Questions tagged [ringct]

New protocol designed by the Monero Research Labs combining ring signatures from CryptoNote with Confidential transactions. RingCT transactions are not only untraceable (ring signature) but also keep the transaction amount private (confidential transaction).

Filter by
Sorted by
Tagged with
1
vote
1answer
25 views

Why do we have MLSAG when we only need two keys?

If I understand correctly, MLSAG is being used only when we have two keys. Is it being used in other places when we have maybe three or more keys? To clarify, by two keys I mean we are trying to ...
1
vote
1answer
15 views

What is the difference between tx version 1 and RingCT version 2?

What were the changes from version 1 to version 2? I think that version 1, did not have confidential txs, but was still based on cryptonote? I'm also guessing that in version 1, we did not have ...
1
vote
1answer
25 views

Are Monero transaction types versioned?

For example, we have RCTTypeNull, RCTTypeSimple and RCTTypeFull. If I were to make a change that was not backwards compatible to RCTTypeSimple, is this versioned in some way, or is another type of tx ...
1
vote
1answer
19 views

Why are there 4 types of range proofs in the Monero code base?

In the code, there is this: enum RangeProofType { RangeProofBorromean, RangeProofBulletproof, RangeProofMultiOutputBulletproof, RangeProofPaddedBulletproof }; [source] I believe: ...
2
votes
1answer
21 views

How does a Monero node know to reject Borromean range proofs

Now that Bulletproofs have been deployed, how does a Monero node know to reject any Borromean range proofs? Is there something like a checkpoint, so that after block N, no more Borromean range proofs ...
1
vote
1answer
19 views

What is the difference between RCTTypeBulletproof and RCTTypeBulletProof2?

There seems to be two types of bulletproof transactions in monero, was there maybe a bug in the first one?
1
vote
1answer
41 views

How does a wallet check when their output has been spent from the keyimage shown in a tx?

How does the wallet check against the key image in a tx that it was them that spent it, given the private/public view and private/public spend?
4
votes
2answers
124 views

What is the impact of having perfectly hidden but only computationally bound commitments?

Monero uses Pedersen commitments to make transaction amounts private (hidden), but what, if any, are the problems of perfectly hidden and computationally binding commitments?
1
vote
1answer
28 views

How can we be sure that there is no bias in calculating H?

To get H we hash G using keccak, interpret the result as a compressed Ed25519 point, then multiply by 8 to ensure the point is in the subgroup of the base point G. How can we be sure there is no bias ...
4
votes
1answer
124 views

Where is the encrypted mask value?

Checked this link: https://moneroblocks.info/api/get_transaction_data/4adb55cde1ffcc0ea639b6718355c48c0e574000306d95ef857e55d91ddabcf2 I could not find the encrypted mask value. I believe the ...
0
votes
1answer
46 views

How to get the base transaction hash from the blocktemplate_blob [duplicate]

I want to know how to generate different blockhashing_blobs using blocktemplate_blob, returned by the RPC get_block_template method, with different extra fields. To do this, I need to manually ...
2
votes
1answer
73 views

Should Monero use ElGamal commitments instead of Pedersen commitments?

Following on from the Q/A regarding "perfectly hiding and computationally binding" commitments, it is mentioned ElGamal commitments can be used to flip the commitment properties to become "perfectly ...
1
vote
3answers
65 views

What would the space saving difference be if MLSAG was applied over all inputs?

Currently, MLSAG is being applied to each real input, giving one signature per real input. What would the space savings be if it was applied over all real inputs, giving one signature per transaction? ...
2
votes
1answer
63 views

How is there no key image for the commitment to zero in MLSAG?

zero to monero 5.7.2 mentions there not being a key image for the commitment to zero. How is this possible? Quote: "Recalling Section 5.6.3, there is no key image for the commitments to zero zjG, and ...
2
votes
1answer
55 views

Different MLSAG implementations across papers

In MRL005, See page9, they describe the signing key for a given ring as Sum public keys + SumInputs - SumOutputs In zero to monero, Page49 section "MLSAG signature for inputs", they describe it as ...
2
votes
1answer
61 views

Key image forgery

Given a keypair (k,K); the key image is calculated as: KeyImage = k * H(K) What is stopping someone from giving a fake K in the hash function?
1
vote
1answer
50 views

Why not use bLSAG for one input instead of MLSAG?

