I have a strange question about the relation of P_i (stealth addresses in ring signature) with x (the one-time private key).
Suppose Alice wants to spend P_1 with her spend private key (x) and we know that P_1 = x*G (G is the base point of elliptic curve).
She chooses randomly P_2 and P_3 to create a ring signature. She computes I (Key image) as I=x*H (P_1) that H(.) is the hash function. She places I in the input. Adversary calculates the H(P_1), H(P_2) and H(P_3) then she inverse them and multiples them by I:
I * (H(P_1)^-1) = x_1
I * (H(P_2)^-1) = x_junk1
I * (H(P_3)^-1) = x_junk2
Now the adversary achieves the private key x_1 but he doesn't know which one is true so he computes stealth addresses like this:
x_1 * G = P_1
x_junk2 * G = P_junk1
x_junk1 * G = P_junk2
So he can determine the p_1 was the real output that was spent.
I know this is a impossible way but I don't know why. What makes it impossible? Thank you :)