Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [ringct]

New protocol designed by the Monero Research Labs combining ring signatures from CryptoNote with Confidential transactions. RingCT transactions are not only untraceable (ring signature) but also keep the transaction amount private (confidential transaction).

0
votes
0answers
17 views

Unable to send coins from freshly forked monero [duplicate]

I have forked Monero, made all the config level changes and start the daemon with v9. All nodes are synced perfectly, but when I try to send coins from wallet-cli I am getting the below error: Error: ...
0
votes
1answer
37 views

Error: not enough outputs for specified ring size = 11

I am trying to fork monero release-v0.13. I have made changes to the cryptonote_config file and I built and ran the daemon. Everything seems to be fine, nodes are syncing, mining is happening. But ...
1
vote
1answer
38 views

How does the mixing work?

I have been researching Monero, and I think I understand how ring signatures and stealth addresses work mathematically. However, to create a new ring transaction, you need N peers that want to join ...
4
votes
1answer
59 views

How was the generator H for the RingCT scheme chosen?

I'm reading the RingCT whitepaper by Shen Noether. The scheme requires a second random generator H such that its discrete logarithm w.r.t. G is not known. Paragraph 3.2 suggests two variants to ...
0
votes
1answer
29 views

Minimum and maximun number of mixin right now? [duplicate]

Is it a hard rule that there needs to be 11 ring signatures right now for a transaction to take place right now?
4
votes
1answer
49 views

How is the number of ring members selected?

How is the number of ring members signing a transaction selected? Is it selected randomly by the sender or is it defined by the Monero wallet?
1
vote
1answer
27 views

What is the block height from which RingCT was implemented?

Can we know the block height from which the ring signatures were implemented. Because i read few blocks which are pre-ring signature blocks where I see there are ring members repeating for a single ...
4
votes
2answers
80 views

How is the used Pedersen commitment kept secret?

I understand one can have two commitments P and Q, and show the world that P - Q = 0 - communicating the commitment to only the recipient. In fact, it can be done with many input commitments P1 ... Pn....
0
votes
1answer
40 views

If the Monero started with rCT, would it be needed to have any part of the codebase handling dust?

I mean there is so much code in Monero handling situation that involve any dust. Is it just for backward compatibility or would it be needed even if the Monero started with rCT? I know about 2 types ...
1
vote
1answer
34 views

RingCt Is It Less Safe to Send the Whole Amount

state 1 Initial positions: A: 5.0032 B: 3.0000 C: 3.2000 ... state 2 G:5.0032 H:2.0000 I:1.0000 J:2.0000 K:1.2000 Let's assume A -> G B -> H,I C -> J,K I get you cannot tell for ...
1
vote
1answer
21 views

Why do we use different H values in a vector Pedersen Commitment?

The usual Pedersen Commitment looks like such: C = xG + aH Where x and a are scalars. However, we can also commit vectors, s.t. C = xG + (a_1 * H_1 + a_2 * H_2) Could anyone point out why we ...
1
vote
1answer
41 views

How would I exploit the fact that I knew the scalar used for H in the Pedersons Commitment w.r.t G?

If H was badly chosen for the Pederson Commitment, such that the attacker knew a k where H = kG (1) What damage could be done to the system? We know that C = aH + bG If I commit a = 10 and b = 2 ...
2
votes
1answer
58 views

How does having a negative number in a Pedersen commitment, create money out of thin air?

Given two inputs of value: 10, 11 And two outputs of value 31, -10 The Pedersen commitment would look like: Let b + c - d - e = k (10G + bH + 11G + cH) - (31G + dH + -10G + eH) = 0G + kH Without ...
1
vote
1answer
33 views

How do I find the value behind the pederson commitment?

Given that I have found a tx that is for me, what would be the maths to find out how much I have received?
2
votes
1answer
39 views

How does signing the hash of the public key show that the signer knew the private key?

I had this previously explained to me, however I do not think I understand it at all. Taken from Maxwell's confidential values: "If a signature is constructed so that the 'message' is the hash of ...
1
vote
1answer
22 views

Why must each input have a separate set of decoys?

If we have a mixin of 6, with two inputs. We immediately have a total of 6 * 2 = 12 decoys Would it not be secure enough to have the 4 decoys with the two inputs which means two key images? So we ...
1
vote
1answer
52 views

How does the ring sig work: practical explanation?

