When a transaction is made with monero there is a 'key image' in the transaction info. what is this exactly? is it like the diffie-hellman exchange to create the one time addresses?

  • Lalu bagaimana cara untuk memasukan scrensout kunci monero di monero
    – Eko Mer
    Commented Apr 13, 2023 at 2:27

4 Answers 4


Monero are always sent to the one-time destination (public key) P. In the CN whitepaper, the corresponding private key is referred to as x.

When you're spending, you're combining your P with a couple of other ones in a ring signature and signing with the x. Only one of the Ps will be spent, but the ring signatures hide which one. In other words, the signature is verified by all of the Ps, and it looks like any of their corresponding private keys could have signed the transaction, thus obfuscating the sender. But how do we know you're not double-spending? We need a way to prove that the private key used to sign was not used before, without revealing which one it is. That is where the key image comes in:

I = xHp(P)

Let's also take a look at how the one-time key-pair is derived:


Since I is a one-way function of x this means that:

  1. Nobody can recover the public key from the key image and identify the signer;
  2. The signer cannot make two signatures with different I’s and the same x which in effect means you can spend your P only once.
  • Does the recipient's one-time public key play any part in the generation of the key image? Commented Aug 21, 2017 at 12:18
  • 1
    Nope. His public key will later be used to generate another key image when he will be spending it. Thing is, the generation requires private one-time key so you can't know what it will be.
    – JollyMort
    Commented Aug 21, 2017 at 12:50
  • @JollyMort can key image be compared to Unspent transaction outputs in Bitcoin and some other cryptocurrencies? If not is there a roughly equivalent of it in Monero? Commented Apr 9, 2019 at 11:11

The key image is an alternate public key computed on a second base point, specifically Hp(P), instead of G. It is required in traceable ring signature construction to ensure multiple signatures with the same real key are linked (and thus rejected by the Monero protocol).


The layman's way to look at what a key image is would be that it allows the Monero network to quickly confirm whether an output as been spent or not. In other words, the key image is a necessary component of Monero's opaque blockchain ecosystem, because it allows for the prevention of double-spends.

For more information on this concept, please refer to this question and answer:

What is Monero's mechanism for defending against a double-spend attack?

  • Can key images be compared to Unspent transaction outputs (utxo) in Bitcoin and some other cryptocurrencies? If not is there a roughly equivalent of it in Monero? Can there be several key images attached to a single real input address? Is a key image attached to an amount of Monero? Commented Apr 9, 2019 at 11:27
  • Monero has TXOs because they generally cannot be proven as spent or unspent. For every output (TXO) there exists a single key image that can only be created by the same private key that is eligible to sign the transaction (to prove ownership, basically). There is no limit to the amount of TXOs sent to an address, so there is also no limit to the amount of key images. A key image is "attached" to an output/TXO, not to an amount. The amount is "attached" to the output/TXO. Commented Apr 9, 2019 at 15:44
  • So a transaction from a single real address can contain several key images ? I’m asking this because some cryptocurrencies like Ethereum which track only balances instead of coins. Commented Apr 9, 2019 at 19:19
  • Yes, if I want to transfer 8 Monero, but I have two 5-Monero outputs, I would have to spend both outputs. A key image would be attached to each ring signature. The recipient would receive their 8 Monero, and I'd receive back as change a little fewer than 2 Monero (because of the transaction fee). Commented Apr 10, 2019 at 3:52

I created a small repository with basic monero functions:

def calc_key_image(a: bytes, b: bytes, R: bytes, i:int) -> bytes:
    """Calculate key image for input 
        a: bytes; Private view key
        b: bytes; Private spend key 
        R: bytes; Transaction public key (rG) of refferenced output transaction. Stored in field extra[1:33]).hex(). 
        i: int; output index of refferenced output
        Key image : string
    # x = H_s(aR) + b
    aR = ed25519.encodepoint(ed25519.scalarmult(ed25519.decodepoint(R), ed25519.decodeint(a)))
    aR =  ed25519.encodepoint(ed25519.scalarmult(ed25519.decodepoint(aR),  8 )) # There is a mathematical reason for this...
    aR += bytes([i])

    Hs = sc_reduce32(keccak_256(aR).digest())

    x = int.from_bytes(Hs, byteorder='little') + int.from_bytes(b, byteorder='little')
    x = x % ed25519.l
    x = x.to_bytes(32, 'little')    

    Hp = hashToPointCN(ed25519.publickey(x))
    return ed25519.encodepoint(ed25519.scalarmult(Hp, ed25519.decodeint(x)))

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.