Questions tagged [cryptography]
Practice and study of techniques for secure communication in the presence of third parties called adversaries
96
questions
1
vote
1
answer
181
views
What makes decoding the total sent amount using the viewkey potentially inaccurate?
When using the 'decode outputs' on moneroexplorer for a TX that I sent, I get this warning when it (correctly) estimates the amount that I spent:
Possible spending is: spent amount (tx fee included)...
CommunityBot
- 1
0
votes
1
answer
219
views
Calculating subaddresses
The PR for subaddresses and MRL-0006 say that the value m is calculated as:
m = H_s(a, i) or H_s(a || i)
I have found another question attempted to find the answer to my same question, however I am ...
CommunityBot
- 1
0
votes
1
answer
32
views
Could anyone explain ge_frombytes_vartime for me?
Recently I am working on monero source code, and I wonder how monero verify ed25519 public key is invalid. Is this function converting the public key into Y coordinates, then calculating the X ...
CommunityBot
- 1
2
votes
1
answer
120
views
How does the code for scalar reduction work?
In this piece of code:
https://github.com/monero-project/monero/blob/master/src/crypto/crypto_ops_builder/ref10CommentedCombined/sc_reduce.c#L35
We reduce a scalar by mod l.
what is the ...
0
votes
0
answers
36
views
What does breaking the discrete logarithm problem imply for anonymity? [duplicate]
If the discrete logarithm problem is broken (either through a mathematical breakthrough or a quantum computer) what are the implications for the history of Monero transactions?
Will past anonymity be ...
0
votes
0
answers
36
views
How to have list of incoming and outgoing tx given an address?
I have my full monero node and I'm trying to extrapolate from it, all the tx (incoming and outgoing) involving my address. Right now I'm using the monerojs library and scanning the blocks, the data I'...
- 1
0
votes
0
answers
45
views
Can you derive anything from knowing multiple subaddresses from the same account/wallet?
If you can link a known ID to multiple/many (20+) publicly posted subaddresses, and you know those subaddresses are under the same account in a wallet, is there an attack surface here for reverse-...
0
votes
1
answer
257
views
Create a key pair for a Monero wallet through the seed generator from the BIP32/BIP44 standard
I am trying to derive my accounts of different blockchains via BIP44 standard to have deterministic account hierarchy. I was able to generate keys for BTC,ETH and other blockchains, but not for monero ...
- 19.1k
0
votes
1
answer
237
views
Quantum-safe stealth addressing
Many of you will know that the stealth addressing system used in Monero is vulnerable to quantum attacks, due to it being based on quantum-weak cryptography. Although not all payments would be ...
- 19.1k
1
vote
1
answer
78
views
Monero public key generation
I'm trying to get the public key with different JavaScript libraries: with elliptic and with libsodium-wrappers-sumo This is my code:
const BN = require('bn.js');
const EdDSA = require('elliptic')....
- 8,468
1
vote
1
answer
98
views
Are hex private keys already in little endian format?
I implemented my own private (seed) spend and view key generator for learning purposes but I still don't fully understand. I ended up with a working implementation but I feel that I'm just swapping ...
- 19.1k
1
vote
1
answer
50
views
Why is the limit in the random32_unbiased function different between the comments and the actual code?
I'm talking about this specific function:
void random32_unbiased(unsigned char *bytes)
{
// l = 2^252 + 27742317777372353535851937790883648493.
// l fits 15 times in 32 bytes (iow, 15 l is ...
- 19.1k
2
votes
1
answer
113
views
ed25519 problem with libsodium implementation S_a + S_b = (s_a+s_b)*G
I'm trying to make my own implementation of atomic swaps by following this article. I use a low level node.js bindings for libsodium for this.
If I understand the protocol correctly, then Alice and ...
- 19.1k
2
votes
1
answer
65
views
Monero secret key (32b) vs libsodium ed25519 secret key (64b)
I'm trying to move cryptographic key operations in the Monero Python module from pure Python to pynacl which is a wrapper around libsodium.
The first problem I stumbled upon is that Monero secret keys ...
- 19.1k
8
votes
2
answers
850
views
Is there information available about the Levin protocol?
Is there any information available about the Levin protocol?
It seems to be used for the peer to peer communication.
Things like:
The working of the protocol?
What are the benefits? Why was it ...
- 26
1
vote
0
answers
25
views
Leveraging FHE transpiler in Monero
Google released recently FOSS source code for a "Fully Homomorphic Encryption Transpiler". Here is the associated paper.
How can this be leveraged for Monero ?
For example, can this be used ...
