All Questions
125 questions
5
votes
1
answer
124
views
Editing Monero Papers
I have been reading some of the papers available on Monero, and they contain a lot of typos and other small errors. It would be great if we could fix and clarify them. Don't get me wrong, I greatly ...
- 3,327
5
votes
1
answer
241
views
Why does the stealth address involve a hash function?
According to the cryptonote white paper, a stealth address of the form P = H_s(rA)G + B. My question is, why is the hash function necessary? It seems that P=rA + B would work just as well. Using a ...
- 3,120
5
votes
1
answer
228
views
What is Triptych and how does it relate to Monero ring signatures?
Monero Research Lab recently published a research paper on Triptych: https://eprint.iacr.org/2020/018
What is Triptych, and what are its advantages and disadvantages compared to CLSAGs?
- 8,826
5
votes
1
answer
416
views
What is the deterministic hash to EC function used to construct the key image?
Ring signatures alone would allow double spending, so Monero (as a result of following the CrpytoNote whitepaper) has to use a 'key image', which is the same across identical transactions and hence ...
- 455
5
votes
1
answer
90
views
How is the G constant calculated in the cryptonote protocol?
The cryptonote whitepaper uses a G constant, as a base point, to calculate various operations, but I don't understand where this constant actually comes from. Is it just a random point on an ...
- 1,155
5
votes
1
answer
71
views
(Non-ring) Wallet signatures
I am reading about ECDSA and EdDSA. I was wondering what the Monero void crypto_ops::generate_signature signature is based upon. From the code, I see that the math to generate one is
k = rand()
t3 = ...
- 307
5
votes
1
answer
68
views
Literature suggestions to understand the cryptography used in Monero?
For a computer scientist familiar with theoretical aspects of the field and a solid understanding of mathematical foundations, but no background in cryptography, what are recommended books or papers ...
- 1,205
5
votes
1
answer
139
views
Monero Research Lab - Talent Acquisition. Whom would/do they want?
The MRL, to my knowledge, is made up of four anonymous/pseudonymous academics, who primarily specialize in mathematics (mathematical sciences and algebraic geometry). Are there other specialties that ...
- 5,515
5
votes
1
answer
730
views
What is elliptic curve cryptography and why is it important to Monero?
What is elliptic curve cryptography and why is it important to Monero?
Please provide both a basic description and an in depth description of the type found on Moneropedia
- 1,010
5
votes
1
answer
170
views
What is the concept of Refund Transactions from the MRL?
I am searching for more information on the concept of refund transactions.
I found that the MRL is working on a paper on the topic (source).
Would this be something that will be used in channel ...
- 985
5
votes
0
answers
246
views
Security risk due to bad random number generator when creating transactions
I've noticed such risk mentioned in this answer to another question, where a presentation (page 28) by Nicolas T. Courtois, studying Monero cryptography, was referred to.
I'm interested to better ...
- 20k
4
votes
5
answers
403
views
Monero technology information [closed]
While this SE site is a good source for getting specific questions answered, where can I go to gain good background knowledge and learn technical details about Monero?
- 83
4
votes
2
answers
567
views
Understanding MLSAG in Monero transaction
This is a followup question to Understanding the structure of Monero transaction with emphasis on the MLSAG part.
Here's the transaction's structure again given with print_tx ...
- 177
4
votes
2
answers
271
views
Key-image generation: What does p signify in I = xHp(P)?
According to the CN whitepaper key image I is generated thusly:
I = xHp(P)
I understand P is the one-time public key for the transaction, x the corresponding private key and H a deterministic hash ...
4
votes
2
answers
484
views
What is the impact of having perfectly hidden but only computationally bound commitments?
Monero uses Pedersen commitments to make transaction amounts private (hidden), but what, if any, are the problems of perfectly hidden and computationally binding commitments?
- 19.4k
4
votes
1
answer
249
views
How is Keccak calculated in Monero?
I am reading the monero's implementation of Keccak (used as first part of slow_hash) in src/crypto/keccak.c
I have found that it is a Keccak-256 (with b=1600, c=512, r=1088) and "output" of 1600 bits ...
- 178
4
votes
1
answer
164
views
How do ringct transactions use previous non-ringct outputs in a ring signature with ringct?
How will ringct transactions use non-ringct outputs to use in a ring signature? Is there any trick that gets them to work together with ringct or is it pretty simple and I am missing something?
