Questions tagged [ring-signatures]

A ring signature is a group of cryptographic signatures with at least one real participant, but there is no way to tell which in the group is the real one as they all appear valid, while the key image prevents double spends.

Filter by
Sorted by
Tagged with
0
votes
0answers
27 views

How do I validate the signature of a Monero transaction manually?

I'm trying to figure out how to validate the signature of a Monero transaction manually. I've read this question: How to verify MLSAG sign with a real transaction and I am trying to recreate this ...
1
vote
1answer
43 views

How is the data in ringCT used to not identify what transaction is being spent?

So I'm trying to figure out how ringCT works, but with so much data that needs to be used to make a transaction, how does Monero keep transactions from being seen if they are spent or not in ring ...
0
votes
1answer
71 views

Why Monero needs ring signature?

I am looking through the whole Monero privacy system, wondering why Monero needs ring signature? One can use stealth address to protect the identities of both sender and receiver. Suppose the longtime ...
2
votes
2answers
41 views

Is a transaction mixin size of 0 the same as not using ring signatures at all?

If I choose a mixin size of 0, is that the same as if ring signatures were not being used at all?
0
votes
1answer
67 views

Do ring signatures sometimes leak "X definitely did not pay Y" info?

I'm trying to understand how privacy in Monero compares to shielded transactions in Zcash. I understand that with Zcash's zk-Snarks, there's no information about sender, receiver or amount. I think I ...
0
votes
1answer
44 views

What is the logic behind multiexp method in bulletproof Monero implementation

Could anybody explain the logic behind multiexp method in the bulletproof Monero implementation. Source code: https://github.com/monero-project/monero/blob/v0.17.1.9/src/ringct/bulletproofs.cc#L85-L94
0
votes
0answers
41 views

Ever thought to improve MLSAG with a RANDOM index for actual UTXO on each level?

As far as I have understood, a unique MLSAG wasn't used in transactions with multiple input UTXOs because of information leakage risk due to the unique index of actual, not decoys UTXOs. I know that's ...
0
votes
1answer
107 views

What's the difference between ring signatures and RingCT

Because Monero has been updated over the years, some of the documentation about Monero no longer applies in the current version. As a result, I am not sure if the information i read is outdated. ...
2
votes
1answer
240 views

Estimating anonymity set size?

Is there any way to at least estimate what kind of anonymity set a user would have after churning Monero X times assuming the anonymity set of each individual transaction is the ringsize (i.e. there ...
0
votes
1answer
65 views

anonymity set (size) for stealth address (receiver)

S1 sends fund to R1 using a stealth addresses. The anonymity set (size) for the receiver (R1) is the size of all possible receivers in the blockchain. Once R1 spends the funds, the anonymity set (size)...
1
vote
1answer
67 views

How to get the r value for commitment in mlsag sign

Refer to ZtM2 chp3.5, we can see that in step 5 rπ = α − cπ * kπ (mod l) It's fine for public-key-ring part because there is private key kπ. But what if it is commitment-ring? How to do with no kπ? ...
1
vote
2answers
57 views

How to do MLSAG signatures with vin of type 0 (miner)?

Commitments(outPK) are required when doing a MLSAG signature. However, there is no outPK in a type 0 transaction. example What should I do as facing this kind of transactions? I've checked rctSigs....
1
vote
1answer
174 views

How to verify MLSAG sign with a real transaction

I'd like to verify a MLSAG signature with a real transaction but it doesn't work.. I chose a transaction 886687fdd30ad46ef1f7c7c18402d82212b4ae1fd2cf6b4dfc549e46be7e22f6 And here is the code written ...
1
vote
1answer
72 views

How to get components of m (message) for verifying

I am trying to verify a transaction manually..but not knowing some components of message m. The message is derived from: m = H( H(tx_prefix), H(ss), H(range proofs) ) where tx_prefix = { tx ...
0
votes
0answers
46 views

How can I get real inputs from key_offsets? [duplicate]

As I get key_offsets from command "print_tx ... +json", how can I get the real inputs with those numbers? For example, using command below.. print_tx ...
5
votes
1answer
161 views

What is Triptych and how does it relate to Monero ring signatures?

