Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [ring-signatures]

A ring signature is a group of cryptographic signatures with at least one real participant, but there is no way to tell which in the group is the real one as they all appear valid, while the key image prevents double spends.

Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

Can't you determine the output spent for keyimage?

I'm studying how ring signatures and key images work, and I think I lack some cryptography-related knowledge in this part. As far as I understand, you can't fake a key image by using a random number (...
xmr_fan's user avatar
  • 101
0 votes
0 answers
27 views

Any known implementation of Monero MPC mutlisigs?

I am looking for a whitepaper/science doc/source code that explains/implements MPC multisig for Monero. Would appreciate any piece of inforamtion
Max's user avatar
  • 101
0 votes
0 answers
39 views

How to have list of incoming and outgoing tx given an address?

I have my full monero node and I'm trying to extrapolate from it, all the tx (incoming and outgoing) involving my address. Right now I'm using the monerojs library and scanning the blocks, the data I'...
AlexCav's user avatar
0 votes
1 answer
36 views

How to use custom output when signing?

So let's say I received 2 transactions to my wallet and I want to make a transaction. I want to choose which one's output will be used to sign my transaction. How can I do that?
Alfred White's user avatar
0 votes
1 answer
179 views

Ring signature and key images for dummies?

So I think I understand the Pedersen commitment math on the curve to hide amounts, but I'm struggling to understand how ring signatures obfuscate your transaction even further. If only one set of the ...
xmrNoob69's user avatar
1 vote
1 answer
56 views

Ring Signatures and the new view tags for fast wallet scanning

Do the new view tags that make wallet scanning faster also make ring signatures less effective? Do all the signatures in any ring produce the same view tag, so that there will end up being 256 ...
Bruce Baker's user avatar
0 votes
1 answer
65 views

How are the participants of a Ring Signature selected?

If I understand correctly, the participants of a ring signature will be just other outputs. But I don't understand the criteria for selecting those outputs.
3af2's user avatar
  • 63
0 votes
1 answer
53 views

In the Ring Signature Process, which one of my keys is used for signing?

I don't get the Ring Signature process. I tried to read about that but I don't understand what is happening in a more technical way. I'm specially confused about which one of my "Public Keys"...
3af2's user avatar
  • 63
1 vote
0 answers
58 views

How do I validate the signature of a Monero transaction manually?

I'm trying to figure out how to validate the signature of a Monero transaction manually. I've read this question: How to verify MLSAG sign with a real transaction and I am trying to recreate this ...
ieatpizza's user avatar
  • 121
1 vote
1 answer
67 views

How is the data in ringCT used to not identify what transaction is being spent?

So I'm trying to figure out how ringCT works, but with so much data that needs to be used to make a transaction, how does Monero keep transactions from being seen if they are spent or not in ring ...
Raccoondude's user avatar
0 votes
1 answer
128 views

Why Monero needs ring signature?

I am looking through the whole Monero privacy system, wondering why Monero needs ring signature? One can use stealth address to protect the identities of both sender and receiver. Suppose the longtime ...
Felix LL's user avatar
  • 133
2 votes
2 answers
67 views

Is a transaction mixin size of 0 the same as not using ring signatures at all?

If I choose a mixin size of 0, is that the same as if ring signatures were not being used at all?
yemista's user avatar
  • 133
0 votes
1 answer
83 views

Do ring signatures sometimes leak "X definitely did not pay Y" info?

I'm trying to understand how privacy in Monero compares to shielded transactions in Zcash. I understand that with Zcash's zk-Snarks, there's no information about sender, receiver or amount. I think I ...
Andrew Arnott's user avatar
0 votes
1 answer
81 views

What is the logic behind multiexp method in bulletproof Monero implementation

Could anybody explain the logic behind multiexp method in the bulletproof Monero implementation. Source code: https://github.com/monero-project/monero/blob/v0.17.1.9/src/ringct/bulletproofs.cc#L85-L94
mahnunchik's user avatar
0 votes
0 answers
51 views

Ever thought to improve MLSAG with a RANDOM index for actual UTXO on each level?

As far as I have understood, a unique MLSAG wasn't used in transactions with multiple input UTXOs because of information leakage risk due to the unique index of actual, not decoys UTXOs. I know that's ...
baro77's user avatar
  • 1
1 vote
2 answers
283 views

What's the difference between ring signatures and RingCT

Because Monero has been updated over the years, some of the documentation about Monero no longer applies in the current version. As a result, I am not sure if the information i read is outdated. ...
elixmr's user avatar
  • 11
2 votes
1 answer
461 views

Estimating anonymity set size?

