CryptoNote 2.0 uses P=Hs(rA)G + B for the generation of a one-time key.

CNS006 seems te change this to P=Hs(rA||n)+B, where n is the transaction index (encoded as varint).

Why is there this additional concatenation; is this to conceal transactions to the same address?

up vote 3 down vote accepted

The CNS006 is correct. In the past outputs had to be split into denominations and without concatenations that'd generate multiple identical outputs (of different amounts) to the same wallet, effectively burning all but 1. With the concatenation, it's guaranteed that outputs will be unique, even if going to the same address.

  • 1
    So it is to "conceal" transactions to the same address before RingCT, I see. Thanks! – rubdos Dec 13 '17 at 12:53

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.