# Detecting the real output in ring signature

I have a strange question about the relation of P_i (stealth addresses in ring signature) with x (the one-time private key).

Suppose Alice wants to spend P_1 with her spend private key (x) and we know that P_1 = x*G (G is the base point of elliptic curve).

She chooses randomly P_2 and P_3 to create a ring signature. She computes I (Key image) as I=x*H (P_1) that H(.) is the hash function. She places I in the input. Adversary calculates the H(P_1), H(P_2) and H(P_3) then she inverse them and multiples them by I:

I * (H(P_1)^-1) = x_1

I * (H(P_2)^-1) = x_junk1

I * (H(P_3)^-1) = x_junk2

Now the adversary achieves the private key x_1 but he doesn't know which one is true so he computes stealth addresses like this:

x_1 * G = P_1

x_junk2 * G = P_junk1

x_junk1 * G = P_junk2

So he can determine the p_1 was the real output that was spent.

I know this is a impossible way but I don't know why. What makes it impossible? Thank you :)

You can't look at a public key `A = aG` and determine the private key `a` by calculating `a = A*G^-1` (otherwise written as `a = A/G`). Similarly, you can't divide the curve point `I` by the curve point `H(P_i)`.