Detecting the real output in ring signature

Question

I have a strange question about the relation of P_i (stealth addresses in ring signature) with x (the one-time private key).

Suppose Alice wants to spend P_1 with her spend private key (x) and we know that P_1 = x*G (G is the base point of elliptic curve).

She chooses randomly P_2 and P_3 to create a ring signature. She computes I (Key image) as I=x*H (P_1) that H(.) is the hash function. She places I in the input. Adversary calculates the H(P_1), H(P_2) and H(P_3) then she inverse them and multiples them by I:

I * (H(P_1)^-1) = x_1

I * (H(P_2)^-1) = x_junk1

I * (H(P_3)^-1) = x_junk2

Now the adversary achieves the private key x_1 but he doesn't know which one is true so he computes stealth addresses like this:

x_1 * G = P_1

x_junk2 * G = P_junk1

x_junk1 * G = P_junk2

So he can determine the p_1 was the real output that was spent.

I know this is a impossible way but I don't know why. What makes it impossible? Thank you :)

Answer 1

The reason we use elliptic curve multiplication is that it is a trapdoor function. This means you can multiply by a point, but you can't divide by a point. Trapdoor functions are an essential component in any asymmetric encryption scheme (i.e. anything involving public and private keys). If we didn't need a trapdoor function, there would be no point in using elliptic curves at all.

You can't look at a public key A = aG and determine the private key a by calculating a = A*G^-1 (otherwise written as a = A/G). Similarly, you can't divide the curve point I by the curve point H(P_i).

You can't ever divide one elliptic curve point by another. This is called the Elliptic Curve Discrete Logarithm Problem, and it is one of the fundamental building blocks of Monero's encryption scheme.