2

Monero uses elliptic curve for stealth address generation. And all the things i have read about stealth addresses mention elliptic curve. My question is are there other cryptosystems out there which could allow us to do the same ?

If so, do we also have PQC-Algorithms which would allow us to create stealth addresses ? Not that I'm concerned about Quantum Computers breaking privacy but I'm just curios.

I found a few related answers and comments regarding the importance of elliptic curve cryptography for stealth addresses, but none of them seem to answer this question directly.

On a reddit thread about stealth address there is this comment by "Natanael_L" which says:

ECDH with the private key of Bob gives the same result as ECDH with the private key of Alice and the public key of Bob. This is a neat feature of the Elliptic Curve cryptography algorithms (some other algorithms have this too, but there's more to come....

Also i found one related question what-is-elliptic-curve-cryptography-and-why-is-it-important-to-monero

But nowhere is mentioned if this is feature which only exists on Elliptic Curve Cryptography or if there are also other possiblities.

Improve this question

3 Answers 3

Reset to default
4

Monero's stealth addressing works like this:

  1. You start with a destination wallet address, which is a pair of public keys A, B which have corresponding private keys a, b known only to the recipient.

  2. A Diffie-Hellman exchange is performed, resulting in a shared secret which can be transformed to produce a private key s.

  3. A public key S corresponding to the private key s is determined.

  4. A homomorphic encryption scheme is used to combine S with B. Homomorphic means that the private key corresponding to the public key S+B can be determined only by someone (i.e. the recipient) that knows s and b. S+B is published as the one-time output public key, and only the recipient (and not the sender or anyone else) can determine the private key for this one-time output. This means the sender can't spend the newly created output themselves.

Steps 1-3 can be done using any asymmetric encryption scheme, such as RSA.

To achieve step 4, you need an asymmetric encryption scheme which is homomorphic. I'm not an expert, but it's possible that the RSA unpadded scheme may work for this: https://en.wikipedia.org/wiki/Homomorphic_encryption#Unpadded_RSA

I don't know if any PQC asymmetric encryption schemes exist which support homomorphic encryption.

Improve this answer
3
  • Great explanation, thank you for clarifying what the needed property is.
    – Mino_e
    Commented May 30, 2018 at 12:04
  • Which inputs go into the ECDH? Is it with ephemeral keys or static?
    – Woodstock
    Commented Sep 2, 2020 at 21:25
  • @Woodstock it's an ephemeral private key created by the sender, combined with the recipient's permanent wallet address public view key. The ephemeral public key corresponding to the ephemeral private key is published as part of the transaction by the sender.
    – knaccc
    Commented Sep 13, 2020 at 0:08
2

Stealth addresses can be supported by any public private key cryptography that supports a Diffie-Hellman (DH) Key Exchange. DH Key Exchanges are not unique to elliptic curve cryptography.

The first half of DF Key exchange occurs in the encoding of the recipient's address. The second half of the DH Key Exchange occurs as info is persistently stored on the blockchain (sent by the payer's wallet) that requires the recipient's wallet to scan the blockchain to complete the DH so the recipients funds may be redeemed at a future date.

Improve this answer
0

For more details about how stealth addresses are generated take a look at my explanation video or git repo

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.