So I read about proving your balance to an auditor, and someone suggested that you can share your view key, exposing all outputs that you received on that address.

If you then give out all key images (created from your private spend key & the output), both spent and unspent you can prove how much monero is on a specific address.

If this reasoning is correct, can the auditor use the key images from the unspent outputs to spend the coins?


No, he can not.

An "output" is actually a one-time key-pair. It consists of an one-time public key, which resides on the blockchain, can be seen by everyone (but it can be matched to a wallet only by having the private view key and the public spend key), and acts as a container which holds some funds. It has a corresponding private key, which can be recovered only by the owning wallet.

This one-time private key is used to sign a transaction which spends that particular output.

Knowing a key image won't tell you this one-time private key, but it will only allow you to check that the same one-time private key has not been used more than once. You can't determine a private key from a key image, but knowing a key image you could tell if a 2nd signature was produced using the same one-time private key - without revealing the key itself. The mechanism is described on page 8 in the CryptoNote whitepaper.

To summarize:

  1. Wallet recognizes an output, using private view key and public spend key (page 7 of WP, check if P = P')
  2. Wallet recovers the one-time private key, using private spend key (b) and shared secret (aR) known from step 1. (page 8 of WP, x = H_s(aR) + b
  3. Wallet computes the key image, using the one-time key-pair (I = xHp(P)). (page 9 of WP)
  4. Wallet constructs a ring signature using one-time key-pair, foreign one-time public keys and the key image.

Trick is, to produce a proper signature, you need all 3 ingredients. Knowing the key image would let you know only if the same one-time private key tried to produce a 2nd signature. Somehow knowing the foreign one-time public keys would let you know which is the "real" public key getting spent (the remaining one). Knowing the one-time private key lets you produce a signature (you can construct a key image from it, and you can choose any number of public keys to ring yours with). Knowing only the public part of the one-time key and the key image lets you monitor for spent status of that output.

To answer the question, when you disclose a key image you kind of pre-announce a signature but never actually make it. The one who has only the key image and the matching one-time public key can now monitor for when you do make a signature which spends the output.


The key image is not the same as the actual key, so they should not be able to sign a transaction without the actual key. The key image prevents double spends, but it is not sufficient in of itself to spend coins.


Another explanation: there is a one-to-one mapping between an output public key P and its key image I as I=x*H_p(P) where x is the private key of P and H_p() is a hash-to-pubkey function. What's important here is that this mapping is secret and can be established only by the wallet owner knowing x. Also note that it's easy for anyone to tell that a given pair of (P,I) is genuine (i.e. I is not some fake arbitrary pubkey) by using yet another signature scheme (to be precise, the same ring signature scheme with 0 mixin). This is why the exported key images need to be "signed".

Disclosing this pair (P,I) only reveals this secret mapping to the auditor, allowing him to detect when the fund associated with P gets spent. Construction of the ring signature requires the secret key x, so only the wallet owner can spend the fund.

Side note: Shen Noether once pointed out a broken implementation of this key image generation algorithm in ShadowCash, making the secret mapping not secret anymore and allowing anyone to de-anonymize all the ring signatures.

Your Answer

By clicking "Post Your Answer", you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.