- 2,968
3
votes
2
answers
327
views
Should Monero use ElGamal commitments instead of Pedersen commitments?
Following on from the Q/A
regarding "perfectly hiding and computationally binding" commitments, it is
mentioned ElGamal commitments can be used to flip the commitment properties to
become "perfectly ...
- 229
1
vote
1
answer
90
views
Possible error in book Zero to Monero: Second Edition
I am reading the book Zero to Monero: Second Edition from the GetMonero Library.
On the 3rd paragraph of page 15, the book mentions an algorithm for finding points inside the subgroup of order l, ...
- 19.1k
17
votes
2
answers
2k
views
Why/how does monero generate public ed25519 keys without using the standard public key generation provided by ed25519 libraries?
Why/how does monero generate public ed25519 keys without using the standard public key derivation provided by ed25519 libraries?
Inspecting the code for mininero (https://github.com/monero-project/...
CommunityBot
- 1
5
votes
1
answer
210
views
What is Triptych and how does it relate to Monero ring signatures?
Monero Research Lab recently published a research paper on Triptych: https://eprint.iacr.org/2020/018
What is Triptych, and what are its advantages and disadvantages compared to CLSAGs?
- 19.1k
1
vote
1
answer
276
views
What is "Janus"-linking?
How did it get its name?
The attacker can't actually steal Monero, right?
It relates to a clever use of cryptography involved in subaddresses? How so?
Can it be mitigated?
- 8,468
0
votes
0
answers
95
views
Understanding a security proof of RingCT 3.0
I am reading the paper "RingCT 3.0 for Blockchain Confidential Transaction:
Shorter Size and Stronger Security" (https://eprint.iacr.org/2019/508.pdf), an improvement to Ring Confidential Transactions....
- 113
4
votes
2
answers
460
views
What is the impact of having perfectly hidden but only computationally bound commitments?
Monero uses Pedersen commitments to make transaction amounts private (hidden), but what, if any, are the problems of perfectly hidden and computationally binding commitments?
- 206
0
votes
1
answer
149
views
Implications and remedies of fixed 'H' in Pedersen commitment
In the monero document "Zero to Monero" pp. 30 the Pedersen Commitment scheme is described as requiring generators G, H such that no-one knows an x where G = x*H. The actual H is defined as H=to_point(...
- 19.1k
1
vote
1
answer
54
views
Is there a written document or resource about CryptoNight v2?
I am looking for something like this:
https://cryptonote.org/cns/cns008.txt
It's got a detailed, written explanation and not just code. I am trying to make a miner for learning purposes so I guess ...
- 19.1k
3
votes
1
answer
70
views
Is a mnemonic for view only wallet possible?
It occurred to me that one may wish to restore a wallet on a compromised computer. Perhaps they need to prove that a payment was received.
Regardless of whether this is a good idea, is it possible ...
- 8,468
2
votes
1
answer
61
views
Reasons for the way the mask/amount is calculated?
I am reading some monero docs and it says that the mask and amount are generated like this;
mask = x + H(K); //where x is the blinding scalar
amount = b + H(H(K)); //where b is the amount
`K` is the ...
- 8,468
2
votes
1
answer
102
views
Why is it necessary to have such long addresses?
In the cryptonote paper, it says the address needs to be so long because there has to be a spend key and a view key. where the receiving address is calculated like this;
address = Hs(rA)G + B
but ...
- 15.2k
2
votes
1
answer
404
views
Explanation of how exactly the pederson commitments in monero work?
so lets say for the first commitment (after a mined transaction)
let a = miner_reward
this is a known number.
to generate the first commitment, one does;
input = x.G + a.H; output = x.G + a.H
...
- 8,468
2
votes
1
answer
162
views
Why is it necessary in confidential transactions to have two generators?
So as i understand it (though im not sure if its the same w/ bulletproofs so please correct me if im wrong), a commitment is generated like this;
commitment = (blinding_secret . G) + (value . H)
...
- 8,468
4
votes
1
answer
92
views
CryptoNight detail. Why this kind of multiplication?
The Cryptonight description by the CryptoNote team states that
The 8byte_mul function, however, uses only the first 8 bytes of each
argument, which are interpreted as unsigned 64-bit little-...
- 19.1k
4
votes
1
answer
268
views
Who Generates parameters G & H for Pedersen commitment in Monero?
Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H ...
- 4,566
4
votes
1
answer
195
views
How can I verify the SHA256 hash of 0.10.3 “Wolfram Warptangent” on macOS?
How can I verify the SHA256 hash published for the official 0.10.3 "Wolfram Warptangent” release matches the file that I downloaded for macOS, 64-bit?
