I've noticed such risk mentioned in this answer to another question, where a presentation (page 28) by Nicolas T. Courtois, studying Monero cryptography, was referred to.

I'm interested to better understand what it means, and what would be the consequences of such bad RNG.

The note reads:

apparently 2 bad random r in monero same user, make the attacker who has 2 view keys v also, able to compute a linear relation between their e keys used to spend...

What does it mean bad random r? That the sender's (Bob's) RNG is such that the sequence of r's could be predicted knowing some 2 r's? But how do you find any r? Anyone can see R, but with view key, you can only see the shared secret rA=aR. If you know 2 private view keys from the same transaction, you could brute-force the r used? Is that what it means? How would finding r work?

Then, by guessing the next r, he could spend any transaction sent to Alice, if he knows Alice's private view key?

Also, what about the linear relation between e keys? Note: e refers to x in the CN whitepaper, meaning the one-time destination private key. Would it mean that the attacker could spend anything sent by Bob, provided that he could "find" those transactions by knowing any of the Bob's recipients private view keys, and not just Alice's?

  • 2
    I think the references are here but I can't give you a full answer right now, hence the comment! Also my name is on the front of those slides!! omg I had no idea!! – bekah Nov 26 '16 at 18:36
  • @bekah Thank you for contributing to SE! I enjoyed the slides and your answer to that question – seek adventure Nov 26 '16 at 18:49
  • @bekah thanks for the link! It's nice to see interest from academia, too! – JollyMort Nov 26 '16 at 20:07
  • I still don't get what's the problem the slide describes, especially since it's under the slide of a different scheme. Further down (slide 36), the 2-key nonce stealth addresses are explained w/o this note. – JollyMort Jan 3 '17 at 22:53

Your Answer


By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.