- 3,215
4
votes
1
answer
1k
views
Will quantum computer break ring signatures?
I knows quantum computer breaks elliptic curve math but what about ring signature? thanks
- 3,215
4
votes
1
answer
163
views
Research on difficulty algorithm
A new difficulty algorithm is said to be researched in https://getmonero.org/design-goals/, with a new MRL paper underway.
I see nothing new on https://github.com/monero-project/research-lab/ about ...
- 34.9k
4
votes
1
answer
95
views
CryptoNight detail. Why this kind of multiplication?
The Cryptonight description by the CryptoNote team states that
The 8byte_mul function, however, uses only the first 8 bytes of each
argument, which are interpreted as unsigned 64-bit little-...
- 105
4
votes
1
answer
230
views
What alternative cryptography could be used in the future to protect Monero against quantum computers?
I know most cryptography Monero uses relies mostly on EC crypto which would be easily broken by a quantum computer powerful enough. What options does Monero have in the future to protect itself?
- 3,215
4
votes
1
answer
283
views
Who Generates parameters G & H for Pedersen commitment in Monero?
Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H ...
- 41
4
votes
1
answer
493
views
What other benefits does Cuckoo Cycle have over cryptonight, is it quantum computer proof?
I have read Which reasons were discussed for potentially changing the proof-of-work algorithm? but aside from being more asic 'resistant' and faster to verify what other reason should monero change ...
- 3,215
4
votes
1
answer
150
views
How is m calculated when generating subaddresses
In Kenshi's notes in the subaddresses PR it says that when generating subaddresses m = Hs(a || i) and i is just the index of the subaddress. so if a is the secret view key "...
4
votes
1
answer
196
views
How can I verify the SHA256 hash of 0.10.3 “Wolfram Warptangent” on macOS?
How can I verify the SHA256 hash published for the official 0.10.3 "Wolfram Warptangent” release matches the file that I downloaded for macOS, 64-bit?
- 438
3
votes
2
answers
360
views
Should Monero use ElGamal commitments instead of Pedersen commitments?
Following on from the Q/A
regarding "perfectly hiding and computationally binding" commitments, it is
mentioned ElGamal commitments can be used to flip the commitment properties to
become "perfectly ...
- 19.4k
3
votes
2
answers
180
views
What is the size of the set of spent key images in Monero?
For research purposes, I want to know the following:
What is the exact size of the set of already spent key images and how it can be checked? Do we need to download the Monero blockchain to get the ...
- 73
3
votes
1
answer
75
views
Is a mnemonic for view only wallet possible?
It occurred to me that one may wish to restore a wallet on a compromised computer. Perhaps they need to prove that a payment was received.
Regardless of whether this is a good idea, is it possible ...
- 5,515
3
votes
1
answer
3k
views
How does Ring Confidential Transactions work?
Can someone explain to me how RingCT works and how the recipient gets the actual amount from the encrypted amount in a RingCT transaction?
3
votes
1
answer
508
views
What are the hex representations of the small subgroup curve points on Ed25519?
Monero uses Ed25519, which has a cofactor of 8. This means the curve has a prime order l = 2^252 + 27742317777372353535851937790883648493 and the total number of possible points on the curve is 8l. ...
- 8,518
3
votes
1
answer
119
views
Discrepancy CNS006 and CryptoNote whitepaper one-time key generation
CryptoNote 2.0 uses P=Hs(rA)G + B for the generation of a one-time key.
CNS006 seems te change this to P=Hs(rA||n)+B, where n is the transaction index (encoded as varint).
Why is there this ...
- 307
3
votes
2
answers
314
views
Computing the hash of a string using Monero's codebase
In the process of trying to learn Monero's codebase and attempting to modify it, I have come across this difficulty: after having a user to enter his/her passphrase (a string), I would like to compute ...
- 3,327
3
votes
1
answer
176
views
An academic "hello world" on Monero
I'm a graduate student looking to improve my skills in real-world applications of cryptography and online anonymity. Reviewing all of the new blockchain and alt-coin variants, I believe that Monero is ...
- 321
3
votes
1
answer
382
views
Using Monero as proof of funds
I'm writing an article about the future of Healthcare. I wondered if it was possible to use Monero to make a proof of funds. For example: the hospital wants to know that I can pay for the medical care ...
