Questions tagged [cryptography]

Practice and study of techniques for secure communication in the presence of third parties called adversaries

Filter by
Sorted by
Tagged with
1 vote
1 answer
47 views

Monero public key generation

I'm trying to get the public key with different JavaScript libraries: with elliptic and with libsodium-wrappers-sumo This is my code: const BN = require('bn.js'); const EdDSA = require('elliptic')....
user avatar
0 votes
0 answers
13 views

cross-curve public keys validation

I read a tech note that describes an algorithm for checking if two public keys on different curves belong to the same private key. Also found implementation on Rust programming language. Unfortunately,...
user avatar
1 vote
1 answer
40 views

Are hex private keys already in little endian format?

I implemented my own private (seed) spend and view key generator for learning purposes but I still don't fully understand. I ended up with a working implementation but I feel that I'm just swapping ...
user avatar
  • 63
1 vote
1 answer
33 views

Why is the limit in the random32_unbiased function different between the comments and the actual code?

I'm talking about this specific function: void random32_unbiased(unsigned char *bytes) { // l = 2^252 + 27742317777372353535851937790883648493. // l fits 15 times in 32 bytes (iow, 15 l is ...
user avatar
  • 63
2 votes
1 answer
70 views

ed25519 problem with libsodium implementation S_a + S_b = (s_a+s_b)*G

I'm trying to make my own implementation of atomic swaps by following this article. I use a low level node.js bindings for libsodium for this. If I understand the protocol correctly, then Alice and ...
user avatar
2 votes
1 answer
48 views

Monero secret key (32b) vs libsodium ed25519 secret key (64b)

I'm trying to move cryptographic key operations in the Monero Python module from pure Python to pynacl which is a wrapper around libsodium. The first problem I stumbled upon is that Monero secret keys ...
user avatar
  • 600
0 votes
0 answers
25 views

How does Argon2d provide security after RandomX dataset is calculated

I am reading the spec for RandomX, and it seems that the creation of the dataset only relies on K, which changes once every 2 days. However, the designers intend the hardness of calculating the ...
user avatar
1 vote
0 answers
20 views

Leveraging FHE transpiler in Monero

Google released recently FOSS source code for a "Fully Homomorphic Encryption Transpiler". Here is the associated paper. How can this be leveraged for Monero ? For example, can this be used ...
user avatar
1 vote
1 answer
83 views

Possible error in book Zero to Monero: Second Edition

I am reading the book Zero to Monero: Second Edition from the GetMonero Library. On the 3rd paragraph of page 15, the book mentions an algorithm for finding points inside the subgroup of order l, ...
user avatar
5 votes
1 answer
172 views

What is Triptych and how does it relate to Monero ring signatures?

Monero Research Lab recently published a research paper on Triptych: https://eprint.iacr.org/2020/018 What is Triptych, and what are its advantages and disadvantages compared to CLSAGs?
user avatar
  • 8,704
1 vote
1 answer
149 views

What is "Janus"-linking?

How did it get its name? The attacker can't actually steal Monero, right? It relates to a clever use of cryptography involved in subaddresses? How so? Can it be mitigated?
user avatar
0 votes
0 answers
87 views

Understanding a security proof of RingCT 3.0

I am reading the paper "RingCT 3.0 for Blockchain Confidential Transaction: Shorter Size and Stronger Security" (https://eprint.iacr.org/2019/508.pdf), an improvement to Ring Confidential Transactions....
user avatar
  • 113
3 votes
2 answers
208 views

Should Monero use ElGamal commitments instead of Pedersen commitments?

Following on from the Q/A regarding "perfectly hiding and computationally binding" commitments, it is mentioned ElGamal commitments can be used to flip the commitment properties to become "perfectly ...
user avatar
  • 17.3k
4 votes
2 answers
358 views

What is the impact of having perfectly hidden but only computationally bound commitments?

Monero uses Pedersen commitments to make transaction amounts private (hidden), but what, if any, are the problems of perfectly hidden and computationally binding commitments?
user avatar
  • 17.3k
0 votes
1 answer
121 views

Implications and remedies of fixed 'H' in Pedersen commitment

In the monero document "Zero to Monero" pp. 30 the Pedersen Commitment scheme is described as requiring generators G, H such that no-one knows an x where G = x*H. The actual H is defined as H=to_point(...
user avatar
1 vote
1 answer
52 views

Is there a written document or resource about CryptoNight v2?