Is the following correct?: If I received 5 XMR from Bob, then I wanted to send this 5 XMR to Alice. Would I create a tx with the input as the 5 XMR from Bob with one output as 5 XMR to alice. Then ...
1
vote
1answer
53 views

How are transactions validated in monero vs bitcoin?

Bitcoin In bitcoin, the signature is a "normal" one and we check it against the signed tx hash. We then check whether the public key/s which signed it, owns the input/s. we then check whether the ...
1
vote
1answer
86 views

The entire lifecycle of an XMR transaction with RingCT

I'm trying to understand the data structure in monerod and create a simple workflow for a transaction's life cycle. It doesn't look like this has been done post-RingCT activation, and I see a lot of ...
3
votes
1answer
135 views

What exactly are bulletproofs replacing in monero?

I am stuck on these questions in understanding bulletproofs: Are bulletproofs a way to hide the sender and the amount? What is the difference between bulletproofs, RingCT and Ring signatures? Edit: ...
3
votes
1answer
36 views

Where can I find the selection of the decoys (stealthy addresses) when constructing a transaction?

When constructing a new transaction, I have reached the function cryptonote_core/cryptonote_tx_utils.cpp/construct_tx_with_tx_key() and I am trying to understand where the decoys came from? How and ...
3
votes
1answer
78 views

How do ring signatures work when there are multiple UTXOs from which you have to collect monero coin?

User A has 3 UTXOs which sum up to 10 XMR. How does the Key Image ensure that all three utxos cannot be double spent?
2
votes
2answers
62 views

Cannot get version 2 transactions to work on private testnet

I built Monero private testnet (basically used these instructions https://github.com/moneroexamples/private-testnet, but with the latest codebase). Everything seemed to work fine, but I realized that ...
3
votes
1answer
100 views

How can I choose addresses to create a ring signature for a transaction

I am doing a project based on blockchain, and I found that Monero is a good candidate for my project because of its ring signature scheme. The scenario is that I would like to create a transaction ...
3
votes
1answer
110 views

What are Ring Members?

So as I understand, ring members are decoy outputs on the XMR Blockchain. Are these outputs originially public addresses (like in the BTC Chain) but have been hidden somehow? How have they been hidden?...
5
votes
2answers
230 views

Understanding MLSAG in Monero transaction

This is a followup question to Understanding the structure of Monero transaction with emphasis on the MLSAG part. Here's the transaction's structure again given with print_tx ...
3
votes
0answers
71 views

Non RingCT transactions since RingCT mandatory

RingCT is mandatory since block 1400000, yet there are 95 non ringct transactions since that block and block 1500000. User iDunk on IRC suggested that this could be the result of the command ...
1
vote
2answers
1k views

How does Ring Confidential Transactions work?

Can someone explain to me how RingCT works and how the recipient gets the actual amount from the encrypted amount in a RingCT transaction?
2
votes
2answers
84 views

How the sender recover the transactions that he spent?

In order to compute the balance of his own wallet, (I assume that) a client needs to retrieve: 1- The transaction that he is the receiver.(By scanning the whole block-chain and compare with his own ...
6
votes
1answer
198 views

Transaction structure: Question about ecdhInfo

This question by kenshi84 shows how the pseudoOuts and outPk fields can be validated by anyone (without knowing any of the private keys involved), by checking that sumIn === sumOut: > var H = ...
3
votes
0answers
211 views

ZK-STARK vs ring-ct size and verification

How does the transaction size of ZK-STARK transactions compare with ring-CT? Also I understand it requires a lot of ram and computing power to create a ZK-STARK, does it take the same amount of ram ...
5
votes
1answer
187 views

Would a fixed ring size improve anonymity?

Currently the ring size of a transaction can be set by the sender. One would think that using a ring size of 10 makes the transaction more anonymous than using a ring size of 5 (current default) as ...
4
votes
0answers
77 views

MLSAG adaptation?

I understand that the main reason why the RCTTypeFull scheme is not applied to multi-input transactions is that the true signing keys in the MLSAG algorithm are on the same row, which impacts ...
1
vote
1answer
84 views

Commitments for RCTTypeSimple transactions

Looking at the code, and after reading a post on the subject, it looks as if transactions of type RCTTypeSimple (multi-input, RCT) get new commitments with new blinding factors for the inputs. Doesn'...
16
votes
1answer
3k views

What are bulletproofs?

