4

This is a scenario I've come up with to help me understand key images.

Let's say I have Wallet 1 and Wallet 2. Wallet 1 has TXO A and TXO B. I send TXO A and TXO B as inputs to Wallet 2. TXO B was reduced to pay transaction fees. Then I send TXO A and the updated TXO B as inputs back to Wallet 1. TXO B was reduced further to pay transaction fees. What I'm left with that concerns me is TXO A.

Based on my rudimentary knowledge of key images, I know that a key image was generated as part of the first transaction (the send from Wallet 1 to Wallet 2). That key image, in layman's terms, says that Wallet 1 spent TXO A (and TXO B, of course), so it can no longer spend TXO A again.

But now TXO A is back in Wallet 1, unchanged (as far as I know) from its original glory. Will the key image be different the second time around, so that Wallet 1 is not prevented from spending TXO A again? Does the original key image have an effect on the ability of Wallet 1 to spend TXO A the second time?

(Please recall from the title that I'm interested in the ingredients - perhaps "variables" is the technical term - for how a key image is generated.)

Improve this question

1 Answer 1

Reset to default
4

When you send TXO A, it doesn't stay unchanged in wallet 2, it it now a new TXO A2 (with a one time address for wallet 2) that can't be linked with certainty to TXO A because of the ring signature.

According to the CryptoNote whitepaper, the key image is computed from the one-time key pair associated to the transaction output:

I = x*H(P)

where:

I is the key image
x is the one-time private key
P is the one-time public key (point P = x*G)
H is a deterministic hash function

If you try to spend TXO A a second time, the network will reject it because the key image for TXO A will already be in the known key images set. But when you spend TXO A2 (back to wallet 1), it will work fine because the key image for TXO A2 is different from the key image for TXO A (because these two TXOs are associated to different one-time key pair).

Improve this answer
9
  • That makes sense (well the words.. I'll need to dig into the whitepaper and the math more deeply), but I'm actually concerned with TXO A3, for sending from Wallet 1 a second time. Will x and P be the same in the key image spending TXO A3 as they were when spending TXO A, but H will be different?
    – scoobybejesus
    Commented Oct 11, 2016 at 15:13
  • You might be missing the one-time property. x and P are always different for different outputs.
    – Luigi
    Commented Oct 11, 2016 at 15:59
  • This answer is good as far as the "ingredients"; perhaps a different question would be in order for understanding them more fully, or maybe editing this question. A key image is simply an additional public key for x computed on a different base (a hash of the public key on base G). A ring signature signs for both public keys (P,I), but due to the multiple public keys (at mixin>0), it's unknown which one I belongs to.
    – Luigi
    Commented Oct 11, 2016 at 16:07
  • I did read "one-time." I don't understand how x and P have that property (I guess it means x and P are derived from my keys, but they aren't actually my keys), but I appreciate you enforcing that point, so at least now I have something specific to look further into. Thanks very much.
    – scoobybejesus
    Commented Oct 11, 2016 at 16:08
  • 1
    No, no. You submit P and I, but P as part of a list of Ps, and I as the key image. :) They are both public keys, though. All curve points are a public key for some x and some generator (base) point. For example G is the public key for x^-1*P where P = xG.
    – Luigi
    Commented Nov 28, 2016 at 17:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.