Questions tagged [ringct]
New protocol designed by the Monero Research Labs combining ring signatures from CryptoNote with Confidential transactions. RingCT transactions are not only untraceable (ring signature) but also keep the transaction amount private (confidential transaction).
167
questions
0
votes
0
answers
13
views
What is the message which is signed in Monero Signature?
As per "Algorithm 1" described on Page 6 in MRL-0003, there is something named "prefix" which is signed.
As per MRL-0005 -Ring Signature Confidential Transactions, Transaction ...
- 51
0
votes
0
answers
32
views
Any known implementation of Monero MPC mutlisigs?
I am looking for a whitepaper/science doc/source code that explains/implements MPC multisig for Monero.
Would appreciate any piece of inforamtion
- 101
0
votes
1
answer
124
views
Is XMR private to Wallet Providers?
If XMR Wallet Providers kept logs, would they be able to identify the amount of transactions and the addresses involved in transactions? Do compromised Wallet Providers pose a risk to XMR privacy and ...
0
votes
1
answer
195
views
Ring signature and key images for dummies?
So I think I understand the Pedersen commitment math on the curve to hide amounts, but I'm struggling to understand how ring signatures obfuscate your transaction even further.
If only one set of the ...
1
vote
0
answers
44
views
Use range proofs to make fees proportional to amounts in transactions
For what I could understand, reading a bit about the use of Bulletproof in Monero, it is used to prove that the amounts in the transaction are between 0 and 2^N-1, where N is the number of bits, ...
- 113
1
vote
1
answer
85
views
How input pseudo-commitments are calculated?
I was reading Zero to Monero and other posts about this and I understand why do we need pseudo-commitment: they are just commitments of inputs' hidden amounts.
The thing that I don't get is how the ...
- 63
1
vote
1
answer
68
views
How is the data in ringCT used to not identify what transaction is being spent?
So I'm trying to figure out how ringCT works, but with so much data that needs to be used to make a transaction, how does Monero keep transactions from being seen if they are spent or not in ring ...
- 11
2
votes
1
answer
83
views
Why are rangeproofs necessary?
Title. This is probably a remarkably stupid question, but I digress. Now, I understand the point of rangeproofs, but I don't understand why they're actually necessary.
So, rangeproofs prevent a ...
0
votes
1
answer
83
views
What is the logic behind multiexp method in bulletproof Monero implementation
Could anybody explain the logic behind multiexp method in the bulletproof Monero implementation.
Source code: https://github.com/monero-project/monero/blob/v0.17.1.9/src/ringct/bulletproofs.cc#L85-L94
- 101
1
vote
2
answers
301
views
What's the difference between ring signatures and RingCT
Because Monero has been updated over the years, some of the documentation about Monero no longer applies in the current version. As a result, I am not sure if the information i read is outdated.
...
- 11
1
vote
1
answer
59
views
How to compute ringct multisignature key images? (Disambiguation of MRL005)
I'm looking at the multisignature scheme provided by MRL005 Section 4.4, and some things are unclear to me. I've attached a picture below of the expression for which I'm seeking some clarification.
...
- 13
0
votes
0
answers
72
views
Build RCT for new(?) format
I'm trying to build a Monero transaction using the mymonero-core library. So far I've been following the code from the tests, however I'm not quite sure what to do with the "rct" part of the previous ...
- 111
2
votes
1
answer
76
views
Calculate the output amount using MiniNero
Referring to the question 11272, I have an experiment with MiniNero:
tx_pub_key = "f6d51a0cabd6a68f2c4960bc06b4132d6b937622b8954ea95851aa5f3b32c1de"
pri_view_key = "...
- 459
2
votes
1
answer
160
views
How to distinguish between the amount of the real input amount and the decoys
Since every transaction has multiple decoys from previous transactions that are connected to it (while only one is real), how does the user link the amount that is linked to the "real" transaction?
...
- 21
2
votes
1
answer
111
views
Why is a key image xHp(P), and not something simpler like Hs(x)?
I understand how ringCTs work and know that they require a key image of the private key of the input that is actually being spent. How is this created? Couldn’t you just hash the private key of the ...
- 123
0
votes
0
answers
96
views
Understanding a security proof of RingCT 3.0
I am reading the paper "RingCT 3.0 for Blockchain Confidential Transaction:
Shorter Size and Stronger Security" (https://eprint.iacr.org/2019/508.pdf), an improvement to Ring Confidential Transactions....
