Is it correct to say that Monero private keys are generated using Ed25519 curve and then Borromean Ring Signature scheme is used to sign transactions?
In other words, is Ed25519 curve "compatible" with Borromean Ring Signature scheme?
1 Answer
Monero currently uses MLSAG ring signatures for the ring of possible outputs being spent.
Borromean ring signatures are currently used only for the 'range proofs' which demonstrate that output amount Pedersen commitments are not negative.
Later this year, the Borromean signatures for range proofs will be swapped out in favor of Bulletproofs, which are more compact. See https://github.com/AdamISZ/from0k2bp/blob/master/testzkp.pdf
It is correct that Monero keys are generated on the Ed25519 curve. Borromean ring signatures can be used with any cryptographically sound elliptic curve. Monero could have used a different elliptic curve too, but Twisted Edwards curves (e.g. Ed25519) are particularly efficient for performing certain types of point multiplication that are heavily used for Monero's existing signature verification algorithms (specifically a type of multiplication called doublescalarbasemult).
