Monero Stack Exchange is a question and answer site for developers and users of the secure, private and untraceable cryptocurrency Monero. It only takes a minute to sign up.
Sign up to join this community
So I read about proving your balance to an auditor, and someone suggested that you can share your view key, exposing all outputs that you received on that address.
If you then give out all key images (created from your private spend key & the output), both spent and unspent you can prove how much monero is on a specific address.
If this reasoning is correct, can the auditor use the key images from the unspent outputs to spend the coins?
No, they cannot.
An "output" is actually a one-time key-pair. It consists of a one-time public key, which resides on the blockchain, can be seen by everyone (but it can be matched to a wallet only by having the private view key and the public spend key), and acts as a container which holds some funds. It has a corresponding private key, which can be recovered only by the owning wallet.
This one-time private key is used to sign a transaction which spends that particular output.
Knowing a key image won't tell you this one-time private key, but it will only allow you to check that the same one-time private key has not been used more than once. You can't determine a private key from a key image, but knowing a key image you could tell if a 2nd signature was produced using the same one-time private key - without revealing the key itself. The mechanism is described on page 8 in the CryptoNote whitepaper.
To summarize:
P = P')b) and shared secret (aR) known from step 1. (page 8 of WP, x = H_s(aR) + bI = xHp(P)). (page 9 of WP)Trick is, to produce a proper signature, you need all 3 ingredients. Knowing the key image would let you know only if the same one-time private key tried to produce a 2nd signature. Somehow knowing the foreign one-time public keys would let you know which is the "real" public key getting spent (the remaining one). Knowing the one-time private key lets you produce a signature (you can construct a key image from it, and you can choose any number of public keys to ring yours with). Knowing only the public part of the one-time key and the key image lets you monitor for spent status of that output.
To answer the question, when you disclose a key image you kind of pre-announce the signature but never actually make it. The one who has only the key image and the matching one-time public key can now monitor for when you do make a signature which spends the output.
The key image is not the same as the actual key, so they should not be able to sign a transaction without the actual key. The key image prevents double spends, but it is not sufficient in of itself to spend coins.
Another explanation: there is a one-to-one mapping between an output public key P and its key image I as I=x*H_p(P) where x is the private key of P and H_p() is a hash-to-pubkey function. What's important here is that this mapping is secret and can be established only by the wallet owner knowing x. Also note that it's easy for anyone to tell that a given pair of (P,I) is genuine (i.e. I is not some fake arbitrary pubkey) by using yet another signature scheme (to be precise, the same ring signature scheme with 0 mixin). This is why the exported key images need to be "signed".
Disclosing this pair (P,I) only reveals this secret mapping to the auditor, allowing him to detect when the fund associated with P gets spent. Construction of the ring signature requires the secret key x, so only the wallet owner can spend the fund.
Side note: Shen Noether once pointed out a broken implementation of this key image generation algorithm in ShadowCash, making the secret mapping not secret anymore and allowing anyone to de-anonymize all the ring signatures.
