20

The auditor will see that you have omitted part of the key images. The auditor can see all the outputs received by your account. Without the spend key, the auditor cannot generate the key images corresponding to those, however. In order to prove your balance, you generate a signed list of key images (see https://github.com/monero-project/bitmonero/pull/928 ...


17

Using a combination of ring signatures (collections of cryptographic signatures with at least one real participant in each group) and stealth addresses (requiring the sender to create one-time addresses for every transaction they make), Monero effectively obfuscates transactions and account balances on the blockchain thus eliminating any possibility of "rich ...


15

First, theoretical background can be found here: Selective transparency in Monero vs Zcash Why is the viewkey able to track incoming transactions, but not outgoing transactions? Is there any way to construct a transaction manually? Basically the gist is that you know a (the private view key) and R (the public tx key). As a result, you are able to compute ...


14

To answer this question, we first have to explain how Monero works. The letters used in this answer correspond to the letters used for the math in the CryptoNote whitepaper. Note that scalars (private keys) are always represented by lowercase letters in equations and points (public keys) are always represented by uppercase letters. In Monero you have two ...


11

Currently, this is not possible. There is however a patch that allows just this ready to be merged: https://github.com/moneromooo-monero/bitmonero/tree/signed-key-images This is possible: Two new commands are added that allow proof of reserves: export_key_images will generate a file containing a dump of all an acocunt's key images, sign with the ...


10

A richlist requires the ability to aggregate and accumulate outputs per account/address/owner/etc. This is not possible with Monero since every single output has its own one time address, which an observer can't unambiguously relate to any other. With Bitcoin, address reuse is discouraged. With Monero, it is taken out of the user's decision: every output ...


9

If the auditor wanted to confirm you had sent funds to a specific address, they'll then need to have the view key of that address also. The only thing the view key of your address can determine which outputs were sent to its corresponding public key. The key images can confirm when a transaction took place, and how much was was moved from your address. It ...


7

If you think about it, change comes back in the same transaction as the money you sent. If you receive X monero as change, you will have sent Y monero in the same transaction, with Y > X. The answer to your question boils down to the key images. You give a signed set of key images to the auditor, who can now see money going in and out. See How to prove my ...


6

No, he can not. An "output" is actually a one-time key-pair. It consists of an one-time public key, which resides on the blockchain, can be seen by everyone (but it can be matched to a wallet only by having the private view key and the public spend key), and acts as a container which holds some funds. It has a corresponding private key, which can be ...


5

First, theoretical background can be found here: Selective transparency in Monero vs Zcash Why is the viewkey able to track incoming transactions, but not outgoing transactions? What is the TX key? Is there any way to construct a transaction manually? Basically the gist is that you know r (the private tx key) and A (the public view key, which is part of ...


5

It is impossible to calculate what the address is that corresponds to a given one-time address (there are actually multiple possibility). It is possible to check if a transaction corresponds to a given address. An auditor would need both your outgoing tx keys, and an address book to figure out where the funds are going.


5

The daemon command print_coinbase_tx_sum is useful for auditing the supply (sum of all coinbase transactions). help print_coinbase_tx_sum Command usage: print_coinbase_tx_sum <start_height> [<block_count>] Command description: Print the sum of coinbase transactions. You then verify, the amount obtained from above, is less than per the ...


4

The key image is not the same as the actual key, so they should not be able to sign a transaction without the actual key. The key image prevents double spends, but it is not sufficient in of itself to spend coins.


4

In monero transactions every output is sent to a One-Time Public Key (stealth address), which is derived from the recipient Public Key, the position or index of the output in the transaction and a random number generated by the sender. As ferretinjapan explained, only the receiver may check if that One-Time Key is derived from his Public Key.


3

The business or charity can publish their public viewkeys. Monero is private by default and public by choice.


3

Another explanation: there is a one-to-one mapping between an output public key P and its key image I as I=x*H_p(P) where x is the private key of P and H_p() is a hash-to-pubkey function. What's important here is that this mapping is secret and can be established only by the wallet owner knowing x. Also note that it's easy for anyone to tell that a given ...


3

The signature verification algorithm will only return a "correct signature" result if P is equal to x·G (i.e. the real spent output's public key is derived from the output's secret spend key x) and if I is equal to x·Hp(P) (i.e. the key image I is derived from the output's secret spend key x). If you can understand the algorithms on page 6 of MRL-0003, you ...


2

Recently there was a post on Reddit asking almost the same question which generated quite some additional discussion (although without much positive outlook). Here's a comment by me giving an answer to the original question: I asked moneromooo about this on IRC, and he said that what's mentioned by u/fluffyponyza in the presentation probably refers to an ...


2

Yes, this is called a SpendProofV1 and is implemented by the official Monero wallet. See this answer: What is the "SpendProofV1..." or "OutProofV1..." in the details of a sent transaction in the GUI?


2

Yes, the view key proves that outputs were destined for a particular wallet address. It cannot be proven whether these outputs were subsequently spent, but it can be guessed that they have been spent if the outputs are referenced in a transaction that creates a change output that is also destined for that same wallet (which someone with the private view key ...


2

Yes. It is supposed to be a more privacy-preserving alternative to the previous method of proving the wallet balance to an auditor by giving out the view key and signed key images. (In my opinion, the watch-only wallet feature should only be used for cold signing purposes; i.e. the view key should never be given out to others.) Similar to the previous method,...


2

Viewkey only shows in which TX you received something so time, date and the amount you received. It can't possibly reveal source address because it's never actually written inside the TX. Spendkey additionally reveals whether what you received above has been spent or not and in which TX it was spent and how much. It will tell you the destination one-time ...


Only top voted, non community-wiki answers of a minimum length are eligible