Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [cryptography]

Practice and study of techniques for secure communication in the presence of third parties called adversaries

3
votes
1answer
29 views

Is a mnemonic for view only wallet possible?

It occurred to me that one may wish to restore a wallet on a compromised computer. Perhaps they need to prove that a payment was received. Regardless of whether this is a good idea, is it possible ...
2
votes
1answer
27 views

Why is it necessary to have such long addresses?

In the cryptonote paper, it says the address needs to be so long because there has to be a spend key and a view key. where the receiving address is calculated like this; address = Hs(rA)G + B but ...
1
vote
1answer
27 views

Reasons for the way the mask/amount is calculated?

I am reading some monero docs and it says that the mask and amount are generated like this; mask = x + H(K); //where x is the blinding scalar amount = b + H(H(K)); //where b is the amount `K` is the ...
2
votes
1answer
174 views

Explanation of how exactly the pederson commitments in monero work?

so lets say for the first commitment (after a mined transaction) let a = miner_reward this is a known number. to generate the first commitment, one does; input = x.G + a.H; output = x.G + a.H ...
2
votes
1answer
119 views

Why is it necessary in confidential transactions to have two generators?

So as i understand it (though im not sure if its the same w/ bulletproofs so please correct me if im wrong), a commitment is generated like this; commitment = (blinding_secret . G) + (value . H) ...
4
votes
1answer
54 views

CryptoNight detail. Why this kind of multiplication?

The Cryptonight description by the CryptoNote team states that The 8byte_mul function, however, uses only the first 8 bytes of each argument, which are interpreted as unsigned 64-bit little-...
4
votes
1answer
81 views

Who Generates parameters G & H for Pedersen commitment in Monero?

Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H ...
1
vote
1answer
47 views

What makes decoding the total sent amount using the viewkey potentially inaccurate?

When using the 'decode outputs' on moneroexplorer for a TX that I sent, I get this warning when it (correctly) estimates the amount that I spent: Possible spending is: spent amount (tx fee included)...
4
votes
1answer
89 views

How is Keccak calculated in Monero?

I am reading the monero's implementation of Keccak (used as first part of slow_hash) in src/crypto/keccak.c I have found that it is a Keccak-256 (with b=1600, c=512, r=1088) and "output" of 1600 bits ...
2
votes
1answer
70 views

What are the hex representations of the small subgroup curve points on Ed25519?

Monero uses Ed25519, which has a cofactor of 8. This means the curve has a prime order l = 2^252 + 27742317777372353535851937790883648493 and the total number of possible points on the curve is 8l. ...
1
vote
1answer
57 views

Is the connection over Tor between client and remote node safe?

I'm using torsocks to connect my CLI wallet to a remote node (geo.node.moneroworld.com:18089). I don't need a high level of anonymity, but I would like to understand what information is at risk. For ...
0
votes
1answer
52 views

How do I multiply 2 public keys?

I want to make DH-like key exchange calculating something like this: b = H(b0B1B2) But the problem is multiplication between two ec-points is not defined on ec-curve. I know monero makes some ...
5
votes
1answer
99 views

Where can I learn about the cryptography used in Monero? [duplicate]

What papers should I read to understand the mathematics behind Monero?
0
votes
1answer
107 views

Calculating subaddresses

The PR for subaddresses and MRL-0006 say that the value m is calculated as: m = H_s(a, i) or H_s(a || i) I have found another question attempted to find the answer to my same question, however I am ...
5
votes
2answers
206 views

Understanding MLSAG in Monero transaction

This is a followup question to Understanding the structure of Monero transaction with emphasis on the MLSAG part. Here's the transaction's structure again given with print_tx ...
3
votes
1answer
126 views

How to convert monero's curve25519 basepoint to bouncycastle

This is how to get the curve25519 basepoint in monero (use js console at https://xmr.llcoins.net/) > var identity = "0100000000000000000000000000000000000000000000000000000000000000" > var base ...
6
votes
1answer
169 views

