6

In passive mixing, the monero wallet finds n other parties and forms a ring signature that proves the signer is one of the parties in the ring, and hence entitled to spend from one of the accounts associated with one of the ring parties.

I don't really understand how, say I am B, if I've mixed my coins into a ring with party A, without them knowing, what's stopping me spending money in A's account, as authorised by the ring signature?

If I only sign to the effect of 'I am one of A or B and so move money from either address_A or address_B, then I could correctly prove that 'I am one of Aor B' (because I hold B and b), and move funds from address_A?

What exactly is happening here -- does the transaction come with an EdDSA signature saying that the signer is authorised to spend money from a given address? And if so, how is this blinded so that it won't deanonymise the signer?

For example, if I produce the EdDSA signature then it will be trivial for an eavesdropper to take A and B and see which one the signature verifies against, hence removing the anonymity gained by the ring signature in the first place?

  • Just for context/clarification, the mentions of EdDSA on this question/others around this site are maybe misleading -- Monero uses ring signatures over Curve25519, which EdDSA is also defined over, but Monero transactions don't actually have a EdDSA signature in them (to my knowledge) as this would deanonymise the transactions – bekah Jan 11 '17 at 11:13
7

Section 4.4 of CN white-paper describes this. With the ring signature, all the keys used are equivalent, so you can't say which one is the actual signer. The signature can be checked against any of the public keys used in the ring. Let's define our one-time keys as

P = xG

Where P is the public key, x the private key, and G the EC basepoint.

If we let the same key produce two signatures, we would allow for a double-spend. That's where key images come in. The key used must also produce a key image with the signature. Trick is, the key image is a function of only the one-time key so it will be the same regardless of other parameters of the transaction.

I = xHp(P)G

Note that knowing I, you can't recover the P used. The key image also forms part of the signing and all the key images ever used are stored on the blockchain. If anyone would attempt to re-use x, then the resulting key image would be the same, and the signature would be rejected by the network as it would already be found on the 'used' list.

Note that there are no 'accounts' or 'addresses' on the blockchain. There are only one-time keys and key images. An address is kind of a 'blueprint' which lets the sender produce one-time key such that only the owner of the address is able to recognize it as belonging to it and recover the private one-time key.

  • Oh this is so much better than what I thought was happening, the no address/account model is such a clever addition to you standard bitcoin-like blockchain! Thank you, and merry christmas/happy holidays! – bekah Dec 25 '16 at 23:12
  • So if I'm signing and the ring signature is for e.g. public keys A, B, and C, and I hold a (the private key corresponding to A), how is his authorising the transfer of money from the public key A? For example, if B and C also have unspent funds, what is stopping me from transferring from their public keys, with my correctly formed ring signature? – bekah Dec 29 '16 at 15:30
  • The fact that, as the owner of only a, you can't produce a key image belonging to either B or C, but only the one for A. You need the a to produce I=aHp(A)G. This particular A,B,C ring could appear maximum 3 times on the blockchain. One time, owner of a would produce it, one time owner of b and one time owner of c. Each appearance would come with a different key image. In that case, to appear the fourth time is not possible, as all 3 possible key images had been used up. You wouldn't be able to tell which key was used for which TX, though. – JollyMort Dec 29 '16 at 16:42
  • so A cannot be the public key where the money is held? – bekah Dec 31 '16 at 13:19
  • It can, but once and only once. Next time it will have to be either B or C, where A would just be used as a decoy. Thing is, external observer can't tell which was the one getting spent. With this edge case where exactly the same 3 keys formed 3 ring signatures, you can be sure that all were spent, but you can't know which was spent in which ring. I'm not sure if the wallet allows/checks for these occurrences. Using any of the ABC in further rings would be useless as someone could find out that all of the 3 were spent in the past. – JollyMort Dec 31 '16 at 17:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.