Questions tagged [ring-signatures]

A ring signature is a group of cryptographic signatures with at least one real participant, but there is no way to tell which in the group is the real one as they all appear valid, while the key image prevents double spends.

Filter by
Sorted by
Tagged with
0 votes
0 answers
9 views

How are monero amounts checked? [duplicate]

I am having a hard time understanding the duality of monero obfuscating the amount sent in any transaction, while at the same time making sure no one spends more than they have. As far as I understand,...
user avatar
  • 101
0 votes
1 answer
18 views

How to use custom output when signing?

So let's say I received 2 transactions to my wallet and I want to make a transaction. I want to choose which one's output will be used to sign my transaction. How can I do that?
user avatar
0 votes
0 answers
22 views

How is an input amount proven to be legitimate? [duplicate]

Let's say I received 1 XMR and now have an output for that, but nobody can see that this output is worth 1 XMR but me, right? What is preventing me from using this output as an input for another ...
user avatar
0 votes
1 answer
56 views

Ring signature and key images for dummies?

So I think I understand the Pedersen commitment math on the curve to hide amounts, but I'm struggling to understand how ring signatures obfuscate your transaction even further. If only one set of the ...
user avatar
1 vote
1 answer
43 views

Ring Signatures and the new view tags for fast wallet scanning

Do the new view tags that make wallet scanning faster also make ring signatures less effective? Do all the signatures in any ring produce the same view tag, so that there will end up being 256 ...
user avatar
0 votes
1 answer
40 views

How are the participants of a Ring Signature selected?

If I understand correctly, the participants of a ring signature will be just other outputs. But I don't understand the criteria for selecting those outputs.
user avatar
  • 63
0 votes
1 answer
33 views

In the Ring Signature Process, which one of my keys is used for signing?

I don't get the Ring Signature process. I tried to read about that but I don't understand what is happening in a more technical way. I'm specially confused about which one of my "Public Keys"...
user avatar
  • 63
1 vote
0 answers
41 views

How do I validate the signature of a Monero transaction manually?

I'm trying to figure out how to validate the signature of a Monero transaction manually. I've read this question: How to verify MLSAG sign with a real transaction and I am trying to recreate this ...
user avatar
  • 121
1 vote
1 answer
53 views

How is the data in ringCT used to not identify what transaction is being spent?

So I'm trying to figure out how ringCT works, but with so much data that needs to be used to make a transaction, how does Monero keep transactions from being seen if they are spent or not in ring ...
user avatar
0 votes
1 answer
101 views

Why Monero needs ring signature?

I am looking through the whole Monero privacy system, wondering why Monero needs ring signature? One can use stealth address to protect the identities of both sender and receiver. Suppose the longtime ...
user avatar
  • 133
2 votes
2 answers
44 views

Is a transaction mixin size of 0 the same as not using ring signatures at all?

If I choose a mixin size of 0, is that the same as if ring signatures were not being used at all?
user avatar
  • 133
0 votes
1 answer
74 views

Do ring signatures sometimes leak "X definitely did not pay Y" info?

I'm trying to understand how privacy in Monero compares to shielded transactions in Zcash. I understand that with Zcash's zk-Snarks, there's no information about sender, receiver or amount. I think I ...
user avatar
0 votes
1 answer
64 views

What is the logic behind multiexp method in bulletproof Monero implementation

Could anybody explain the logic behind multiexp method in the bulletproof Monero implementation. Source code: https://github.com/monero-project/monero/blob/v0.17.1.9/src/ringct/bulletproofs.cc#L85-L94
user avatar
0 votes
0 answers
45 views

Ever thought to improve MLSAG with a RANDOM index for actual UTXO on each level?

As far as I have understood, a unique MLSAG wasn't used in transactions with multiple input UTXOs because of information leakage risk due to the unique index of actual, not decoys UTXOs. I know that's ...
user avatar
  • 1
1 vote
2 answers
178 views

What's the difference between ring signatures and RingCT

Because Monero has been updated over the years, some of the documentation about Monero no longer applies in the current version. As a result, I am not sure if the information i read is outdated. ...
user avatar
  • 11
2 votes
1 answer
304 views

Estimating anonymity set size?