- 113
2
votes
1
answer
104
views
RingCT: What happens if accidentially decoy "Input + Output" sum up to 0?
In Ring CT the validattors check whether there is one combination of "Output + Input", that sums up to zero. What happens if "Real-Input + Output" does not sum up to zero, but accidentally some other ...
- 21
0
votes
1
answer
124
views
RingCT 3.0 in Monero
Is there a plan to transfer Monero to RingCT 3.0 (https://eprint.iacr.org/2019/508.pdf)?
Is there any (test) implementation of RingCT 3.0 in computer code or at least parts of it?
The authors' ...
- 1
2
votes
2
answers
168
views
Will Chained Mempool Transactions ever be possible?
If Monero gets large enough Ring Sizes to include potentially unconfirmed inputs, would chained transactions be possible?
Chained Mempool Transactions in Bitcoin allow unconfirmed inputs to be ...
- 493
1
vote
1
answer
58
views
Why do we have MLSAG when we only need two keys?
If I understand correctly, MLSAG is being used only when we have two keys. Is it being used in other places when we have maybe three or more keys?
To clarify, by two keys I mean we are trying to ...
- 660
1
vote
1
answer
114
views
What is the difference between tx version 1 and RingCT version 2?
What were the changes from version 1 to version 2?
I think that version 1, did not have confidential txs, but was still based on cryptonote?
I'm also guessing that in version 1, we did not have ...
- 660
2
votes
1
answer
45
views
How does a Monero node know to reject Borromean range proofs
Now that Bulletproofs have been deployed, how does a Monero node know to reject any Borromean range proofs?
Is there something like a checkpoint, so that after block N, no more Borromean range proofs ...
- 660
1
vote
1
answer
131
views
Why are there 4 types of range proofs in the Monero code base?
In the code, there is this:
enum RangeProofType { RangeProofBorromean, RangeProofBulletproof, RangeProofMultiOutputBulletproof, RangeProofPaddedBulletproof };
[source]
I believe:
...
- 660
1
vote
1
answer
78
views
What is the difference between RCTTypeBulletproof and RCTTypeBulletProof2?
There seems to be two types of bulletproof transactions in monero, was there maybe a bug in the first one?
- 660
1
vote
1
answer
93
views
Are Monero transaction types versioned?
For example, we have RCTTypeNull, RCTTypeSimple and RCTTypeFull.
If I were to make a change that was not backwards compatible to RCTTypeSimple, is this versioned in some way, or is another type of tx ...
- 660
1
vote
1
answer
96
views
How does a wallet check when their output has been spent from the keyimage shown in a tx?
How does the wallet check against the key image in a tx that it was them that spent it, given the private/public view and private/public spend?
- 660
1
vote
1
answer
60
views
How can we be sure that there is no bias in calculating H?
To get H we hash G using keccak, interpret the result as a compressed Ed25519 point, then multiply by 8 to ensure the point is in the subgroup of the base point G.
How can we be sure there is no bias ...
- 660
5
votes
1
answer
302
views
Where is the encrypted mask value?
Checked this link: https://moneroblocks.info/api/get_transaction_data/4adb55cde1ffcc0ea639b6718355c48c0e574000306d95ef857e55d91ddabcf2
I could not find the encrypted mask value.
I believe the ...
- 660
1
vote
1
answer
253
views
How to get the base transaction hash from the blocktemplate_blob [duplicate]
I want to know how to generate different blockhashing_blobs using blocktemplate_blob, returned by the RPC get_block_template method, with different extra fields. To do this, I need to manually ...
- 185
3
votes
2
answers
348
views
Should Monero use ElGamal commitments instead of Pedersen commitments?
Following on from the Q/A
regarding "perfectly hiding and computationally binding" commitments, it is
mentioned ElGamal commitments can be used to flip the commitment properties to
become "perfectly ...
- 19.2k
4
votes
2
answers
475
views
What is the impact of having perfectly hidden but only computationally bound commitments?
Monero uses Pedersen commitments to make transaction amounts private (hidden), but what, if any, are the problems of perfectly hidden and computationally binding commitments?
- 19.2k
2
votes
1
answer
124
views
How is there no key image for the commitment to zero in MLSAG?
zero to monero 5.7.2 mentions there not being a key image for the commitment to zero. How is this possible?
Quote: "Recalling Section 5.6.3, there is no key image for the commitments to zero zjG, and ...
- 660
1
vote
3
answers
98
views
What would the space saving difference be if MLSAG was applied over all inputs?
