I've read key images are the critical element in Monero to avoid double spends.

I think I understand how it works when you are using only one of your previously unspent transaction outputs to create a new transaction.

Let's say you have a previously unspent transaction output TXO_A.

In that case you create a ring signature joining your TXO_A with 4 other TXOs (TXO_B, TXO_C, TXO_D and TXO_E). The ring signature is formed in a way that everybody can validate that someone in the ring has signed it, but no one can tell who was the signer. Also, you have to attach a key image derived from TXO_A to the transaction so the protocol would never accept using the same TXO_A in a different transaction.

Here come my doubts: How is a transaction formed when you need to use 2 or more of your TXOs?

Imagine you have to pay 15 XMR and you don't have a single TXO with enough XMR. You'll have to use 2 different TXOs, for example: TXO_A1 with 10 XMR and TXO_A2 with 8 XMR.

In that case, the ring signature would be formed from TXO_A1, TXO_A2, TXO_B, TXO_C and TXO_D?

Evidently the protocol could not let you use again TXO_A1 nor TXO_A2, so there has to be a way to include key images from both TXO_A1 and TXO_A2.

But if you add explicitly 2 key images to the transaction, it leaks that you used 2 TXOs instead of just one, and everybody knows the number of decoy TXOs has been reduced by one.

The worst case would be if you'll need to use 5 TXOs owned by you, then there would be no decoys!!

As it can't be that way, I would like an explanation of how is this done in Monero.

up vote 1 down vote accepted

Monero's ring signatures typically use a ring size of 7, which means 1 real output and 6 decoy outputs.

However, there are several rings if you spend several outputs. Therefore if you spend 5 outputs, there will be 6*5=30 decoys.

  • I'm not sure I understand. So in the example used above: Imagine you have to pay 15 XMR and you don't have a single TXO with enough XMR. You'll have to use 2 different TXOs, for example: TXO_A1 with 10 XMR and TXO_A2 with 8 XMR. There would be two different ring signatures, each one of them with one of your unspent outputs? Would it be like Transaction1: TXO_A1, TXO_B, TXO_C, TXO_D, TXO_E, TXO_F, TXO_G Transaction2: TXO_A2, TXO_H, TXO_I, TXO_J, TXO_K, TXO_L, TXO_M with each transaction posting respectively the key image of TXO_A1 / TXO_A2? – michi Aug 13 at 10:35
  • 1
    I think I understand now how it works. I've found an example with 2 inputs on moneroblocks.info and it's very clear. The problem using several outputs would be the size (in bytes) which leads to higher fees, but it's something that already happens on bitcoin. Thanks for the answer. – michi Aug 13 at 11:15

Your Answer

 
discard

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.