When a transaction is made with monero there is a 'key image' in the transaction info. what is this exactly? is it like the diffie-hellman exchange to create the one time addresses?


Monero are always sent to the one-time destination (public key) P. In the CN whitepaper, the corresponding private key is referred to as x.

When you're spending, you're combining your P with a couple of other ones in a ring signature and signing with the x. Only one of the Ps will be spent, but the ring signatures hide which one. In other words, the signature is verified by all of the Ps, and it looks like any of their corresponding private keys could have signed the transaction, thus obfuscating the sender. But how do we know you're not double-spending? We need a way to prove that the private key used to sign was not used before, without revealing which one it is. That is where the key image comes in:

I = xHp(P)

Let's also take a look at how the one-time key-pair is derived:


Since I is a one-way function of x this means that:

  1. Nobody can recover the public key from the key image and identify the signer;
  2. The signer cannot make two signatures with different I’s and the same x which in effect means you can spend your P only once.
  • Does the recipient's one-time public key play any part in the generation of the key image? – Jonathan Cross Aug 21 '17 at 12:18
  • 1
    Nope. His public key will later be used to generate another key image when he will be spending it. Thing is, the generation requires private one-time key so you can't know what it will be. – JollyMort Aug 21 '17 at 12:50

The key image is an alternate public key computed on a second base point, specifically Hp(P), instead of G. It is required in traceable ring signature construction to ensure multiple signatures with the same real key are linked (and thus rejected by the Monero protocol).


The layman's way to look at what a key image is would be that it allows the Monero network to quickly confirm whether an output as been spent or not. In other words, the key image is a necessary component of Monero's opaque blockchain ecosystem, because it allows for the prevention of double-spends.

For more information on this concept, please refer to this question and answer:

What is Monero's mechanism for defending against a double-spend attack?

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.