AFAIK MLSAG is being used for one input because of a privacy problem. Why not just use bLSAG, since in the MRL005 it says that MLSAG is better once we have > 1 sets of keys.
1
vote
1answer
37 views

Relationship between pseudoOuts and Real outputs

For each real input, we have a pseduoOut which is commitment to the same amount as the real input. We can therefore subtract the realInputCommitment from the pseudoOut and prove that it is a ...
1
vote
1answer
49 views

Trying to understand how RCTTypeSimple works

We cannot use MLSAG and sign all inputs at once; as all real inputs would need to share the same index. The partial solution is to use a ring signature on each input separately. We need to ensure ...
1
vote
1answer
31 views

What is the significance of monero switching the G and H points in a Pedersen commitment?

Conventionally G is used to denote the standard Generator. H is then some point whereby the discrete log is not known with respects to G; H = yG where y is unknown. A pedersen commitment would ...
1
vote
1answer
31 views

Commitment to zero vs one-time public key signature

After reading 5.6.3 in Zero-To-Monero: https://www.getmonero.org/library/Zero-to-Monero-1-0-0.pdf It seems as if they are saying that we use the commitment to zero to sign the ring with the inputs as ...
2
votes
1answer
55 views

How does commitment to zero work?

Given two inputs each with their respective committed amounts; P1, P2. Then given two outputs each with their own respective committed amounts; P3, P4. We want to prove that the inputs - outputs - ...
4
votes
2answers
263 views

How are outPk, mask and amount fields created when spending RignCT coinbase transactions?

RingCT coinbase transactions don't have ecdhInfo fields with mask, outPk and amount. For example, this is how ringct coinbase transactions looks like (look at JSON representation): https://explorer....
16
votes
3answers
6k views

How many transactions per second can the Monero network handle?

How many transactions per second can the Monero network (theoretically) handle? Did recent LMDB optimizations improve the speed that CPUs can confirm transactions? Is the current limiting factor CPU ...
0
votes
0answers
18 views

Unable to send coins from freshly forked monero [duplicate]

I have forked Monero, made all the config level changes and start the daemon with v9. All nodes are synced perfectly, but when I try to send coins from wallet-cli I am getting the below error: Error: ...
0
votes
1answer
78 views

Error: not enough outputs for specified ring size = 11

I am trying to fork monero release-v0.13. I have made changes to the cryptonote_config file and I built and ran the daemon. Everything seems to be fine, nodes are syncing, mining is happening. But ...
1
vote
1answer
83 views

How does the mixing work?

I have been researching Monero, and I think I understand how ring signatures and stealth addresses work mathematically. However, to create a new ring transaction, you need N peers that want to join ...
4
votes
1answer
78 views

How was the generator H for the RingCT scheme chosen?

I'm reading the RingCT whitepaper by Shen Noether. The scheme requires a second random generator H such that its discrete logarithm w.r.t. G is not known. Paragraph 3.2 suggests two variants to ...
0
votes
1answer
55 views

Minimum and maximun number of mixin right now? [duplicate]

Is it a hard rule that there needs to be 11 ring signatures right now for a transaction to take place right now?
16
votes
1answer
3k views

What are bulletproofs?

I have heard that Monero transactions are relatively large, and that Bulletproofs will make Monero transactions smaller. Can someone give a high-level overview about what these are, and how they ...
4
votes
1answer
72 views

How is the number of ring members selected?

How is the number of ring members signing a transaction selected? Is it selected randomly by the sender or is it defined by the Monero wallet?
1
vote
1answer
38 views

What is the block height from which RingCT was implemented?

Can we know the block height from which the ring signatures were implemented. Because i read few blocks which are pre-ring signature blocks where I see there are ring members repeating for a single ...
4
votes
2answers
114 views

How is the used Pedersen commitment kept secret?

I understand one can have two commitments P and Q, and show the world that P - Q = 0 - communicating the commitment to only the recipient. In fact, it can be done with many input commitments P1 ... Pn....
4
votes
2answers
176 views

Is the 'pseudoOuts' of 'rctSig' the commitment on input amounts for simple RCT

It seems that the genRctSimple function will make a different input commitment for each input amount (line 675-683 in file src/rct/rctSigs.cpp). And summation of these input commitments = output ...
1
vote
1answer
50 views

How would I exploit the fact that I knew the scalar used for H in the Pedersons Commitment w.r.t G?