Monero Research Lab recently published a research paper on Triptych: https://eprint.iacr.org/2020/018 What is Triptych, and what are its advantages and disadvantages compared to CLSAGs?
1
vote
1answer
58 views

Results of scalarmultKey in MiniNero and monero-project are different

I'd like to create LSAG in C and now I need to calculate ciKi as element in L. Then, I try an example with MiniNero like below: K = "210330a31c3caab4087c19fbe770514e5e6b80eda552d1e5f8becabd12c4540e" ...
1
vote
1answer
59 views

How does a wallet using a remote node select ring members?

If I'm going to have decoys in my transactions, I need to know about them somehow. How does Monero prevent the remote node I'm connected to from feeding me known ring members, effectively ruining that ...
2
votes
1answer
220 views

Duplicate ring members

A Monero transaction input's ring signature contains a set of one time output keys corresponding to the outputs of some previous transactions. Such a transaction can have multiple inputs, and ...
1
vote
1answer
66 views

What are advantages and disadvantages of Monero's privacy features as compared to Bitcoin?

What are the advantages and disadvantages of Monero's privacy features as compared to Bitcoin?
1
vote
1answer
176 views

How to get the base transaction hash from the blocktemplate_blob [duplicate]

I want to know how to generate different blockhashing_blobs using blocktemplate_blob, returned by the RPC get_block_template method, with different extra fields. To do this, I need to manually ...
1
vote
1answer
98 views

Trying to understand how RCTTypeSimple works

We cannot use MLSAG and sign all inputs at once; as all real inputs would need to share the same index. The partial solution is to use a ring signature on each input separately. We need to ensure ...
1
vote
1answer
75 views

Commitment to zero vs one-time public key signature

After reading 5.6.3 in Zero-To-Monero: https://www.getmonero.org/library/Zero-to-Monero-1-0-0.pdf It seems as if they are saying that we use the commitment to zero to sign the ring with the inputs as ...
1
vote
1answer
537 views

How does the mixing work?

I have been researching Monero, and I think I understand how ring signatures and stealth addresses work mathematically. However, to create a new ring transaction, you need N peers that want to join ...
0
votes
1answer
192 views

Minimum and maximun number of mixin right now? [duplicate]

Is it a hard rule that there needs to be 11 ring signatures right now for a transaction to take place right now?
1
vote
2answers
66 views

How is the number of key images for a transaction selected?

I see that there are a few transactions that have many key images for each of the 11 ring members. But there are also a few with a lesser number of key images. How does this happen?
4
votes
1answer
151 views

How is the number of ring members selected?

How is the number of ring members signing a transaction selected? Is it selected randomly by the sender or is it defined by the Monero wallet?
4
votes
2answers
147 views

Can any one please tell me where I can find the latest python implementation of monero RingCT?

Mininero is a python implementation of monero. But the git repository is three years old where the latest link does not have any content. Is there any other python implementation of monero where code ...
0
votes
1answer
79 views

Does /get_transaction return ring signatures or key image?

i am trying to use https://www.getmonero.org/resources/developer-guides/daemon-rpc.html#get_transactions To get the signatures.. But i was wondering if they are the correct data or not?
2
votes
1answer
162 views

Key Image and Ring Member

When were counting the number of ring signatures for a certain transaction do we count the number of key images or ring members of each key image?
0
votes
1answer
163 views

Monero Ring Signature data

Is it possible to get all the data of all the transaction with all its ring signatures using either the monero-wallet or API?
2
votes
1answer
59 views

How does signing the hash of the public key show that the signer knew the private key?

I had this previously explained to me, however I do not think I understand it at all. Taken from Maxwell's confidential values: "If a signature is constructed so that the 'message' is the hash of ...
1
vote
1answer
44 views

What is a scenario when the other members of the ring signature would have multiple keys?

Looking at the algorithm for ring signature, n members of the ring can have m keys associated with them. What is a scenario where the other members, not the signer, would have multiple keys ...
1
vote
1answer
32 views

Why must each input have a separate set of decoys?