Is there any way to at least estimate what kind of anonymity set a user would have after churning Monero X times assuming the anonymity set of each individual transaction is the ringsize (i.e. there ...
user avatar
0 votes
1 answer
77 views

anonymity set (size) for stealth address (receiver)

S1 sends fund to R1 using a stealth addresses. The anonymity set (size) for the receiver (R1) is the size of all possible receivers in the blockchain. Once R1 spends the funds, the anonymity set (size)...
user avatar
  • 141
1 vote
1 answer
70 views

How to get the r value for commitment in mlsag sign

Refer to ZtM2 chp3.5, we can see that in step 5 rπ = α − cπ * kπ (mod l) It's fine for public-key-ring part because there is private key kπ. But what if it is commitment-ring? How to do with no kπ? ...
user avatar
  • 459
1 vote
2 answers
60 views

How to do MLSAG signatures with vin of type 0 (miner)?

Commitments(outPK) are required when doing a MLSAG signature. However, there is no outPK in a type 0 transaction. example What should I do as facing this kind of transactions? I've checked rctSigs....
user avatar
  • 459
1 vote
1 answer
179 views

How to verify MLSAG sign with a real transaction

I'd like to verify a MLSAG signature with a real transaction but it doesn't work.. I chose a transaction 886687fdd30ad46ef1f7c7c18402d82212b4ae1fd2cf6b4dfc549e46be7e22f6 And here is the code written ...
user avatar
  • 459
1 vote
1 answer
80 views

How to get components of m (message) for verifying

I am trying to verify a transaction manually..but not knowing some components of message m. The message is derived from: m = H( H(tx_prefix), H(ss), H(range proofs) ) where tx_prefix = { tx ...
user avatar
  • 459
0 votes
0 answers
51 views

How can I get real inputs from key_offsets? [duplicate]

As I get key_offsets from command "print_tx ... +json", how can I get the real inputs with those numbers? For example, using command below.. print_tx ...
user avatar
  • 459
5 votes
1 answer
174 views

What is Triptych and how does it relate to Monero ring signatures?

Monero Research Lab recently published a research paper on Triptych: https://eprint.iacr.org/2020/018 What is Triptych, and what are its advantages and disadvantages compared to CLSAGs?
user avatar
  • 8,704
1 vote
1 answer
61 views

Results of scalarmultKey in MiniNero and monero-project are different

I'd like to create LSAG in C and now I need to calculate ciKi as element in L. Then, I try an example with MiniNero like below: K = "210330a31c3caab4087c19fbe770514e5e6b80eda552d1e5f8becabd12c4540e" ...
user avatar
  • 459
1 vote
1 answer
62 views

How does a wallet using a remote node select ring members?

If I'm going to have decoys in my transactions, I need to know about them somehow. How does Monero prevent the remote node I'm connected to from feeding me known ring members, effectively ruining that ...
user avatar
2 votes
1 answer
228 views

Duplicate ring members

A Monero transaction input's ring signature contains a set of one time output keys corresponding to the outputs of some previous transactions. Such a transaction can have multiple inputs, and ...
user avatar
  • 359
1 vote
1 answer
68 views

What are advantages and disadvantages of Monero's privacy features as compared to Bitcoin?

What are the advantages and disadvantages of Monero's privacy features as compared to Bitcoin?
user avatar
1 vote
1 answer
196 views

How to get the base transaction hash from the blocktemplate_blob [duplicate]

I want to know how to generate different blockhashing_blobs using blocktemplate_blob, returned by the RPC get_block_template method, with different extra fields. To do this, I need to manually ...
user avatar
  • 85
1 vote
1 answer
106 views

Trying to understand how RCTTypeSimple works

We cannot use MLSAG and sign all inputs at once; as all real inputs would need to share the same index. The partial solution is to use a ring signature on each input separately. We need to ensure ...
user avatar
1 vote
1 answer
79 views

Commitment to zero vs one-time public key signature

After reading 5.6.3 in Zero-To-Monero: https://www.getmonero.org/library/Zero-to-Monero-1-0-0.pdf It seems as if they are saying that we use the commitment to zero to sign the ring with the inputs as ...
user avatar
1 vote
1 answer
579 views

How does the mixing work?

I have been researching Monero, and I think I understand how ring signatures and stealth addresses work mathematically. However, to create a new ring transaction, you need N peers that want to join ...
user avatar
0 votes
1 answer
219 views

Minimum and maximun number of mixin right now? [duplicate]

Is it a hard rule that there needs to be 11 ring signatures right now for a transaction to take place right now?
user avatar
  • 167
1 vote
2 answers
67 views

How is the number of key images for a transaction selected?

