Do signed exported key images prove that the key images provided are legitimate?

Question

When key images are exported using the export_key_images command, each key image is signed using the private key of the output corresponding to each respective key image.

This signature will prove that the signer knew the private key for the output.

However, does it prove that the key image being signed really is the correct key image for that output?

This has implications for an auditor that wants assurance that the key images provided are not made up in order to conceal the spending of a view-only wallet's outputs.

Answer 1

When exporting signed key images, the signature of each key image is in fact a ring signature with the output public key P and the key image I as parameters.

Therefore it proves that the signer knows the output secret key x such that P = x·G and I = x·Hp(P) (see ring signature algorithm), which means that I is the correct key image of P.

In the source code of Monero, the function doing this is wallet2::export_key_images() in src/wallet/wallet2.cpp.