- 4,566
4
votes
1
answer
230
views
How is Keccak calculated in Monero?
I am reading the monero's implementation of Keccak (used as first part of slow_hash) in src/crypto/keccak.c
I have found that it is a Keccak-256 (with b=1600, c=512, r=1088) and "output" of 1600 bits ...
- 3,334
2
votes
1
answer
431
views
What are the hex representations of the small subgroup curve points on Ed25519?
Monero uses Ed25519, which has a cofactor of 8. This means the curve has a prime order l = 2^252 + 27742317777372353535851937790883648493 and the total number of possible points on the curve is 8l. ...
- 8,468
4
votes
2
answers
267
views
Key-image generation: What does p signify in I = xHp(P)?
According to the CN whitepaper key image I is generated thusly:
I = xHp(P)
I understand P is the one-time public key for the transaction, x the corresponding private key and H a deterministic hash ...
- 8,468
1
vote
1
answer
338
views
Is the connection over Tor between client and remote node safe?
I'm using torsocks to connect my CLI wallet to a remote node (geo.node.moneroworld.com:18089). I don't need a high level of anonymity, but I would like to understand what information is at risk. For ...
- 34.9k
0
votes
1
answer
129
views
How do I multiply 2 public keys?
I want to make DH-like key exchange calculating something like this:
b = H(b0B1B2)
But the problem is multiplication between two ec-points is not defined on ec-curve.
I know monero makes some ...
- 121
4
votes
2
answers
554
views
Understanding MLSAG in Monero transaction
This is a followup question to Understanding the structure of Monero transaction with emphasis on the MLSAG part.
Here's the transaction's structure again given with print_tx ...
- 11
5
votes
1
answer
188
views
Where can I learn about the cryptography used in Monero? [duplicate]
What papers should I read to understand the mathematics behind Monero?
- 8,468
6
votes
1
answer
2k
views
What cryptography primitives/concepts, other than the basic ones, does Monero use?
The following are the "basic" cryptography primitives/concepts, taught in all beginner textbooks on cryptography:
symmetric encryption (stream and block ciphers. AES, etc.)
asymmetric public-key ...
- 1
5
votes
1
answer
404
views
What is the deterministic hash to EC function used to construct the key image?
Ring signatures alone would allow double spending, so Monero (as a result of following the CrpytoNote whitepaper) has to use a 'key image', which is the same across identical transactions and hence ...
- 19.9k
6
votes
1
answer
355
views
Transaction structure: Question about ecdhInfo
This question by kenshi84 shows how the pseudoOuts and outPk fields can be validated by anyone (without knowing any of the private keys involved), by checking that sumIn === sumOut:
> var H = ...
- 8,468
2
votes
1
answer
483
views
How to convert monero's curve25519 basepoint to bouncycastle
This is how to get the curve25519 basepoint in monero (use js console at https://xmr.llcoins.net/)
> var identity = "0100000000000000000000000000000000000000000000000000000000000000"
> var base ...
- 8,468
4
votes
1
answer
148
views
How is m calculated when generating subaddresses
In Kenshi's notes in the subaddresses PR it says that when generating subaddresses m = Hs(a || i) and i is just the index of the subaddress. so if a is the secret view key "...
7
votes
1
answer
530
views
What signature prevents me from spending others' coins?
In passive mixing, the monero wallet finds n other parties and forms a ring signature that proves the signer is one of the parties in the ring, and hence entitled to spend from one of the accounts ...
- 2,239
3
votes
1
answer
360
views
Using Monero as proof of funds
I'm writing an article about the future of Healthcare. I wondered if it was possible to use Monero to make a proof of funds. For example: the hospital wants to know that I can pay for the medical care ...
CommunityBot
- 1
5
votes
1
answer
67
views
(Non-ring) Wallet signatures
I am reading about ECDSA and EdDSA. I was wondering what the Monero void crypto_ops::generate_signature signature is based upon. From the code, I see that the math to generate one is
k = rand()
t3 = ...
- 3,334
3
votes
1
answer
113
views
Discrepancy CNS006 and CryptoNote whitepaper one-time key generation
CryptoNote 2.0 uses P=Hs(rA)G + B for the generation of a one-time key.
CNS006 seems te change this to P=Hs(rA||n)+B, where n is the transaction index (encoded as varint).
Why is there this ...
- 19.9k
7
votes
1
answer
647
views
Stealth addresses: where do they come from?
I wonder what the origin of stealth addresses is.
I learned that they were introduced for BitCoin, by Peter Todd. However, I cannot find any literature describing or analysing the specific ...
- 19.9k