Can someone explain to me how RingCT works and how the recipient gets the actual amount from the encrypted amount in a RingCT transaction?


1 Answer 1


All outputs on the Monero blockchain have encrypted amounts, with the exception of outputs created in a 'coinbase' transaction. A coinbase transaction is a transaction that creates new Monero out of thin air according to Monero's emission schedule. Here is an example coinbase transaction: https://xmrchain.net/tx/c0b6b35c1a9c580aaa5ba04db6477cb255b33abb6492f9b5d6e02d7768aefcee

The amount of each output is encrypted and written into the transaction in two different ways. Once, as part of the 'ecdhInfo' in a way that allows only the recipient to decode the actual value, and a second time as a 'Pedersen commitment'.

Only the recipient of an output is able to decode the actual amount. This amount is encrypted by the sender using the transaction shared secret, and is transmitted to the recipient in the 'ecdhInfo' section of the transaction. The transaction shared secret is computed by combining the recipient's private view key with the transaction public key (the latter is transmitted as part of the transaction).

Third party observers will not be able to decrypt that amount, and will need to use the Pedersen commitments to verify that other than the allowed creation of new Monero as part of the emission schedule, no Monero has been created out of thin air.

RingCT achieves this by doing two things:

  1. Proving that all of a transaction's outputs are greater than zero. This prevents the sender from starting with 1 XMR, and then creating two outputs where one has a value of -99 XMR and the other has a value of 100 XMR. This is achieved with a 'range proof'. A range proof proves that the encrypted amount must have been created out of the addition of a series of positive powers of 2, without disclosing what the actual powers of 2 are. For more information, see https://people.xiph.org/~greg/confidential_values.txt

  2. As you probably know, there are real inputs and fake inputs referenced in each transaction. No third party can tell which are real and which are fake. RingCT proves that in at least one combination of the possible inputs and the outputs, that Pedersen commitments of the inputs - Pedersen commitment of the transaction fee - Pedersen commitments of the outputs = a zero Perdersen commitment.

    This is possible because input and output amounts are encrypted using 'homomorphic' Pedersen commitments, meaning that although you can't tell the values, you can verify that they sum to zero. Proving that they sum to zero is achieved by proving that you know the private key of the 'zero' Pedersen commitment for at least one of the combinations of possible inputs and outputs.

    Therefore, for a transaction of ring size 5, as an outside observer you'll come up with 5 different possible 'zero Pedersen commitments', where only one of those possibilities really will be a commitment to zero. Since the Pedersen commitments are all technically public keys, and since the sender of the transaction needs to prove that they know the private key for at least one of those combinations (thus proving one of the combinations really does sum to zero), this is an ideal task for a ring signature. This is because ring signatures are a device to prove that out of a set of public keys, you know the private key for at least one of them.

    The full math is here: https://lab.getmonero.org/pubs/MRL-0005.pdf

To sum up, RingCT is a mechanism that allows an outside observer to check that in at least one combination of inputs and outputs, no Monero has been created out of thin air. This mechanism is impossible to cheat.

  • Thank for your replying. Can you please explain me the step by step process of Monero. I meant let says Alice want to pay 12XMR to Bob and she input transaction is 14XMR. Please explain me step by step how does this works. (according to the Alice and Bob, how Alice send it and how Bob receives it) Commented Mar 4, 2018 at 6:47
  • Your question would require dozens of pages to answer. The summary is that Alice starts with a 14XMR output that she owns. She then creates a transaction to pay Bob, which spends the existing 14XMR output and creates two new outputs. One is a change output of 2XMR that goes back to herself, and the other is a 12XMR output that is destined for Bob. Alice signs the transaction with RingCT to prove she has the right to spend an output. Bob scans the blockchain and sees that there is an output destined for him. For more, see the Cryptonote White Paper cryptonote.org/whitepaper.pdf
    – knaccc
    Commented Mar 4, 2018 at 7:50
  • Thanks knaccc. Addition for this can you suggest me some research areas that possible to do with Monero? Commented Mar 4, 2018 at 8:19
  • I'm not sure I understand what you mean by "research areas". If you're interested in researching more about Monero, the Cryptonote White Paper and the MRL documents at lab.getmonero.org are the place to go. If you're talking about researching future directions for Monero, then an upcoming replacement for the "range proofs" mentioned above are something called "bulletproofs", which you can read about here eprint.iacr.org/2017/1066.pdf
    – knaccc
    Commented Mar 4, 2018 at 9:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.