If H was badly chosen for the Pederson Commitment, such that the attacker knew a k where H = kG (1) What damage could be done to the system? We know that C = aH + bG If I commit a = 10 and b = 2 ...
0
votes
1answer
48 views

If the Monero started with rCT, would it be needed to have any part of the codebase handling dust?

I mean there is so much code in Monero handling situation that involve any dust. Is it just for backward compatibility or would it be needed even if the Monero started with rCT? I know about 2 types ...
1
vote
1answer
38 views

RingCt Is It Less Safe to Send the Whole Amount

state 1 Initial positions: A: 5.0032 B: 3.0000 C: 3.2000 ... state 2 G:5.0032 H:2.0000 I:1.0000 J:2.0000 K:1.2000 Let's assume A -> G B -> H,I C -> J,K I get you cannot tell for ...
1
vote
1answer
27 views

Why do we use different H values in a vector Pedersen Commitment?

The usual Pedersen Commitment looks like such: C = xG + aH Where x and a are scalars. However, we can also commit vectors, s.t. C = xG + (a_1 * H_1 + a_2 * H_2) Could anyone point out why we ...
2
votes
1answer
75 views

How does having a negative number in a Pedersen commitment, create money out of thin air?

Given two inputs of value: 10, 11 And two outputs of value 31, -10 The Pedersen commitment would look like: Let b + c - d - e = k (10G + bH + 11G + cH) - (31G + dH + -10G + eH) = 0G + kH Without ...
1
vote
1answer
71 views

How are transactions validated in monero vs bitcoin?

Bitcoin In bitcoin, the signature is a "normal" one and we check it against the signed tx hash. We then check whether the public key/s which signed it, owns the input/s. we then check whether the ...
1
vote
1answer
38 views

How do I find the value behind the pederson commitment?

Given that I have found a tx that is for me, what would be the maths to find out how much I have received?
2
votes
1answer
46 views

How does signing the hash of the public key show that the signer knew the private key?

I had this previously explained to me, however I do not think I understand it at all. Taken from Maxwell's confidential values: "If a signature is constructed so that the 'message' is the hash of ...
1
vote
1answer
27 views

Why must each input have a separate set of decoys?

If we have a mixin of 6, with two inputs. We immediately have a total of 6 * 2 = 12 decoys Would it not be secure enough to have the 4 decoys with the two inputs which means two key images? So we ...
1
vote
1answer
69 views

How does the ring sig work: practical explanation?

Is the following correct?: If I received 5 XMR from Bob, then I wanted to send this 5 XMR to Alice. Would I create a tx with the input as the 5 XMR from Bob with one output as 5 XMR to alice. Then ...
1
vote
1answer
114 views

The entire lifecycle of an XMR transaction with RingCT

I'm trying to understand the data structure in monerod and create a simple workflow for a transaction's life cycle. It doesn't look like this has been done post-RingCT activation, and I see a lot of ...
3
votes
1answer
178 views

What exactly are bulletproofs replacing in monero?

I am stuck on these questions in understanding bulletproofs: Are bulletproofs a way to hide the sender and the amount? What is the difference between bulletproofs, RingCT and Ring signatures? Edit: ...
3
votes
1answer
45 views

Where can I find the selection of the decoys (stealthy addresses) when constructing a transaction?

When constructing a new transaction, I have reached the function cryptonote_core/cryptonote_tx_utils.cpp/construct_tx_with_tx_key() and I am trying to understand where the decoys came from? How and ...
3
votes
1answer
119 views

How do ring signatures work when there are multiple UTXOs from which you have to collect monero coin?

User A has 3 UTXOs which sum up to 10 XMR. How does the Key Image ensure that all three utxos cannot be double spent?
2
votes
2answers
75 views

Cannot get version 2 transactions to work on private testnet

I built Monero private testnet (basically used these instructions https://github.com/moneroexamples/private-testnet, but with the latest codebase). Everything seemed to work fine, but I realized that ...
5
votes
1answer
194 views

Wolfram Warptangent, Point Release 10.2.1 performance improvements

There have been multiple reports of massive reductions in memory and CPU usage with the new Monero 10.2.1 point release. What specific optimizations led to the "massive speed improvements to RingCT ...