20

Most non coinbase Monero transactions are currently around 2,000 bytes (but with significant variation) which is somewhere in the neighborhood of 8 times larger than most Bitcoin non coinbase transactions. The reason why RingCT should help eliminate the need for extremely large Monero transactions is that RIngCT no longer will require the use of outputs of ...


17

RingCT is based on the Confidential Transactions research you cited (combined with ring signatures) RingCT just like Confidential Transactions hides the amount of each transaction. Unlike Confidential Transactions, RingCT will also make the payments unlinkable. Confidential Transactions include a cryptographic proof that the sum of the input amounts is ...


15

Non coinbase transactions can start at a couple hundred bytes, and can go up in size a lot if they have a large number of inputs. The main factors driving up size is the number of inputs and mixin. When sending a large amount, if the sending wallet only has small inputs, it will have to include a lot of them in the transaction (and possibly even send ...


9

Perfectly hiding. I don't think perfectly binding even existed at the time RCT was developed (not sure, though). As to what should be chosen, think about this: We can always replace lost money, but we can't ever replace lost privacy.


8

The current Monero median block size (last 1,000 blocks) is 286 bytes. The median transaction size is slightly less because some block include multiple transactions. The current median BTC transaction size is 260 bytes. http://moneroblocks.info/stats https://bitcoinfees.21.co/ Monero median (not mean) block sizes are important since they influence the ...


8

The input comes from a non-RingCT transaction. The outputs are RingCT outputs, and are therefore reflected as 0.


8

As in my post to MRL Issue #6, I now figured out what pseudoOuts mean. Assuming the outPk means the output commitments, what I'd like to know (assuming the ring signature is valid), would be to see the following hold: sum_j{pseudoOuts[j]} = sum_i{outPk[i]} + fee*H What I'm missing in Luigi's JS code is a way to get fee*H. Edit: Luigi kindly answered my ...


5

Bulletproofs are used to prove that the amounts in confidential transactions are in range, so you can't do underhanded things like creating negative amounts. They replace Borromean range proofs. They are smaller in size, and faster to verify, though slower to generate. As used in Monero, they are unrelated to ring signatures, but are part of RingCT, since ...


4

2017 update now that RingCT is standard: Real (non-coinbase) transactions in Monero are currently about 13kb each when using a ring size of 5. The median Bitcoin transaction size is 226 bytes.


4

The equation is rct = x*G + a*H(G) where * indicates scalar point multiplication in the ed25519 curve, x is the "mask", G is the base point of the curve (group generator), a is the actual amount, and H(...) is a function that returns a point on the curve based on the cryptographic hash of the point G. The "mask" (x) is randomly generated so there is no ...


3

How does signing the hash of the public key show that the signer knew the private key? That's what signatures do. They prove that a private key must have been known for a particular public key that the verifier checks there has been a successful signature for. You can sign the message "hello" and that'd still prove you knew the private key for the public ...


3

Normally C = xG + aH where a is the amount and x is the blinding factor. The point of a Pedersen Commitment is to commit you to a certain value of a. If instead you had C = xG + aG, then this simplifies to C = (x+a)G. So you could claim any value of a later by claiming you'd used a different blinding factor. Using H, which has an unknown DL w.r.t. G, ...


3

tl;dr: OutProofV1 strings prove you had access to the wallet that constructed a particular transaction. SpendProofV1 strings are used when some wallet information has been lost (because txkeys are lost forever if you don't store them), and instead prove you had full knowledge of the private keys of the inputs being spent in a transaction. Strings ...


3

Both the ecdhInfo mask and amount are encrypted by the sender of the transaction. Both are encrypted (each in a slightly different way) using the transaction's shared secret (aR). Therefore both encrypted values will be randomly distributed, and thus cannot be validated by a third party. If the sender of the transaction had somehow written faulty values ...


3

If you sent to an address owned by someone else (Bitfinex), then you cannot use a wallet to recover the funds. It is the responsibility of the address owner (the exchange, Bitfinex) to credit you with those funds, as long as you can prove that they were sent by you or on your behalf.


