In passive mixing, the monero wallet finds
n other parties and forms a ring signature that proves the signer is one of the parties in the ring, and hence entitled to spend from one of the accounts associated with one of the ring parties.
I don't really understand how, say I am
B, if I've mixed my coins into a ring with party
A, without them knowing, what's stopping me spending money in
A's account, as authorised by the ring signature?
If I only sign to the effect of 'I am one of
B and so move money from either
address_B, then I could correctly prove that 'I am one of
B' (because I hold
b), and move funds from
What exactly is happening here -- does the transaction come with an EdDSA signature saying that the signer is authorised to spend money from a given address? And if so, how is this blinded so that it won't deanonymise the signer?
For example, if I produce the EdDSA signature then it will be trivial for an eavesdropper to take
B and see which one the signature verifies against, hence removing the anonymity gained by the ring signature in the first place?