What is the "SpendProofV1..." or "OutProofV1..." in the details of a sent transaction in the GUI?

Question

I'm guessing it's either the Confidential Transaction range-proof? Or is it some kind of proof-of-payment I can send to the recipient to prove... payment...?

Either way, what privacy or security is lost if that detail is shared or exposed?

Answer 1

tl;dr:

OutProofV1 strings prove you had access to the wallet that constructed a particular transaction. SpendProofV1 strings are used when some wallet information has been lost (because txkeys are lost forever if you don't store them), and instead prove you had full knowledge of the private keys of the inputs being spent in a transaction.

Strings beginning with "OutProofV1" directly disclose the per-recipient "key derivation", which in turn allows someone to determine the per-output shared secret for the output you claim to have sent. Indirectly, this information allows the id of the related transaction to be identified, and then the amount of the output sent to the recipient to be decrypted and any encrypted payment id to be decrypted. If you know a list of potential wallet addresses that the transaction could have been destined for, you can test whether any of those wallet addresses were the destination of the transaction.

Strings beginning with "SpendProofV1" indirectly disclose the id of the related transaction.

Knowing the id of a transaction allows all public information about that transaction to be discovered (such as any old-style unencrypted payment id used, the time and date of the transaction, the ring size used and the fee amount paid to mine the transaction).

Monero's untraceability (i.e. knowledge of the inputs actually being spent in the transaction) is unaffected either way. Your wallet address is not leaked in either scenario either.

The full answer:

If you see a string beginning with "OutProofV1", then the characters that follow contain the per-recipient "key derivation" (32 byte elliptic curve point) and a Schnorr signature (two 32 byte scalars). These are base58 encoded.

The the "key derivation" can be used to calculate the per-output shared secret which can be used to decrypt the amount sent and decrypt any encrypted payment id that is present.

The Schnorr signature proves that you have knowledge of the transaction private key that correlates with both the key derivation and the transaction public key.

Although the OutProofV1 string directly only discloses the per-recipient key derivation, it indirectly discloses more than this. The per-output shared secret can be calculated and used to attempt to decrypt the amount of every single output on the blockchain (via the ecdhInfos section of each transaction). When a decrypted amount appears that is within the allowed range of Monero output amounts (i.e. less than 2^64 piconero), this is very strong evidence that the shared secret applies to that particular output.

Therefore knowledge of the OutProofV1 string discloses the related transaction, the amount of the output transmitted in that transaction (only the amount of the output destined for the other person, and not the amount of your change output), and can decrypt the encrypted payment id associated with that transaction.

If a database of possible wallet addresses is available (e.g. by scraping Monero addresses from internet web sites), then it would be possible to use the key derivation to check whether the output was destined for any of those wallet addresses. Note that this only works if there is a possible wallet address list to check against. If the wallet address of the recipient is unknown, then it is impossible to determine it. It would not be possible to test if the change addresses in the transaction are destined for any particular wallet address, because the key derivation that applies to your change outputs is different than the key derivation disclosed by the OutProofV1 string.

If you see a string beginning with "SpendProofV1", this means that the transaction private key (txkey) was not available. This could be because you had made the transaction from a different wallet. If you don't preserve knowledge of a txkey after making a transaction, it is lost forever and cannot be recovered by scanning the blockchain. It also means you will be unable to recover the per-output shared secret for the output sent to the other person in the transaction.

Since you can't prove knowledge of the txkey or the per-output shared secret, you can instead prove that you owned the outputs that were spent in the transaction. The transaction you originally sent would have already included a ring signature proving that you owned one output per ring in the transaction.

The SpendProofV1 string contains a second, newly created ring signature that proves exactly the same input ownership again, but using different random initialization data. Only someone that owned the inputs of the transaction would be able to create this second valid ring signature. That is all the SpendProofV1 string contains. There is no key derivation communicated, because it is unknown by the wallet in this scenario.

Since the ring signature(s) in the SpendProofV1 string will be valid for one of the transactions on the blockchain, it would be possible to identify the transaction from this SpendProofV1 string.

In both scenarios, knowing the id of a transaction allows all public information about that transaction to be discovered (such as any old-style unencrypted payment id used, the time and date of the transaction, the ring size used and the fee amount paid to mine the transaction).

In both scenarios, Monero's untraceability (i.e. knowledge of the inputs actually being spent in the transaction) is unaffected. Your wallet address is not leaked in either scenario either.