According to the CN whitepaper key image I is generated thusly:

I = xHp(P)

I understand P is the one-time public key for the transaction, x the corresponding private key and H a deterministic hash function, but what is p?


2 Answers 2


There are two hash functions you'll see referenced often with Monero - there is Hs and Hp.

Hs means "hash to scalar", meaning take a keccak(256) hash and then ensure the result is a "scalar" (a positive integer less than 2252 + 27742317777372353535851937790883648493).

Hp means "hash to point", meaning take a keccak(256) hash, interpret the resulting bytes as an elliptic curve point, and then multiply that curve point by 8 to force the resulting point to be in the base point group - i.e. to force it to be the case that there must exist an value x (even though x will be unknown) such that Hp(..data..) == xG.


Hp is the hash function but SE doesn't support subscripts well. Sometimes it can be written as H_p to avoid confusion.

  • 2
    FYI, you can use H<sub>p</sub> (although not in a code section).
    – assylias
    Apr 11, 2017 at 14:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.