# Using exponentiations instead of ECC multiplication in computing Stealth address

I'm developing a variant of Monero.

Is it possible to change the ECC multiplication `rA` with `r^A` of the stealth address term `Hs(rA)G+B`. And of course also the multiplication by `G`.

IMHO it should be interchangble but I want to be sure. What other modification do I need to make? Is it breaking any security assumptions?

## 1 Answer

The reason we use ECC multiplication (which I'm sure you know is not just regular integer multiplication) is that it is a homomorphic trapdoor function.

You could potentially use unpadded RSA to achieve the same objective https://en.wikipedia.org/wiki/Homomorphic_encryption

However, the reason that all cryptocurrencies use ECC and not RSA is that RSA public keys in particular are enormous compared to the size of ECC public keys. RSA would make for an unnecessarily bloated blockchain.

There is another way of interpreting your question though. Sometimes people use the term exponentiation to describe the exact same operation that Monero usually describes as scalar multiplication. In which case, you could use the alternate notation. Just note that the equivalent of `rA` is written as `A^r` and not `r^A`.

• Thanks for the answer! and Yes, I know that it's less efficient, but it's just POC so it's acceptable. Thus, as I understand, I just change every ECC encryption with RSA encryption and it should work. It also for the ring signature, right? Aug 1, 2018 at 19:58
• Yes, the ring signature and the range proofs too. I would do some simple tests first to make sure you can get a basic Diffie Hellman exchange working (check B^a==G^b^a==A^b). Aug 1, 2018 at 20:26