I have seen this discussed on Bitcointalk, but how does one prove they sent XMR to the receiver of the transaction if the recipient claims they never got it?
Is this where a viewkey comes in? What tools exist to help me use the viewkey in this situation and what information will I need to provide?
Yes, the viewkey comes in here. One can use this tool: http://xmr.llcoins.net/checktx.html
What you need:
When you fill these in you can check if the transaction arrived
best regards,
r in CN whitepaper. The "shared secret" is rA = aR and only the sender knows r because it's just some random number rolled by him. Thus, knowing the r proves you're the sender of a TX. The recipient can verify it's a match by checking if rA = aR
Commented
Mar 4, 2017 at 23:05
It's an interesting question, and yes there is a way to prove a specific transaction.
TL;DR with the transaction private key you can prove it was made by you. Since it's a random number generated by the sender at the time of transaction creation, it must be saved locally as it can't be recreated. There's another option without this requirement but it is not currently in use.
First, let's understand how transactions are created. Every transaction will have a transaction key-pair R = rG created by the sender. The r is just some random number rolled by the sender and is used as the transaction private key. The R is the transaction public key. This key-pair is specific to a transaction and the public part is published with the transaction.
So, if everyone can see R of any transaction, and only the sender knows r, then someone knowing r must be the sender of some transaction R. The sender can prove he knows r by simply disclosing r, which is the current mechanism to prove payments - you give your r to the recipient and he checks if it's a match with some transaction R in which he received some funds. A 3rd party arbiter will also need to know the receiving address to assert it all ties together. The recipient's view key is never required.
However, if anyone else also would know the r, then he could then claim he was the one sending the funds and it would be a plausible claim. It would be better for the sender to instead sign a message using r which would let him prove he knows r without disclosing it.
Recall that Monero one-time keys (outputs) are created as
P = H_s(rA||i)G + B,
where A and B are recipient public view and spend keys. Since r is random, the one-time keys are non-deterministic and you can't tell 2 apart. This means that they can never be linked to a specific address and the sender can't prove a given output was created by him unless he knows the r.
But what if the sender lost his r? Can he still prove that some payment came from him? Yes, by using the other end of transaction (the input).
He can't prove that he created the output in question because he lost the r but he can prove that the input used in that transaction came from him. He can do this by signing some message using the key image(s) of input(s) in that transaction. To be able to generate this signature, the sender must use his private spend key. This method is not currently in use.
