2

And if the answer is yes, doesn't it compromise the anonymity property? Assuming my wallet client does not check the transfer amount. (I prefer mathematical explanations).

  • 1
    There are outputs with zero. For example, if you sweep_all, it goes into a single output. A second output is created also, so you don't know which one is which (not that you can tell anyway, as an outsider). Anyway, can you be more specific about how you think privacy (anonymity) is compromised? – scoobybejesus Mar 22 '18 at 17:23
3

Yes it is possible. You still need to consume an existing output in order to send a zero output to someone else. This existing output will need to have non-zero value, because you'll need some of it to pay the transaction fee. You'll create a zero output for the recipient, and a change output which will go back to yourself.

All output amounts are encrypted using the "transaction shared secret", which is something only the sender and recipient will have knowledge of. It's also encrypted in a second way as a "Pedersen commitment". The first method of encryption is to pass the real value to the recipient. The Pedersen commitment is part of the proof that no Monero is being created out of thin air.

The encryption applies even if the amount is zero. Your anonymity is therefore definitely not compromised or weakened in the slightest.

If you're interested in the mathematical details, see https://people.xiph.org/~greg/confidential_values.txt

Specifically, your amount is encrypted as a Pedersen commitment using a "blinding factor", which prevents any particular amount (like zero) from standing out in any way. The application of Greg Maxwell's paper, which I linked above, is also known as "confidential transactions", which is the CT in Monero's "RingCT" scheme.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.