3

No. No. Naturally, you can only know about what you sent to that address. You can't know whether that address ever received anything else from the side. When the target spends what you sent to them, you won't be able to tell if it was your target who did the spending or someone else who just happened to include output of your TX as his "decoy" input (look up ...


2

I searched your transmission hash on XMRchain.org and the coins were sent. Download the entire block chain to a computer. Check completion status, and when 100.0%, nothing less, reconstitute your paper wallet into a real wallet, using your 25 word mnemonic seed. Your coins will magically appear.


2

There are several people close to the Monero project that would tentatively agree with you that a fixed ring size would improve anonymity. As you point out, if you use a non-default ring size, your transaction will stand out. Even if you were to use a random ring size each time, you'll be one of a small number of people that are not using the default ring ...


2

And KeyImages link to addresses which links to inputs Any particular key image specified in a ring signature in a transaction must correspond to one of the output public keys (sometimes called stealth addresses) referenced in that ring signature, but you can't tell which output. These outputs will be created in transactions where it will again not be clear ...


2

The point of a commitment is that it prevents you from later claiming that you'd committed to a different value. To use the usual algebraic letters, a commitment is C = xG + aH where the value a is being committed to and the value x is the mask (a.k.a. blinding factor). Revealing x and a after you've created the commitment C will prove that you had ...


2

RingCT is basically the combination of three things: ring signatures, stealth addresses (one-time output keys) and CT (Confidential Transactions). The ring signature provides sender ambiguity, the stealth addresses (one-time output keys) hide the recipient address from the blockchain and CT is used in hiding the amount. Combined, you have the properties ...


2

The encrypted/masked amounts are stored in the tx ecdhInfo field. If you want to view these masked amounts on an explorer: Visit: https://xmrchain.net/tx/9adbcfa8fe9011c2451b9636d3b68312047e93ec4477bf894687fb182a93a4c2/1 Scroll to the bottom and click "Show JSON representation of tx". If you want to view in a daemon: print_tx ...


1

You will need the address/subaddress and private view key to decode the amounts. Go to xmrchain.net and fill in the missing address and viewkey. Edit: Here's some light reading for deeper knowledge of Monero. Transaction structure is described in detail in Appendix A/B.


1

Mixin 6 means a ring size of 7. Having 2 real inputs and 5 decoys for an overall ring size of 7 is a lower level of privacy than the current implementation, which would be 2 real inputs and 12 decoys as part of two rings of size 7. It would be worse if you were spending 6 inputs. You'd have only 1 decoy, so your privacy level would drop enormously. ...


1

I'll do my best to answer: 1) Actually it starts with the wallet, not daemon, aggregating the inputs for spending. 2) The wallet asks the daemon for the mixins (decoys) 6) All values are encrypted as Pedersen commitments 6.1) They are also Pedersen commitments 6.2) Key Images are actually on each txin 8) Receivers wallet (receiver) checks each txout ...


1

I'll describe conceptually how they work in Monero, since this is the Monero stackexchange. I'd assume they would work similarly when implemented elsewhere. Output amounts are encrypted by the sender using the transaction shared secret, and bundled with the transaction. The transaction shared secret is the result of a Diffie Hellman exchange between the ...


1

Your analysis is correct, however knowing that the transaction is one of the five transactions (in average) of a block will not help to identify your address as it will be one of the 5*7=35 addresses of the lot used as ring signatures.


1

Let's say it is possible to guess the exact Monero transaction on the blockchain that resulted in the corresponding Bitcoin transaction. That would not constitute a significant privacy leak. No one can know your Monero wallet address or even which outputs you were actually spending.


1

No, no and no. Monero is inherently private. Look for more information with keywords like: stealth address, ring signature, confidential transactions etc.


1

The other two answers are good in that they cover the part about Pedersen commitments, and how those are used to check that the sum of the amounts in the outputs created doesn't exceed that of the sum of the real inputs consumed (the homomorphic cryptography part). On the other hand, since the amounts involved are being taken from a finite range where ...


Only top voted, non community-wiki answers of a minimum length are eligible