So I have 5 monero, but if nobody else can see my balance, how can I prove that these coins are in my posession, and that they have not been spent yet.

I just fail to see how Monero can ensure that without the ability to view either a list of transactions or balances.

If I understand correctly, I can see my received transactions with my viewkey, and my sent transactions with my spendkey, but how can I prove that the coins have not been spent before if I don't disclose my spendkey?

I understand most of Bitcoin transactions and I have a more than basic understanding of encryption and how public and private keys work.

Also, please link easy-to-understand posts about the security of monero.

up vote 10 down vote accepted

When you have 5 monero it actually means that you have some unspent outputs with the total value being 5 monero. Those outputs are actually one-time use containers and you always empty them completely to make new ones.

So, if you had 5 monero in a single container, when sending 3 monero to someone, you'd empty your original container and create new ones of 3+2; one for the recipient and one for you. The recipient's wallet is then able to recognize (using private view key) and access the corresponding one-time private key (using private spend key) to the corresponding container(s).

Spending actually means using the one-time private key to sign to empty some container, which gives you the right to create new containers of the same value. The network doesn't check that it's full because it doesn't know which container you're emptying (it's hidden among other containers in the ring signature - the network can't know from which one you "took"). Instead, the network does check that you don't take from the same one 2 times, which effectively prevents double-spends but still keeps the "real" container hidden among other ones used in the ring signature. The mechanism for this is called a key image, and it's described here: What is a key image?

  • Awesome explanation! So Monero also works with change addresses then, just like Bitcoin, as each output can only be used once, not able to be split? I'll look further into the crazy encryption that is ring signatures, but at least I understand this part now. – vrwim Apr 2 '17 at 17:34
  • 2
    Only it's not an address! Monero don't reside on addresses but on this one-time keys serving as cointainers. Simply sending funds to yourself further buries the trail and improves privacy. The change output can not be linked to your wallet - it's just some random-looking string on the blockchain which your wallet is able to find it and recover the matching private key to spend it. Using the same abstraction as above - ring signature means pretending to have taken from any 5 different containers while you actually took only from 1 of them. The other 4 belong to some other, random, wallet. – JollyMort Apr 2 '17 at 17:42
  • Good explanation! The missing piece for me was that a private key can only be used once. – Jonathan Cross Apr 3 '17 at 17:40

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.