I am looking for something like this: https://cryptonote.org/cns/cns008.txt It's got a detailed, written explanation and not just code. I am trying to make a miner for learning purposes so I guess ...
user avatar
  • 43
2 votes
1 answer
86 views

How does the code for scalar reduction work?

In this piece of code: https://github.com/monero-project/monero/blob/master/src/crypto/crypto_ops_builder/ref10CommentedCombined/sc_reduce.c#L35 We reduce a scalar by mod l. what is the ...
user avatar
3 votes
1 answer
68 views

Is a mnemonic for view only wallet possible?

It occurred to me that one may wish to restore a wallet on a compromised computer. Perhaps they need to prove that a payment was received. Regardless of whether this is a good idea, is it possible ...
user avatar
2 votes
1 answer
97 views

Why is it necessary to have such long addresses?

In the cryptonote paper, it says the address needs to be so long because there has to be a spend key and a view key. where the receiving address is calculated like this; address = Hs(rA)G + B but ...
user avatar
  • 191
1 vote
1 answer
56 views

Reasons for the way the mask/amount is calculated?

I am reading some monero docs and it says that the mask and amount are generated like this; mask = x + H(K); //where x is the blinding scalar amount = b + H(H(K)); //where b is the amount `K` is the ...
user avatar
  • 191
2 votes
1 answer
330 views

Explanation of how exactly the pederson commitments in monero work?

so lets say for the first commitment (after a mined transaction) let a = miner_reward this is a known number. to generate the first commitment, one does; input = x.G + a.H; output = x.G + a.H ...
user avatar
  • 191
2 votes
1 answer
153 views

Why is it necessary in confidential transactions to have two generators?

So as i understand it (though im not sure if its the same w/ bulletproofs so please correct me if im wrong), a commitment is generated like this; commitment = (blinding_secret . G) + (value . H) ...
user avatar
  • 191
4 votes
1 answer
88 views

CryptoNight detail. Why this kind of multiplication?

The Cryptonight description by the CryptoNote team states that The 8byte_mul function, however, uses only the first 8 bytes of each argument, which are interpreted as unsigned 64-bit little-...
user avatar
4 votes
1 answer
208 views

Who Generates parameters G & H for Pedersen commitment in Monero?

Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H ...
user avatar
1 vote
1 answer
154 views

What makes decoding the total sent amount using the viewkey potentially inaccurate?

When using the 'decode outputs' on moneroexplorer for a TX that I sent, I get this warning when it (correctly) estimates the amount that I spent: Possible spending is: spent amount (tx fee included)...
user avatar
4 votes
1 answer
199 views

How is Keccak calculated in Monero?

I am reading the monero's implementation of Keccak (used as first part of slow_hash) in src/crypto/keccak.c I have found that it is a Keccak-256 (with b=1600, c=512, r=1088) and "output" of 1600 bits ...
user avatar
  • 178
2 votes
1 answer
264 views

What are the hex representations of the small subgroup curve points on Ed25519?

Monero uses Ed25519, which has a cofactor of 8. This means the curve has a prime order l = 2^252 + 27742317777372353535851937790883648493 and the total number of possible points on the curve is 8l. ...
user avatar
  • 8,368
1 vote
1 answer
279 views

Is the connection over Tor between client and remote node safe?

I'm using torsocks to connect my CLI wallet to a remote node (geo.node.moneroworld.com:18089). I don't need a high level of anonymity, but I would like to understand what information is at risk. For ...
user avatar
0 votes
1 answer
88 views

How do I multiply 2 public keys?

I want to make DH-like key exchange calculating something like this: b = H(b0B1B2) But the problem is multiplication between two ec-points is not defined on ec-curve. I know monero makes some ...
user avatar
  • 121
5 votes
1 answer
177 views

Where can I learn about the cryptography used in Monero? [duplicate]

What papers should I read to understand the mathematics behind Monero?
user avatar
  • 8,368
0 votes
1 answer
185 views

Calculating subaddresses

The PR for subaddresses and MRL-0006 say that the value m is calculated as: m = H_s(a, i) or H_s(a || i) I have found another question attempted to find the answer to my same question, however I am ...
user avatar
4 votes
2 answers
494 views

Understanding MLSAG in Monero transaction

This is a followup question to Understanding the structure of Monero transaction with emphasis on the MLSAG part. Here's the transaction's structure again given with print_tx ...
user avatar
  • 177
2 votes
1 answer
418 views

How to convert monero's curve25519 basepoint to bouncycastle

This is how to get the curve25519 basepoint in monero (use js console at https://xmr.llcoins.net/) > var identity = "0100000000000000000000000000000000000000000000000000000000000000" > var base ...
user avatar
6 votes
1 answer
333 views

