I'm developing a variant of Monero.

Is it possible to change the ECC multiplication rA with r^A of the stealth address term Hs(rA)G+B. And of course also the multiplication by G.

IMHO it should be interchangble but I want to be sure. What other modification do I need to make? Is it breaking any security assumptions?

1 Answer 1


The reason we use ECC multiplication (which I'm sure you know is not just regular integer multiplication) is that it is a homomorphic trapdoor function.

You could potentially use unpadded RSA to achieve the same objective https://en.wikipedia.org/wiki/Homomorphic_encryption

However, the reason that all cryptocurrencies use ECC and not RSA is that RSA public keys in particular are enormous compared to the size of ECC public keys. RSA would make for an unnecessarily bloated blockchain.

There is another way of interpreting your question though. Sometimes people use the term exponentiation to describe the exact same operation that Monero usually describes as scalar multiplication. In which case, you could use the alternate notation. Just note that the equivalent of rA is written as A^r and not r^A.

  • Thanks for the answer! and Yes, I know that it's less efficient, but it's just POC so it's acceptable. Thus, as I understand, I just change every ECC encryption with RSA encryption and it should work. It also for the ring signature, right? Commented Aug 1, 2018 at 19:58
  • Yes, the ring signature and the range proofs too. I would do some simple tests first to make sure you can get a basic Diffie Hellman exchange working (check B^a==G^b^a==A^b).
    – knaccc
    Commented Aug 1, 2018 at 20:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.