I have heard that Monero transactions are relatively large, and that Bulletproofs will make Monero transactions smaller. Can someone give a high-level overview about what these are, and how they ...
4
votes
1answer
141 views

How Ed25519 curve relates to Borromean Ring Signature scheme?

Is it correct to say that Monero private keys are generated using Ed25519 curve and then Borromean Ring Signature scheme is used to sign transactions? In other words, is Ed25519 curve "compatible" ...
1
vote
1answer
54 views

Additional keys/commitments for MLSAG

There is one thing I don't understand about the MLSAG signature. The additional public keys mixed into the signature ring, must correspond to real unspent outputs in the blockchain, isn't it? ...
9
votes
1answer
482 views

Are Confidential Transactions in Monero perfectly binding or hiding?

Bitcoin contributor Pieter Wuille recently commented on Reddit: Bulletproofs and the Pedersen commitments they operate on are perfectly hiding, but not perfectly binding. This roughly means that ...
3
votes
2answers
255 views

Confused about the RingCT protocol

I'm a newcomer. I'm a bit confused about the current protocol and I don't quite feel like reading the code yet. I've been reading Shen Noether's paper as well as related work. (1) I understand that ...
1
vote
0answers
85 views

“Error: One of the destinations is zero” on Monero CLI wallet when trying to send a transaction with >6000 ring signatures?

I wanna do 7500 ring CTs on my transaction but I keep getting that error. Anyone know a work-around? Also when I lower it to 5000 ring CTs I get "Error: failed to find a suitable way to split ...
3
votes
2answers
140 views

Maximizing privacy when dealing with pre RingCT outputs

When spending from a cold storage wallet with multiple pre RingCT (and no post RingCT) outputs what are the best privacy practices? Spending in this context means the eventual moving of these funds ...
1
vote
1answer
88 views

How do you make sure a sender isn't sending bogus funds?

It is my understanding that RingCT allows the verifier to make sure that the sum of the inputs is the same as the sum of the outputs in a transaction, so that no monero is magically created or lost. ...
1
vote
0answers
51 views

Borromean signatures in monero commiting to an empty string?

In the codebase, the Borromean signatures to reduce the size of range proofs seem to sign an empty string,which is different from the paper by Maxwell et al. Is it true? Thanks for any answer.
14
votes
1answer
2k views

What is StringCT?

I saw some recent comments about RuffCT/StringCT, which is a supposed improvement to RingCT. What is RuffCT/StringCT, and how is it different than RingCT? What improvements (if any) will this bring to ...
1
vote
2answers
188 views

How to sweep the contents of a specific output?

I noticed that the sweep_all command warns when it is about to merge outputs from the same transaction, which I appreciate, as that would kind of break the point of ring signatures and make my ...
4
votes
2answers
147 views

Is the 'pseudoOuts' of 'rctSig' the commitment on input amounts for simple RCT

It seems that the genRctSimple function will make a different input commitment for each input amount (line 675-683 in file src/rct/rctSigs.cpp). And summation of these input commitments = output ...
4
votes
0answers
88 views

How does RingCT work? [duplicate]

How does RingCT work in hiding transaction amounts and how can it ensure that an output with 3 monero is used in a transaction with outputs of 1 and 2 monero but not 2 and 2?
2
votes
1answer
340 views

Is it possible to reset the blockchain with a new genesis block for efficiency?

I am researching state prunning, and I saw here that AEON state prunning does helps a bit, with some issues though because of historical reasons (details in the link). Would it be possible to reset ...
6
votes
3answers
393 views

How does RingCT work with / without coefficients?

I was trying to get more information on how RingCT works, I found the thread I linked to below here on the stack exchange. In the other thread, the most upvoted answer explains it as a coefficient, ...
7
votes
1answer
153 views

Will a large and sustained increase in Monero transactions resolve the current issues of the dynamic block size penalty function?

The fee algorithm has not readjusted as intended following the dramatic increase in median transaction size which came with the upgrade to RingCT transactions. A conclusion reached on the subject has ...