The viewkey can be used to see the outputs sent to my address, but not the outputs I generate when sending monero. If I need to know the balance I also need the private spendkey. It is suggested that if I were to give the viewkey and a big list of transaction key images to an auditor so they can verify what I've spent.

Am I correct in assuming that if I omit some transactions when sending to the auditor, they would think I have a larger balance than I actually do? If this is true, is it also true that there is no way to give an auditor the ability to verify that funds aren't spent?

I considered one way to partially confirm my balance would be to sweep the wallet to a new location that the auditor has another viewkey for, but there are some downsides to this approach (requires the owner to share a new viewkey, spend transaction fees, and manage a second wallet, auditor needs a list of all keys, can't be done for cold storage).

up vote 20 down vote accepted

The auditor will see that you have omitted part of the key images.

The auditor can see all the outputs received by your account. Without the spend key, the auditor cannot generate the key images corresponding to those, however. In order to prove your balance, you generate a signed list of key images (see https://github.com/monero-project/bitmonero/pull/928 for the new commands and RPC calls to do this, soon to be merged now merged), and send this to your auditor.

The signatures are essentially a 0-mixin ring signature. Since these have only one public key attached, this proves that the key image is that of the public key.

The auditor then loads those key images, and checks that each purported key image matches the public key of the output that the auditor knows was received. If the signature checks out, it is proof that the key image really is the key image for this output. The auditor can then check the blockchain to see whether this key image appears on it (spent) or not (unspent).

For reasons of simplicity, this check is done in blockchain order, so you're supposed to give the key images in the same order as their appearance on the blockchain. If you omit a key image (or add one, or change one), the signature will not check out, and the auditor knows you're trying to pull a fast one (or, you never know, a bug somewhere, data corruption in transfer, but Questions Will Be Asked).

A special case happens at the end of the list, since it's very possible that new outputs will be received between the time the signed key images are generated and the time they are checked. This is handled simply by stating that the balance is correct as of the last seen block height in the key images (technically, it's also valid till the block preceding the next output received, if any).

As for omitting transactions, this system works on key images for the outputs received. Transactions are not used, so you can't omit any.

  • "If you omit a key image ..., the signature will not check out" could you explain? If I omit a key image, wouldn't they just skip over it when scanning the block chain, like all of the other key images that aren't yours? – PyRulez Aug 24 '16 at 14:30
  • They have your view key, so they see what outputs are to your wallet. – user36303 Aug 24 '16 at 18:43
  • Oh, so your saying that you publish the key images for all your incoming transactions, not just the spent ones, right? – PyRulez Aug 24 '16 at 18:55
  • 1
    Yes. placeholder for stupid length check. – user36303 Aug 24 '16 at 18:56
  • 3
    There's some handwavy magic that boils down to "the key image is signed by a ring signature with mixin 0 for that output". The ring signature can be checked in the same way as a normal ring signature. See luigi1111 on IRC for details of the crypto theory, because I don't understand it well. – user36303 Aug 25 '16 at 20:39

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.