Is it correct to say that Monero private keys are generated using Ed25519 curve and then Borromean Ring Signature scheme is used to sign transactions?

In other words, is Ed25519 curve "compatible" with Borromean Ring Signature scheme?

1 Answer 1


Monero currently uses MLSAG ring signatures for the ring of possible outputs being spent.

Borromean ring signatures are currently used only for the 'range proofs' which demonstrate that output amount Pedersen commitments are not negative.

Later this year, the Borromean signatures for range proofs will be swapped out in favor of Bulletproofs, which are more compact. See https://github.com/AdamISZ/from0k2bp/blob/master/testzkp.pdf

It is correct that Monero keys are generated on the Ed25519 curve. Borromean ring signatures can be used with any cryptographically sound elliptic curve. Monero could have used a different elliptic curve too, but Twisted Edwards curves (e.g. Ed25519) are particularly efficient for performing certain types of point multiplication that are heavily used for Monero's existing signature verification algorithms (specifically a type of multiplication called doublescalarbasemult).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.