15

The title says it all, but I want to frame the issue two ways, in hopes of a slightly more in-depth answer.

With Bitcoin, the blockchain is transparent. In the "ordinary course of business" in the world of Bitcoin, it's rather simple for miners to quickly prove whether or not an output is available to be spent. But how does it work with Monero?

What made me think to ask this is that when recovering a wallet, it took my computer hours to scan the blockchain, presumably using my private send key and private view key all along the way, while it determined which outputs were in my address and which of those outputs I had spent as inputs in new 'send' transactions. If my computer has to work so hard to prove that it has legitimate outputs to spend, how can blocks be mined so quickly (in minutes) without double-spends sneaking by?

Improve this question
2
  • I'm guessing it must have something to do with how transactions are signed, but I just don't understand how the miners can so quickly prove that the signature is valid and the transaction is legitimate.
    – scoobybejesus
    Oct 11, 2016 at 5:45
  • 1
    Depending on your parameters, you might've scanned the entire blockchain in a few hours, most of which was spent checking which outputs are yours; very little time is needed to query spent status, as it's just a list. Mining only checks the transactions in the current block (again, most of the time on checking signatures for validity, very little on querying the key image list)..
    – Luigi
    Oct 11, 2016 at 16:16

2 Answers 2

Reset to default
10

Each transaction generates a key image. In the CryptoNote protocol, key images used more than once are rejected by the blockchain as double-spends. When a new transaction is received, the miner need only verify that the key image does not already exist in the database.

When your wallet is scanning the blockchain, it must check each transaction output in order to see which belongs to you.

In essence, there's a fingerprint database of spent outputs, so checking a new fingerprint is pretty quick.

Improve this answer
3
  • 1
    I believe "stealth-address" above should be "one-time public keys". The wallet knows your stealth address already, but not the public keys generated by senders when sending transactions to that sealth-address. This is how one finds the outputs they control.
    – Jonathan Cross
    Aug 21, 2017 at 12:08
  • "stealth-address" and "one-time public keys" both refer to the same thing and thus can be used interchangeably.
    – jtgrassie ♦
    Oct 7, 2019 at 14:59
  • Link doesn’t work for me
    – Montana Burr
    Sep 16 at 1:30
11

Double spends are prevented by the use of key images, which are sent along with each output being spent in a transaction, and which are checked for uniqueness before allowing the transaction.

In the Cryptonote protocol, an output's private key can be used to uniquely generate a key image in such a way that a miner can check a purported key image really is correct. When spending an output, its key image is calculated by the sender, and included in the transaction. Miners then check these key images are real, and check whether they were already seen in the blockchain. If they were, it means the output being spent was already spent in a previous transaction, which is then discarded.

Since a miner can verify a purported key image, but not create one without the private key (similar to a cryptographic signature), only the owner of the output may spend it - just once.

The set of key images must then be kept for lookup by miners and other nodes. This is the "unbounded TXO set" that is often mentioned as a cons of using Monero/Cryptonote. Each key image is 32 bytes long.

Once RingCT is enabled, this system will not change, as RingCT includes that system as well. However, since transactions will not have to split amounts anymore, that TXO set growth will substantially decrease.

UPDATE: RingCT is now enabled. You can read more about it here: What is RingCT and how does it make Monero private?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.