Is there any way to at least estimate what kind of anonymity set a user would have after churning Monero X times assuming the anonymity set of each individual transaction is the ringsize (i.e. there ...
The_Ringsize_Ring's user avatar
0 votes
1 answer
96 views

anonymity set (size) for stealth address (receiver)

S1 sends fund to R1 using a stealth addresses. The anonymity set (size) for the receiver (R1) is the size of all possible receivers in the blockchain. Once R1 spends the funds, the anonymity set (size)...
Cisco Mmu's user avatar
  • 161
1 vote
1 answer
75 views

How to get the r value for commitment in mlsag sign

Refer to ZtM2 chp3.5, we can see that in step 5 rπ = α − cπ * kπ (mod l) It's fine for public-key-ring part because there is private key kπ. But what if it is commitment-ring? How to do with no kπ? ...
Mooooo's user avatar
  • 459
1 vote
2 answers
77 views

How to do MLSAG signatures with vin of type 0 (miner)?

Commitments(outPK) are required when doing a MLSAG signature. However, there is no outPK in a type 0 transaction. example What should I do as facing this kind of transactions? I've checked rctSigs....
Mooooo's user avatar
  • 459
1 vote
1 answer
188 views

How to verify MLSAG sign with a real transaction

I'd like to verify a MLSAG signature with a real transaction but it doesn't work.. I chose a transaction 886687fdd30ad46ef1f7c7c18402d82212b4ae1fd2cf6b4dfc549e46be7e22f6 And here is the code written ...
Mooooo's user avatar
  • 459
1 vote
1 answer
87 views

How to get components of m (message) for verifying

I am trying to verify a transaction manually..but not knowing some components of message m. The message is derived from: m = H( H(tx_prefix), H(ss), H(range proofs) ) where tx_prefix = { tx ...
Mooooo's user avatar
  • 459
0 votes
0 answers
85 views

How can I get real inputs from key_offsets? [duplicate]

As I get key_offsets from command "print_tx ... +json", how can I get the real inputs with those numbers? For example, using command below.. print_tx ...
Mooooo's user avatar
  • 459
5 votes
1 answer
211 views

What is Triptych and how does it relate to Monero ring signatures?

Monero Research Lab recently published a research paper on Triptych: https://eprint.iacr.org/2020/018 What is Triptych, and what are its advantages and disadvantages compared to CLSAGs?
sgp's user avatar
  • 8,806
1 vote
1 answer
66 views

Results of scalarmultKey in MiniNero and monero-project are different

I'd like to create LSAG in C and now I need to calculate ciKi as element in L. Then, I try an example with MiniNero like below: K = "210330a31c3caab4087c19fbe770514e5e6b80eda552d1e5f8becabd12c4540e" ...
Mooooo's user avatar
  • 459
1 vote
1 answer
81 views

How does a wallet using a remote node select ring members?

If I'm going to have decoys in my transactions, I need to know about them somehow. How does Monero prevent the remote node I'm connected to from feeding me known ring members, effectively ruining that ...
Dr-Bracket's user avatar
2 votes
1 answer
241 views

Duplicate ring members

A Monero transaction input's ring signature contains a set of one time output keys corresponding to the outputs of some previous transactions. Such a transaction can have multiple inputs, and ...
koe's user avatar
  • 379
1 vote
1 answer
75 views

What are advantages and disadvantages of Monero's privacy features as compared to Bitcoin?

What are the advantages and disadvantages of Monero's privacy features as compared to Bitcoin?
thelma lobo's user avatar
1 vote
1 answer
242 views

How to get the base transaction hash from the blocktemplate_blob [duplicate]

I want to know how to generate different blockhashing_blobs using blocktemplate_blob, returned by the RPC get_block_template method, with different extra fields. To do this, I need to manually ...
Oroffe's user avatar
  • 185
1 vote
1 answer
131 views

Trying to understand how RCTTypeSimple works

We cannot use MLSAG and sign all inputs at once; as all real inputs would need to share the same index. The partial solution is to use a ring signature on each input separately. We need to ensure ...
WeCanBeFriends's user avatar
1 vote
1 answer
93 views

Commitment to zero vs one-time public key signature

After reading 5.6.3 in Zero-To-Monero: https://www.getmonero.org/library/Zero-to-Monero-1-0-0.pdf It seems as if they are saying that we use the commitment to zero to sign the ring with the inputs as ...
WeCanBeFriends's user avatar
1 vote
1 answer
679 views

How does the mixing work?

I have been researching Monero, and I think I understand how ring signatures and stealth addresses work mathematically. However, to create a new ring transaction, you need N peers that want to join ...
user avatar
0 votes
1 answer
261 views

Minimum and maximun number of mixin right now? [duplicate]

Is it a hard rule that there needs to be 11 ring signatures right now for a transaction to take place right now?
Sri davei's user avatar
  • 167
1 vote
2 answers
75 views

How is the number of key images for a transaction selected?

