, and yes there is a way to prove a specific transaction.
TL;DR with the transaction private key you can prove it was made by you. Since it's a random number generated by the sender at the time of transaction creation, it must be saved locally as it can't be recreated. There's another option without this requirement but it is not currently in use.
First, let's understand how transactions are created. Every transaction will have a transaction key-pair
R = rG created by the sender. The
r is just some random number rolled by the sender and is used as the transaction private key. The
R is the transaction public key. This key-pair is specific to a transaction and the public part is published with the transaction.
So, if everyone can see
R of any transaction, and only the sender knows
r, then someone knowing
r must be the sender of some transaction
R. The sender can prove he knows
r by simply disclosing
r, which is the current mechanism to prove payments - you give your
r to the recipient and he checks if it's a match with some transaction
R in which he received some funds. A 3rd party arbiter will also need to know the receiving address to assert it all ties together. The recipient's view key is never required.
However, if anyone else also would know the
r, then he could then claim he was the one sending the funds and it would be a plausible claim. It would be better for the sender to instead sign a message using
r which would let him prove he knows
r without disclosing it.
Recall that Monero one-time keys (outputs) are created as
P = H_s(rA||i)G + B,
where A and B are recipient public view and spend keys. Since
r is random, the one-time keys are non-deterministic and you can't tell 2 apart. This means that they can never be linked to a specific address and the sender can't prove a given output was created by him unless he knows the
But what if the sender lost his
r? Can he still prove that some payment came from him? Yes, by using the other end of transaction (the input).
He can't prove that he created the output in question because he lost the
r but he can prove that the input used in that transaction came from him. He can do this by signing some message using the key image(s) of input(s) in that transaction. To be able to generate this signature, the sender must use his private spend key. This method is not currently in use.