17

When a transaction is made with monero there is a 'key image' in the transaction info. what is this exactly? is it like the diffie-hellman exchange to create the one time addresses?

13

Monero are always sent to the one-time destination (public key) P. In the CN whitepaper, the corresponding private key is referred to as x.

When you're spending, you're combining your P with a couple of other ones in a ring signature and signing with the x. Only one of the Ps will be spent, but the ring signatures hide which one. In other words, the signature is verified by all of the Ps, and it looks like any of their corresponding private keys could have signed the transaction, thus obfuscating the sender. But how do we know you're not double-spending? We need a way to prove that the private key used to sign was not used before, without revealing which one it is. That is where the key image comes in:

I = xHp(P)

Let's also take a look at how the one-time key-pair is derived:

P=xG

Since I is a one-way function of x this means that:

  1. Nobody can recover the public key from the key image and identify the signer;
  2. The signer cannot make two signatures with different I’s and the same x which in effect means you can spend your P only once.
  • Does the recipient's one-time public key play any part in the generation of the key image? – Jonathan Cross Aug 21 '17 at 12:18
  • 1
    Nope. His public key will later be used to generate another key image when he will be spending it. Thing is, the generation requires private one-time key so you can't know what it will be. – JollyMort Aug 21 '17 at 12:50
  • @JollyMort can key image be compared to Unspent transaction outputs in Bitcoin and some other cryptocurrencies? If not is there a roughly equivalent of it in Monero? – user2284570 Apr 9 at 11:11
11

The key image is an alternate public key computed on a second base point, specifically Hp(P), instead of G. It is required in traceable ring signature construction to ensure multiple signatures with the same real key are linked (and thus rejected by the Monero protocol).

5

The layman's way to look at what a key image is would be that it allows the Monero network to quickly confirm whether an output as been spent or not. In other words, the key image is a necessary component of Monero's opaque blockchain ecosystem, because it allows for the prevention of double-spends.

For more information on this concept, please refer to this question and answer:

What is Monero's mechanism for defending against a double-spend attack?

  • Can key images be compared to Unspent transaction outputs (utxo) in Bitcoin and some other cryptocurrencies? If not is there a roughly equivalent of it in Monero? Can there be several key images attached to a single real input address? Is a key image attached to an amount of Monero? – user2284570 Apr 9 at 11:27
  • Monero has TXOs because they generally cannot be proven as spent or unspent. For every output (TXO) there exists a single key image that can only be created by the same private key that is eligible to sign the transaction (to prove ownership, basically). There is no limit to the amount of TXOs sent to an address, so there is also no limit to the amount of key images. A key image is "attached" to an output/TXO, not to an amount. The amount is "attached" to the output/TXO. – scoobybejesus Apr 9 at 15:44
  • So a transaction from a single real address can contain several key images ? I’m asking this because some cryptocurrencies like Ethereum which track only balances instead of coins. – user2284570 Apr 9 at 19:19
  • Yes, if I want to transfer 8 Monero, but I have two 5-Monero outputs, I would have to spend both outputs. A key image would be attached to each ring signature. The recipient would receive their 8 Monero, and I'd receive back as change a little fewer than 2 Monero (because of the transaction fee). – scoobybejesus Apr 10 at 3:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.