I see that there are a few transactions that have many key images for each of the 11 ring members. But there are also a few with a lesser number of key images. How does this happen?
Sri davei's user avatar
  • 167
4 votes
1 answer
178 views

How is the number of ring members selected?

How is the number of ring members signing a transaction selected? Is it selected randomly by the sender or is it defined by the Monero wallet?
Sri davei's user avatar
  • 167
4 votes
2 answers
191 views

Can any one please tell me where I can find the latest python implementation of monero RingCT?

Mininero is a python implementation of monero. But the git repository is three years old where the latest link does not have any content. Is there any other python implementation of monero where code ...
trijia's user avatar
  • 73
0 votes
1 answer
91 views

Does /get_transaction return ring signatures or key image?

i am trying to use https://www.getmonero.org/resources/developer-guides/daemon-rpc.html#get_transactions To get the signatures.. But i was wondering if they are the correct data or not?
Sri davei's user avatar
  • 167
2 votes
1 answer
188 views

Key Image and Ring Member

When were counting the number of ring signatures for a certain transaction do we count the number of key images or ring members of each key image?
Sri davei's user avatar
  • 167
0 votes
1 answer
176 views

Monero Ring Signature data

Is it possible to get all the data of all the transaction with all its ring signatures using either the monero-wallet or API?
Sri davei's user avatar
  • 167
2 votes
1 answer
65 views

How does signing the hash of the public key show that the signer knew the private key?

I had this previously explained to me, however I do not think I understand it at all. Taken from Maxwell's confidential values: "If a signature is constructed so that the 'message' is the hash of ...
WeCanBeFriends's user avatar
1 vote
1 answer
49 views

What is a scenario when the other members of the ring signature would have multiple keys?

Looking at the algorithm for ring signature, n members of the ring can have m keys associated with them. What is a scenario where the other members, not the signer, would have multiple keys ...
WeCanBeFriends's user avatar
1 vote
1 answer
38 views

Why must each input have a separate set of decoys?

If we have a mixin of 6, with two inputs. We immediately have a total of 6 * 2 = 12 decoys Would it not be secure enough to have the 4 decoys with the two inputs which means two key images? So we ...
WeCanBeFriends's user avatar
1 vote
1 answer
140 views

How does the ring sig work: practical explanation?

Is the following correct?: If I received 5 XMR from Bob, then I wanted to send this 5 XMR to Alice. Would I create a tx with the input as the 5 XMR from Bob with one output as 5 XMR to alice. Then ...
WeCanBeFriends's user avatar
1 vote
1 answer
192 views

How are transactions validated in monero vs bitcoin?

Bitcoin In bitcoin, the signature is a "normal" one and we check it against the signed tx hash. We then check whether the public key/s which signed it, owns the input/s. we then check whether the ...
WeCanBeFriends's user avatar
3 votes
1 answer
291 views

What exactly are bulletproofs replacing in monero?

I am stuck on these questions in understanding bulletproofs: Are bulletproofs a way to hide the sender and the amount? What is the difference between bulletproofs, RingCT and Ring signatures? Edit: ...
WeCanBeFriends's user avatar
2 votes
1 answer
279 views

How do miners verify the Ring Signature of a transaction?

As from I have understood, a Ring Signature is created manipulating the true one time spend key of the sender with some set of keys that are actually "decoys" (precisely some random old keys taken ...
giacom0c's user avatar
  • 187
3 votes
1 answer
213 views

How do ring signatures work when there are multiple UTXOs from which you have to collect monero coin?

User A has 3 UTXOs which sum up to 10 XMR. How does the Key Image ensure that all three utxos cannot be double spent?
user136368's user avatar
1 vote
2 answers
128 views

Can monero include actual spent input as previous transaction output?

Let's take we have two transactions. In the first transaction, it has 1 input with zero mixins and 3 outputs(stealth addresses). The second transaction has 1 input with one mixins and 2 outputs. Here ...
Sajitha Liyanage's user avatar
1 vote
1 answer
53 views

Identifying the *real* public keys of ring signatures

Since a ring signature uses |R-1| decoy outputs for a ring of size R, is it possible to retrieve from them the real (which reveals the true wallet) A,B values from those stealth addresses?
user1387682's user avatar
0 votes
1 answer
191 views

Could a blackballs list be used maliciously?

I do not see any way to trustlessly generate a blackballs database without running full nodes for malicious fork coins, which I do NOT want to do (and don't even have hardware resources to do). ...
rkmv6jph's user avatar