How does the method of proofing a Monero payment following this pull request differ from the former process?

Is revealing key derivation easier or more difficult than revealing the tx secret key?

What are the privacy and security benefits of revealing key derivation instead of revealing the tx secret key?


Previously, a method to prove a payment would have been just to reveal the TX secret key r. This worked, because someone knowing the r and the destination address can only unmask destination one-time keys (aka output) in that particular TX and verify that funds sent to some one-time key were indeed sent to a correct address.

Problem is, if you reveal r, it's out in the "public". So while anyone can verify the destination, how can you confirm who the sender is? If now both you and me know your r, I could claim I'm the sender, and you'd have to go through extra hoops to prove me lying. So until now, proving that you're the sender relied on the assumption that you didn't already leak the r to someone else.

With the new method, you can also prove the destination and amount sent, but without ever revealing r. Instead, it uses r to sign a message which can be verified by anyone using the public TX key R. Also, it uses the shared secret rA to prove the amount. Shared secret is not public, but it's not really a problem to reveal it considering the recipient already knows it. Also, if recipient made his view key a public, then ALL of his shared secrets are also shared with the public anyway (because rA == aR). Revealing rA works like a selective view key - it reveals only what's in some particular TX. However, you get to keep the r private and thanks to that you'll still be the only one able to produce the signature.

There's another way to prove who the sender is, but whether it's useful is yet to be seen as it can't prove the destination without support from the recipient: https://github.com/monero-project/monero/issues/2065

  • how would that work on the wallet ? – Pedro Gaspar Jun 26 '17 at 10:15
  • 2
    There's an example in the PR-1992 by Stoffu, using commands get_tx_proof and check_tx_proof. The other one in the proposed fallback methid should be the same, you pick a TX to prove sending, produce a ring signature and the checker checks it. That's not coded and is just an idea at the present moment. – JollyMort Jun 26 '17 at 11:56

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.