If we have a mixin of 6, with two inputs. We immediately have a total of 6 * 2 = 12 decoys Would it not be secure enough to have the 4 decoys with the two inputs which means two key images? So we ...
1
vote
1answer
118 views

How does the ring sig work: practical explanation?

Is the following correct?: If I received 5 XMR from Bob, then I wanted to send this 5 XMR to Alice. Would I create a tx with the input as the 5 XMR from Bob with one output as 5 XMR to alice. Then ...
1
vote
1answer
158 views

How are transactions validated in monero vs bitcoin?

Bitcoin In bitcoin, the signature is a "normal" one and we check it against the signed tx hash. We then check whether the public key/s which signed it, owns the input/s. we then check whether the ...
3
votes
1answer
255 views

What exactly are bulletproofs replacing in monero?

I am stuck on these questions in understanding bulletproofs: Are bulletproofs a way to hide the sender and the amount? What is the difference between bulletproofs, RingCT and Ring signatures? Edit: ...
1
vote
1answer
216 views

How do miners verify the Ring Signature of a transaction?

As from I have understood, a Ring Signature is created manipulating the true one time spend key of the sender with some set of keys that are actually "decoys" (precisely some random old keys taken ...
3
votes
1answer
195 views

How do ring signatures work when there are multiple UTXOs from which you have to collect monero coin?

User A has 3 UTXOs which sum up to 10 XMR. How does the Key Image ensure that all three utxos cannot be double spent?
1
vote
2answers
103 views

Can monero include actual spent input as previous transaction output?

Let's take we have two transactions. In the first transaction, it has 1 input with zero mixins and 3 outputs(stealth addresses). The second transaction has 1 input with one mixins and 2 outputs. Here ...
1
vote
1answer
42 views

Identifying the *real* public keys of ring signatures

Since a ring signature uses |R-1| decoy outputs for a ring of size R, is it possible to retrieve from them the real (which reveals the true wallet) A,B values from those stealth addresses?
0
votes
1answer
137 views

Could a blackballs list be used maliciously?

I do not see any way to trustlessly generate a blackballs database without running full nodes for malicious fork coins, which I do NOT want to do (and don't even have hardware resources to do). ...
2
votes
1answer
93 views

How does key images work when you create a transaction using two or more of your previously unspent transaction outputs?

I've read key images are the critical element in Monero to avoid double spends. I think I understand how it works when you are using only one of your previously unspent transaction outputs to create ...
1
vote
1answer
309 views

What keys are being used to create the key image and how is it verified?

So i'm trying to pin this down since yesterday and i simply cannot find a definite answer. Read dozens of posts and few papers specifically on this topic and while i developed a "belief" that it has ...
3
votes
1answer
126 views

Detecting the real output in ring signature

I have a strange question about the relation of P_i (stealth addresses in ring signature) with x (the one-time private key). Suppose Alice wants to spend P_1 with her spend private key (x) and we ...
0
votes
1answer
51 views

Does Monero use rfc6979 for signatures?

I came across a post stating that Monero uses the Borromean Ring Signature scheme to hide the amounts. So what signature scheme is used to sign the transactions?
1
vote
1answer
396 views

What does "rings used by outputs spent on Monero on a key reusing chain" mean?

Can you help me parse this sentence from the Shared RingDB page in the Monero GUI? This records rings used by outputs spent on Monero on a key reusing chain, so that the same ring may be reused to ...
3
votes
1answer
243 views

With a Churn: does it increase privacy more to do 1 TX with RingSize14 or 2 TX with RingSize7 or is it exactly the same?

In terms of increasing the distant to the original output.
3
votes
1answer
149 views

Is a transaction from Exchange to Wallet to Exchange traceable?

Here is an example: Exchange1 --> Adr1; Adr1 --> Exchange2 Where Adr1 is a one-time subaddress. Now suppose that Exchange1 and 2 are corrupt and cooperate with a government to leak my information. ...
2
votes
1answer
161 views

How can I choose addresses to create a ring signature for a transaction

I am doing a project based on blockchain, and I found that Monero is a good candidate for my project because of its ring signature scheme. The scenario is that I would like to create a transaction ...