3

I'm reading about Monero and the CryptoNote paper in general. I somewhat understand both the stealth addresses and the ring signatures.

Reading this stackexchange I've encountred several times that Monero outputs used to be split by denomination and that this is not the case any more due to the RingCT feature deployed in early 2017.

I'm still curious though, what was the rationale behind the denomination splits? I guess this was to somehow obfuscate the amounts being spent, could you provide more details?

1 Answer 1

4

The splitting by denominations was indeed intended to allow ring signatures to easily find other candidates to sign with.

Pre-ringCT, a ring is made up of a number of inputs, possibly one (just the one that's being spent), or more. In order to verify that no money is being created from thin air, all inputs in a ring must have the same amount, since you can't tell which one is actually spent. In fact, technically, it would be enough to say that the smaller amount in a ring is used to prevent money creation, but then there is very strong monetary incentive to not lose money by selecting fake outputs with a lower amount than the real output, so you'd end up with ineffective ring signatures if you did that.

Now, if each transaction was sending amounts as is, you'd typically have two outputs per transasction: one which is the actual payment, and a change output. The actual payment would typically be a nice round amount (ie, please pay only 1.95 for our widget!), while the change would be weird amounts, as it'd be the result of subtracting the fee from whatever input sum you had, and the fee has more decimal places, typically.

This means you'd end up with a wide range of output sizes on the blockchain, and, in turn, it'd be pretty hard to find other outputs of the exact amount you need to sign with.

Therefore, splitting by denominations ensures that even weird amounts such as 8.54753282 end up creating "simple" amount outputs.

With rct, since amounts are encrypted, we don't need inputs to be the same amount anymore, since we rely on commitments to ensure no monero is created out of thin air without knowing the actual values.

3
  • "In order to verify that no money is being created from thin air, all inputs in a ring must have the same amount" I don't understand that. Let's suppose you want to spend 10 XMR, why not mixing this input with completely different ones? Since there's only one valid private key which corresponds to the signature no coins are created becuase the other public keys are not valid
    – tsusanka
    Commented Oct 16, 2017 at 11:49
  • If you spend a 2 monero output with mixin 1, and choose a 5 monero output to mix with, the miners can't know whether you're spending 2 or 5.
    – user36303
    Commented Oct 16, 2017 at 15:02
  • Ahaa! And the miners need to know the amount to make sure no new coins are created. Thx
    – tsusanka
    Commented Oct 17, 2017 at 8:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.