Can I fake a balance by giving the view key to an auditor but omitting some transactions and key images?

Question

The viewkey can be used to see the outputs sent to my address, but not the outputs I generate when sending monero. If I need to know the balance I also need the private spendkey. It is suggested that if I were to give the viewkey and a big list of transaction key images to an auditor so they can verify what I've spent.

Am I correct in assuming that if I omit some transactions when sending to the auditor, they would think I have a larger balance than I actually do? If this is true, is it also true that there is no way to give an auditor the ability to verify that funds aren't spent?

I considered one way to partially confirm my balance would be to sweep the wallet to a new location that the auditor has another viewkey for, but there are some downsides to this approach (requires the owner to share a new viewkey, spend transaction fees, and manage a second wallet, auditor needs a list of all keys, can't be done for cold storage).

Answer 1

The auditor will see that you have omitted part of the key images.

The auditor can see all the outputs received by your account. Without the spend key, the auditor cannot generate the key images corresponding to those, however. In order to prove your balance, you generate a signed list of key images (see https://github.com/monero-project/bitmonero/pull/928 for the new commands and RPC calls to do this, soon to be merged now merged), and send this to your auditor.

The signatures are essentially a 0-mixin ring signature. Since these have only one public key attached, this proves that the key image is that of the public key.

The auditor then loads those key images, and checks that each purported key image matches the public key of the output that the auditor knows was received. If the signature checks out, it is proof that the key image really is the key image for this output. The auditor can then check the blockchain to see whether this key image appears on it (spent) or not (unspent).

For reasons of simplicity, this check is done in blockchain order, so you're supposed to give the key images in the same order as their appearance on the blockchain. If you omit a key image (or add one, or change one), the signature will not check out, and the auditor knows you're trying to pull a fast one (or, you never know, a bug somewhere, data corruption in transfer, but Questions Will Be Asked).

A special case happens at the end of the list, since it's very possible that new outputs will be received between the time the signed key images are generated and the time they are checked. This is handled simply by stating that the balance is correct as of the last seen block height in the key images (technically, it's also valid till the block preceding the next output received, if any).

As for omitting transactions, this system works on key images for the outputs received. Transactions are not used, so you can't omit any.