Transaction structure: Question about ecdhInfo

This question by kenshi84 shows how the pseudoOuts and outPk fields can be validated by anyone (without knowing any of the private keys involved), by checking that sumIn === sumOut: > var H = ...
user avatar
4 votes
1 answer
136 views

How is m calculated when generating subaddresses

In Kenshi's notes in the subaddresses PR it says that when generating subaddresses m = Hs(a || i) and i is just the index of the subaddress. so if a is the secret view key "...
user avatar
3 votes
1 answer
303 views

Using Monero as proof of funds

I'm writing an article about the future of Healthcare. I wondered if it was possible to use Monero to make a proof of funds. For example: the hospital wants to know that I can pay for the medical care ...
user avatar
  • 242
5 votes
1 answer
61 views

(Non-ring) Wallet signatures

I am reading about ECDSA and EdDSA. I was wondering what the Monero void crypto_ops::generate_signature signature is based upon. From the code, I see that the math to generate one is k = rand() t3 = ...
user avatar
  • 307
3 votes
1 answer
106 views

Discrepancy CNS006 and CryptoNote whitepaper one-time key generation

CryptoNote 2.0 uses P=Hs(rA)G + B for the generation of a one-time key. CNS006 seems te change this to P=Hs(rA||n)+B, where n is the transaction index (encoded as varint). Why is there this ...
user avatar
  • 307
7 votes
1 answer
601 views

Stealth addresses: where do they come from?

I wonder what the origin of stealth addresses is. I learned that they were introduced for BitCoin, by Peter Todd. However, I cannot find any literature describing or analysing the specific ...
user avatar
  • 307
9 votes
1 answer
596 views

Are Confidential Transactions in Monero perfectly binding or hiding?

Bitcoin contributor Pieter Wuille recently commented on Reddit: Bulletproofs and the Pedersen commitments they operate on are perfectly hiding, but not perfectly binding. This roughly means that ...
user avatar
  • 215
6 votes
1 answer
424 views

Is CryptoNight the hash function which plays the role of the "random oracle"?

Is CryptoNight the hash function which plays the role of the "random oracle" in the random oracle model under which certain properties of CryptoNote are mathematically proven in the original paper? Or ...
user avatar
2 votes
1 answer
284 views

Scratchpad Initialisation : What is the input to Keccak?

So this is probably a question I should be able to find the answer to easily but I am stumped. In the documentation for cryptonight the part on scratchpad initialization says: First, the input is ...
user avatar
  • 21
9 votes
1 answer
874 views

How do key images really work?

I have the following questions regarding the equation I=xHp(P): What is the hash function Hp? How can we know that Hp(P) is a point on the Ed25519 curve? Or is it not? Is the value I published with ...
user avatar
6 votes
2 answers
1k views

How do I manually decode outputs?

I'm currently coding a small Monero tool just to better understand how it all works. I already implemented address-generation from scratch (thanks to luigis address test page) and the next step is to ...
user avatar
6 votes
1 answer
2k views

What cryptography primitives/concepts, other than the basic ones, does Monero use?

The following are the "basic" cryptography primitives/concepts, taught in all beginner textbooks on cryptography: symmetric encryption (stream and block ciphers. AES, etc.) asymmetric public-key ...
user avatar
  • 63
9 votes
3 answers
4k views

How does the recent patched key image exploit work in practice?

For more info https://getmonero.org/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html This has been patched months ago and was never exploited which can be proven by running a ...
user avatar
  • 3,185
7 votes
3 answers
1k views

Can a One-Time public key be used for more than one payment?

If I understand correctly, every new payment will ideally have a different one-time public key for increased privacy. However, could a one-time public key receive Monero more than once (as in ...
user avatar
2 votes
0 answers
75 views

Cryptonote one time use view key

Would be possible to have a one-time view key where it would expire after one use or a specific time has been reached? We assume that this is using the blockchain thus it cannot be modified. What I ...
user avatar
  • 1,016
2 votes
0 answers
66 views

Determining the real transaction/balance with view key only

An open source web lightwallet was posted on Reddit the source is https://github.com/moneroexamples/openmonero. It would be able to check the balance of your wallet with only the address and view key (...
user avatar
  • 1,016
4 votes
2 answers
261 views

Key-image generation: What does p signify in I = xHp(P)?

According to the CN whitepaper key image I is generated thusly: I = xHp(P) I understand P is the one-time public key for the transaction, x the corresponding private key and H a deterministic hash ...
user avatar