Transaction structure: Question about ecdhInfo

This question by kenshi84 shows how the pseudoOuts and outPk fields can be validated by anyone (without knowing any of the private keys involved), by checking that sumIn === sumOut: > var H = ...
4
votes
1answer
81 views

How is m calculated when generating subaddresses

In Kenshi's notes in the subaddresses PR it says that when generating subaddresses m = Hs(a || i) and i is just the index of the subaddress. so if a is the secret view key "...
4
votes
1answer
154 views

Using Monero as proof of funds

I'm writing an article about the future of Healthcare. I wondered if it was possible to use Monero to make a proof of funds. For example: the hospital wants to know that I can pay for the medical care ...
5
votes
1answer
51 views

(Non-ring) Wallet signatures

I am reading about ECDSA and EdDSA. I was wondering what the Monero void crypto_ops::generate_signature signature is based upon. From the code, I see that the math to generate one is k = rand() t3 = ...
3
votes
1answer
95 views

Discrepancy CNS006 and CryptoNote whitepaper one-time key generation

CryptoNote 2.0 uses P=Hs(rA)G + B for the generation of a one-time key. CNS006 seems te change this to P=Hs(rA||n)+B, where n is the transaction index (encoded as varint). Why is there this ...
8
votes
1answer
412 views

Stealth addresses: where do they come from?

I wonder what the origin of stealth addresses is. I learned that they were introduced for BitCoin, by Peter Todd. However, I cannot find any literature describing or analysing the specific ...
9
votes
1answer
440 views

Are Confidential Transactions in Monero perfectly binding or hiding?

Bitcoin contributor Pieter Wuille recently commented on Reddit: Bulletproofs and the Pedersen commitments they operate on are perfectly hiding, but not perfectly binding. This roughly means that ...
6
votes
1answer
382 views

Is CryptoNight the hash function which plays the role of the “random oracle”?

Is CryptoNight the hash function which plays the role of the "random oracle" in the random oracle model under which certain properties of CryptoNote are mathematically proven in the original paper? Or ...
3
votes
1answer
229 views

Scratchpad Initialisation : What is the input to Keccak?

So this is probably a question I should be able to find the answer to easily but I am stumped. In the documentation for cryptonight the part on scratchpad initialization says: First, the input is ...
8
votes
1answer
387 views

How do key images really work?

I have the following questions regarding the equation I=xHp(P): What is the hash function Hp? How can we know that Hp(P) is a point on the Ed25519 curve? Or is it not? Is the value I published with ...
7
votes
2answers
406 views

How do I manually decode outputs?

I'm currently coding a small Monero tool just to better understand how it all works. I already implemented address-generation from scratch (thanks to luigis address test page) and the next step is to ...
7
votes
1answer
2k views

What cryptography primitives/concepts, other than the basic ones, does Monero use?

The following are the "basic" cryptography primitives/concepts, taught in all beginner textbooks on cryptography: symmetric encryption (stream and block ciphers. AES, etc.) asymmetric public-key ...
10
votes
3answers
3k views

How does the recent patched key image exploit work in practice?

For more info https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html This has been patched months ago and was never exploited which can be proven by running a ...
6
votes
3answers
809 views

Can a One-Time public key be used for more than one payment?

If I understand correctly, every new payment will ideally have a different one-time public key for increased privacy. However, could a one-time public key receive Monero more than once (as in ...
2
votes
0answers
58 views

Cryptonote one time use view key

Would be possible to have a one-time view key where it would expire after one use or a specific time has been reached? We assume that this is using the blockchain thus it cannot be modified. What I ...
3
votes
0answers
57 views

Determining the real transaction/balance with view key only

An open source web lightwallet was posted on Reddit the source is https://github.com/moneroexamples/openmonero. It would be able to check the balance of your wallet with only the address and view key (...
5
votes
2answers
170 views

Key-image generation: What does p signify in I = xHp(P)?

According to the CN whitepaper key image I is generated thusly: I = xHp(P) I understand P is the one-time public key for the transaction, x the corresponding private key and H a deterministic hash ...
6
votes
3answers
357 views

How does RingCT work with / without coefficients?