I see that there are a few transactions that have many key images for each of the 11 ring members. But there are also a few with a lesser number of key images. How does this happen?
user avatar
  • 167
4 votes
1 answer
160 views

How is the number of ring members selected?

How is the number of ring members signing a transaction selected? Is it selected randomly by the sender or is it defined by the Monero wallet?
user avatar
  • 167
4 votes
2 answers
163 views

Can any one please tell me where I can find the latest python implementation of monero RingCT?

Mininero is a python implementation of monero. But the git repository is three years old where the latest link does not have any content. Is there any other python implementation of monero where code ...
user avatar
  • 73
0 votes
1 answer
80 views

Does /get_transaction return ring signatures or key image?

i am trying to use https://www.getmonero.org/resources/developer-guides/daemon-rpc.html#get_transactions To get the signatures.. But i was wondering if they are the correct data or not?
user avatar
  • 167
2 votes
1 answer
169 views

Key Image and Ring Member

When were counting the number of ring signatures for a certain transaction do we count the number of key images or ring members of each key image?
user avatar
  • 167
0 votes
1 answer
165 views

Monero Ring Signature data

Is it possible to get all the data of all the transaction with all its ring signatures using either the monero-wallet or API?
user avatar
  • 167
2 votes
1 answer
61 views

How does signing the hash of the public key show that the signer knew the private key?

I had this previously explained to me, however I do not think I understand it at all. Taken from Maxwell's confidential values: "If a signature is constructed so that the 'message' is the hash of ...
user avatar
1 vote
1 answer
44 views

What is a scenario when the other members of the ring signature would have multiple keys?

Looking at the algorithm for ring signature, n members of the ring can have m keys associated with them. What is a scenario where the other members, not the signer, would have multiple keys ...
user avatar
1 vote
1 answer
32 views

Why must each input have a separate set of decoys?

If we have a mixin of 6, with two inputs. We immediately have a total of 6 * 2 = 12 decoys Would it not be secure enough to have the 4 decoys with the two inputs which means two key images? So we ...
user avatar
1 vote
1 answer
126 views

How does the ring sig work: practical explanation?

Is the following correct?: If I received 5 XMR from Bob, then I wanted to send this 5 XMR to Alice. Would I create a tx with the input as the 5 XMR from Bob with one output as 5 XMR to alice. Then ...
user avatar
1 vote
1 answer
173 views

How are transactions validated in monero vs bitcoin?

Bitcoin In bitcoin, the signature is a "normal" one and we check it against the signed tx hash. We then check whether the public key/s which signed it, owns the input/s. we then check whether the ...
user avatar
3 votes
1 answer
271 views

What exactly are bulletproofs replacing in monero?

I am stuck on these questions in understanding bulletproofs: Are bulletproofs a way to hide the sender and the amount? What is the difference between bulletproofs, RingCT and Ring signatures? Edit: ...
user avatar
2 votes
1 answer
238 views

How do miners verify the Ring Signature of a transaction?

As from I have understood, a Ring Signature is created manipulating the true one time spend key of the sender with some set of keys that are actually "decoys" (precisely some random old keys taken ...
user avatar
  • 187
3 votes
1 answer
200 views

How do ring signatures work when there are multiple UTXOs from which you have to collect monero coin?

User A has 3 UTXOs which sum up to 10 XMR. How does the Key Image ensure that all three utxos cannot be double spent?
user avatar
1 vote
2 answers
106 views

Can monero include actual spent input as previous transaction output?

Let's take we have two transactions. In the first transaction, it has 1 input with zero mixins and 3 outputs(stealth addresses). The second transaction has 1 input with one mixins and 2 outputs. Here ...
user avatar
1 vote
1 answer
48 views

Identifying the *real* public keys of ring signatures

Since a ring signature uses |R-1| decoy outputs for a ring of size R, is it possible to retrieve from them the real (which reveals the true wallet) A,B values from those stealth addresses?
user avatar
0 votes
1 answer
160 views

Could a blackballs list be used maliciously?

I do not see any way to trustlessly generate a blackballs database without running full nodes for malicious fork coins, which I do NOT want to do (and don't even have hardware resources to do). ...
user avatar
2 votes
1 answer
101 views

How does key images work when you create a transaction using two or more of your previously unspent transaction outputs?

I've read key images are the critical element in Monero to avoid double spends. I think I understand how it works when you are using only one of your previously unspent transaction outputs to create ...
user avatar
  • 23