Currently, MLSAG is being applied to each real input, giving one signature per real input. What would the space savings be if it was applied over all real inputs, giving one signature per transaction?
...
- 660
2
votes
1
answer
109
views
Key image forgery
Given a keypair (k,K); the key image is calculated as:
KeyImage = k * H(K)
What is stopping someone from giving a fake K in the hash function?
- 660
2
votes
1
answer
81
views
Different MLSAG implementations across papers
In MRL005, See page9, they describe the signing key for a given ring as Sum public keys + SumInputs - SumOutputs
In zero to monero, Page49 section "MLSAG signature for inputs", they describe it as ...
- 660
1
vote
1
answer
95
views
Why not use bLSAG for one input instead of MLSAG?
AFAIK MLSAG is being used for one input because of a privacy problem. Why not just use bLSAG, since in the MRL005 it says that MLSAG is better once we have > 1 sets of keys.
- 660
1
vote
1
answer
86
views
Relationship between pseudoOuts and Real outputs
For each real input, we have a pseduoOut which is commitment to the same amount as the real input. We can therefore subtract the realInputCommitment from the pseudoOut and prove that it is a ...
- 660
1
vote
1
answer
133
views
Trying to understand how RCTTypeSimple works
We cannot use MLSAG and sign all inputs at once; as all real inputs would need to share the same index.
The partial solution is to use a ring signature on each input separately.
We need to ensure ...
- 660
1
vote
1
answer
75
views
What is the significance of monero switching the G and H points in a Pedersen commitment?
Conventionally G is used to denote the standard Generator.
H is then some point whereby the discrete log is not known with respects to G; H = yG where y is unknown.
A pedersen commitment would ...
- 660
1
vote
1
answer
93
views
Commitment to zero vs one-time public key signature
After reading 5.6.3 in Zero-To-Monero: https://www.getmonero.org/library/Zero-to-Monero-1-0-0.pdf
It seems as if they are saying that we use the commitment to zero to sign the ring with the inputs as ...
- 660
2
votes
1
answer
143
views
How does commitment to zero work?
Given two inputs each with their respective committed amounts; P1, P2.
Then given two outputs each with their own respective committed amounts; P3, P4.
We want to prove that the inputs - outputs - ...
- 660
0
votes
0
answers
34
views
Unable to send coins from freshly forked monero [duplicate]
I have forked Monero, made all the config level changes and start the daemon with v9. All nodes are synced perfectly, but when I try to send coins from wallet-cli I am getting the below error:
Error: ...
1
vote
1
answer
363
views
Error: not enough outputs for specified ring size = 11
I am trying to fork monero release-v0.13. I have made changes to the cryptonote_config file and I built and ran the daemon. Everything seems to be fine, nodes are syncing, mining is happening. But ...
1
vote
1
answer
689
views
How does the mixing work?
I have been researching Monero, and I think I understand how ring signatures and stealth addresses work mathematically.
However, to create a new ring transaction, you need N peers that want to join ...
user9634
6
votes
1
answer
192
views
How was the generator H for the RingCT scheme chosen?
I'm reading the RingCT whitepaper by Shen Noether. The scheme requires a second random generator H such that its discrete logarithm w.r.t. G is not known. Paragraph 3.2 suggests two variants to ...
0
votes
1
answer
264
views
Minimum and maximun number of mixin right now? [duplicate]
Is it a hard rule that there needs to be 11 ring signatures right now for a transaction to take place right now?
- 167
4
votes
1
answer
180
views
How is the number of ring members selected?
How is the number of ring members signing a transaction selected? Is it selected randomly by the sender or is it defined by the Monero wallet?
- 167
1
vote
1
answer
88
views
What is the block height from which RingCT was implemented?
Can we know the block height from which the ring signatures were implemented. Because i read few blocks which are pre-ring signature blocks where I see there are ring members repeating for a single ...
4
votes
2
answers
437
views
How is the used Pedersen commitment kept secret?
I understand one can have two commitments P and Q, and show the world that P - Q = 0 - communicating the commitment to only the recipient. In fact, it can be done with many input commitments P1 ... Pn....
0
votes
1
answer
64
views
If the Monero started with rCT, would it be needed to have any part of the codebase handling dust?
I mean there is so much code in Monero handling situation that involve any dust.
Is it just for backward compatibility or would it be needed even if the Monero started with rCT?
I know about 2 types ...
- 117