I've noticed such risk mentioned in this answer to another question, where a presentation (page 28) by Nicolas T. Courtois, studying Monero cryptography, was referred to.

I'm interested to better understand what it means, and what would be the consequences of such bad RNG.

The note reads:

apparently 2 bad random r in monero same user, make the attacker who has 2 view keys v also, able to compute a linear relation between their e keys used to spend...

What does it mean bad random r? That the sender's (Bob's) RNG is such that the sequence of r's could be predicted knowing some 2 r's? But how do you find any r? Anyone can see R, but with view key, you can only see the shared secret rA=aR. If you know 2 private view keys from the same transaction, you could brute-force the r used? Is that what it means? How would finding r work?

Then, by guessing the next r, he could spend any transaction sent to Alice, if he knows Alice's private view key?

Also, what about the linear relation between e keys? Note: e refers to x in the CN whitepaper, meaning the one-time destination private key. Would it mean that the attacker could spend anything sent by Bob, provided that he could "find" those transactions by knowing any of the Bob's recipients private view keys, and not just Alice's?

  • 2
    I think the references are here but I can't give you a full answer right now, hence the comment! Also my name is on the front of those slides!! omg I had no idea!!
    – bekah
    Commented Nov 26, 2016 at 18:36
  • @bekah Thank you for contributing to SE! I enjoyed the slides and your answer to that question Commented Nov 26, 2016 at 18:49
  • @bekah thanks for the link! It's nice to see interest from academia, too!
    – JollyMort
    Commented Nov 26, 2016 at 20:07
  • I still don't get what's the problem the slide describes, especially since it's under the slide of a different scheme. Further down (slide 36), the 2-key nonce stealth addresses are explained w/o this note.
    – JollyMort
    Commented Jan 3, 2017 at 22:53


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.