I was trying to get more information on how RingCT works, I found the thread I linked to below here on the stack exchange. In the other thread, the most upvoted answer explains it as a coefficient, ...
3
votes
1answer
39 views

How can I verify the SHA256 hash of 0.10.3 “Wolfram Warptangent” on FreeBSD?

How can I verify the SHA256 listed in this GPG-signed message for the official Monero 0.10.3 release matches the file that I downloaded for FreeBSD, 64-bit?
5
votes
1answer
104 views

How can I verify the SHA256 hash of 0.10.3 “Wolfram Warptangent” on macOS?

How can I verify the SHA256 hash published for the official 0.10.3 "Wolfram Warptangent” release matches the file that I downloaded for macOS, 64-bit?
3
votes
3answers
1k views

How can I verify the SHA256 hash of 0.10.3 “Wolfram Warptangent” on Windows?

How can I verify the SHA256 hash published for the official 0.10.3 release matches the file that I downloaded for Windows, 64-bit?
7
votes
3answers
240 views

How can I verify the SHA256 hash of 0.10.3 “Wolfram Warptangent” on Ubuntu?

How can I verify the SHA256 hash published for the official 0.10.3 release matches the file that I downloaded for Linux, 64-bit?
1
vote
1answer
57 views

Why does the SHA512 code include numbers ending in ULL?

The sha512-blocs.c file contains five blocks like these: F(w0 ,0x428a2f98d728ae22ULL) F(w1 ,0x7137449123ef65cdULL) F(w2 ,0xb5c0fbcfec4d3b2fULL) F(w3 ,0xe9b5dba58189dbbcULL) F(w4 ,...
7
votes
1answer
398 views

Can someone walk me through a simple example to explain how RingCT works?

Original: https://www.reddit.com/r/Monero/comments/5irg81/questions_regarding_the_cryptography_behind_ringct/ I just read the RingCT paper, and there are a couple things that could use some clearing ...
2
votes
0answers
73 views

BLS Signature Aggregation

Would signature aggregation as an alternative to pruning be possible / desirable with Monero? As far as I understand it, it's a way to compress hundreds of tx into a single hash.
5
votes
1answer
122 views

How do ringct transactions use previous non-ringct outputs in a ring signature with ringct?

How will ringct transactions use non-ringct outputs to use in a ring signature? Is there any trick that gets them to work together with ringct or is it pretty simple and I am missing something?
7
votes
1answer
389 views

What signature prevents me from spending others' coins?

In passive mixing, the monero wallet finds n other parties and forms a ring signature that proves the signer is one of the parties in the ring, and hence entitled to spend from one of the accounts ...
8
votes
1answer
234 views

What was the problem with ASNL forgery?

For background there is https://nickler.ninja/blog/2016/12/17/a-problem-with-ringct/ and this problem had been fixed before this post was made by changing ASNL to borromean signature. For background ...
9
votes
3answers
405 views

In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?

Are the range proofs and pedersen commitments part of a transaction? Or are they not kept in a transaction at all?
9
votes
2answers
151 views

Can Monero's privacy features be integrated into (copied) by bitcoin?

Can Monero's privacy features be integrated into (copied) by bitcoin? If so, to what degree given the current political gridlock? By the way, I'm a true believer and I'm setting up a full node as I ...
5
votes
1answer
403 views

What other benefits does Cuckoo Cycle have over cryptonight, is it quantum computer proof?

I have read Which reasons were discussed for potentially changing the proof-of-work algorithm? but aside from being more asic 'resistant' and faster to verify what other reason should monero change ...
5
votes
2answers
339 views

Why does Monero use keccak over something like sha-256?

Keccak uses a sponge function which is cool but what benefits does keccak have over sha-256 for cryptography operations in the code? thanks
5
votes
1answer
720 views

Will quantum computer break ring signatures?

I knows quantum computer breaks elliptic curve math but what about ring signature? thanks
10
votes
1answer
949 views

What are Borromean signatures?

For more background info visit GitHub or Bitcointalk It looks like borromean signatures are going to be replacing schnorr signatures in the RingCT hardfork. What does this mean for Monero and RingCT ...