For background there is https://nickler.ninja/blog/2016/12/17/a-problem-with-ringct/ and this problem had been fixed before this post was made by changing ASNL to borromean signature. For background on what borromean signature is here is this question for background on what borromean signatures are What are Borromean signatures? Now obviously it has already been fixed but what was the exact problem with ASNL that could have been exploited in more simple terms?
Add a comment
|
1 Answer
The problem was exactly that - possible forgery. In the RCT paper, there was a proof that you can't forge ASNL range proof which later turned out to have an error. See here for more details.
Why do we need these proofs / signatures? From the RCT paper (emphasis mine):
... as -1 is a very large number modulo the curve group order, free money has been created. It is therefore necessary to prove that the C_out,i are commitments to values which are positive and lie in a restricted range [0,2^n] for some n.
These signatures are used to prove that one is not using just anything to hide the amounts, ie to prove what I've highlighted above. It's important because allowing just anything would make it possible to cheat the sum(ins) == sum(outs) part of transaction verification. It's important that the proof be airtight, otherwise you could make a transaction where sum(ins) != sum(outs) but which would be validated as if both sides were equal.
The ASNL proof was not good, so it was replaced with Borromean. With ASNL it would have been possible to create an exploit (as the author of your linked post did) which could create or destroy monero, and bypassing the intended coin supply. A scary thought indeed.