- 242
3
votes
1
answer
2k
views
Missing Monero Funds
I made a transaction on ShapeShift. The transaction was successful but I never received my funds in my wallet. I’ve already talked with ShapeShift customer and they said the best thing to do is to ask ...
- 111
2
votes
3
answers
2k
views
How can I verify the SHA256 hash of 0.10.3 “Wolfram Warptangent” on Windows?
How can I verify the SHA256 hash published for the official 0.10.3 release matches the file that I downloaded for Windows, 64-bit?
- 438
2
votes
1
answer
73
views
Reasons for the way the mask/amount is calculated?
I am reading some monero docs and it says that the mask and amount are generated like this;
mask = x + H(K); //where x is the blinding scalar
amount = b + H(H(K)); //where b is the amount
`K` is the ...
- 201
2
votes
1
answer
127
views
How does the code for scalar reduction work?
In this piece of code:
https://github.com/monero-project/monero/blob/master/src/crypto/crypto_ops_builder/ref10CommentedCombined/sc_reduce.c#L35
We reduce a scalar by mod l.
what is the ...
- 660
2
votes
1
answer
421
views
Explanation of how exactly the pederson commitments in monero work?
so lets say for the first commitment (after a mined transaction)
let a = miner_reward
this is a known number.
to generate the first commitment, one does;
input = x.G + a.H; output = x.G + a.H
...
- 201
2
votes
1
answer
164
views
Why is it necessary in confidential transactions to have two generators?
So as i understand it (though im not sure if its the same w/ bulletproofs so please correct me if im wrong), a commitment is generated like this;
commitment = (blinding_secret . G) + (value . H)
...
- 201
2
votes
1
answer
496
views
How to convert monero's curve25519 basepoint to bouncycastle
This is how to get the curve25519 basepoint in monero (use js console at https://xmr.llcoins.net/)
> var identity = "0100000000000000000000000000000000000000000000000000000000000000"
> var base ...
2
votes
1
answer
989
views
Help-Sent Monero From Changelly and did not received funds
I am a total Tech NOOB. I set up the Monero GUI wallet yesterday and moved BTC to Changelly to convert to XMR. Changelly shows the transaction record but something went wrong did not get the funds in ...
- 21
2
votes
1
answer
220
views
What cryptography does Monero utilize?
Just looking for a brief explanation of what cryptography is used and where/how it is used in Monero. Thanks :)
- 3,215
2
votes
1
answer
124
views
ed25519 problem with libsodium implementation S_a + S_b = (s_a+s_b)*G
I'm trying to make my own implementation of atomic swaps by following this article. I use a low level node.js bindings for libsodium for this.
If I understand the protocol correctly, then Alice and ...
- 87
2
votes
1
answer
67
views
Monero secret key (32b) vs libsodium ed25519 secret key (64b)
I'm trying to move cryptographic key operations in the Monero Python module from pure Python to pynacl which is a wrapper around libsodium.
The first problem I stumbled upon is that Monero secret keys ...
- 620
2
votes
1
answer
108
views
Why is it necessary to have such long addresses?
In the cryptonote paper, it says the address needs to be so long because there has to be a spend key and a view key. where the receiving address is calculated like this;
address = Hs(rA)G + B
but ...
- 201
2
votes
1
answer
478
views
Will Monero suffer the transaction fee problem like Bitcoin?
Currently, BTC has a problem with small transfers, i.e sending £1 will cost £4 which is just ridiculous. Will XMR ever have the same problem? I know LTC have sloved this issue and Bitcoin cash has ...
- 123
2
votes
1
answer
168
views
How Monero transactions related with mixins
Can anyone explain me is there a relationship between transaction outputs with the number of mixins using in the transaction? I meant If someone sends 12XMR to someone else with 5-mixins how many ...
2
votes
2
answers
132
views
How the sender recover the transactions that he spent?
In order to compute the balance of his own wallet, (I assume that) a client needs to retrieve:
1- The transaction that he is the receiver.(By scanning the whole block-chain and compare with his own ...
- 367
2
votes
1
answer
292
views
Scratchpad Initialisation : What is the input to Keccak?
So this is probably a question I should be able to find the answer to easily but I am stumped. In the documentation for cryptonight the part on scratchpad initialization says:
First, the input is ...
- 21