24 votes
Accepted

Why are Monero addresses so long?

From Cryptonote Address Tests Cryptonote Public Addresses differ in several ways compared to Bitcoin. First, Cryptonote uses two keypairs, known as the spend keypair and the view keypair. ...
user avatar
20 votes
Accepted

Why/how does monero generate public ed25519 keys without using the standard public key generation provided by ed25519 libraries?

Monero doesn't use EdDSA, which all of those libraries are specifically set up for. We don't use SHA512 at all, but rather Keccak (~SHA3). We don't use secret keys as seeds like EdDSA does, but rather ...
user avatar
  • 2,422
15 votes
Accepted

Can you trustlessly trade Monero for Bitcoin?

Indeed it can. Let's say Alice has Y XMR and Bob has Z BTC, and they want to trade. Alice and Bob setup a multisig wallet (see this). Alice creates (but does not sign) a transaction of Y XMR to the ...
user avatar
  • 3,120
13 votes
Accepted

In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?

Suppose the sender wants to create a Pedersen Commitment to the amount of 23 XMR for a new output pubkey in a transaction. Without range proof, the sender simply creates the commitment as: C = a G + ...
user avatar
  • 2,475
12 votes

What cryptographic assumptions is Monero based on?

Firstly, Monero relies on the safety of Ed25519 (as opposed to secp256k1 for Bitcoin) and EdDSA. Note that if EdDSA/Ed25519 breaks, a lot more than Monero will be impacted, including SSH, Tor, I2P, ...
user avatar
  • 6,533
11 votes

Why are Monero addresses so long?

As explained by Papa Lazzarou, Monero addresses contain two public keys (the spend key and the viewkey). As for the integrated addresses, these include the same information, plus an extra 8 byte ...
user avatar
  • 34.6k
11 votes
Accepted

What are Borromean signatures?

I happened to have read Greg Maxwell's paper recently, so here I try to lay down my interpretation in a bit abstract manner: Before talking about the Borromean scheme, let us recapitulate the current ...
user avatar
  • 2,475
11 votes

Can Monero's privacy features be integrated into (copied) by bitcoin?

The simple answer would be no. The codebases simply aren't in any way similar. Bitcoin devs would need to do a massive rewrite of the code to implement ring sigs with confidential transactions, it ...
user avatar
11 votes
Accepted

Can someone walk me through a simple example to explain how RingCT works?

Let's say you'll use two of your outputs, 12.34 XMR and 7.89 XMR and send 18.37 XMR to your recipient for a fee of 0.022 XMR and change of 1.838 XMR. If you use mixin of 4, you'll be creating two ...
user avatar
  • 2,475
10 votes

Is a Monero key backdoor possible?

The underlying Elliptic Curve that is used for Monero's cryptography is the Twisted Edwards curve Ed25519, and this is the same curve used in applications like OpenSSH, Tor, Tox, I2P, Facebook ...
user avatar
  • 3,327
10 votes
Accepted

Is a Monero key backdoor possible?

While interesting, it's not really applicable to cryptography utilized by Monero as the trapdoored one is specific to 1024-bit prime numbers. Monero utilizes elliptic curve cryptography, more ...
user avatar
  • 19.8k
9 votes

How do payment ids work?

Since StackExchange prefers content to be on the site rather than through links, I've transcribed and annotated the information from luigi1111 on PasteBin to make it more accessible for readers. ...
user avatar
  • 490
9 votes

When you sign a Monero transaction, are you signing a hash?

In the interest of pedantry (and since I can't comment -_-): You sign the hash of the transaction prefix. In Monero that is everything but the signatures. (at the above answer) Monero relies on ...
user avatar
  • 2,422
9 votes
Accepted

What was the problem with ASNL forgery?

The problem was exactly that - possible forgery. In the RCT paper, there was a proof that you can't forge ASNL range proof which later turned out to have an error. See here for more details. Why do ...
user avatar
  • 19.8k
9 votes
Accepted

Are Confidential Transactions in Monero perfectly binding or hiding?

Perfectly hiding. I don't think perfectly binding even existed at the time RCT was developed (not sure, though). As to what should be chosen, think about this: We can always replace lost money, ...
user avatar
  • 19.8k
8 votes
Accepted

Can I manually check consistency of Pedersen Commitments in RingCT?

As in my post to MRL Issue #6, I now figured out what pseudoOuts mean. Assuming the outPk means the output commitments, what I'd like to know (assuming the ring signature is valid), would be to see ...
user avatar
  • 2,475
8 votes

How does the recent patched key image exploit work in practice?

Looks like it was being exploited on Bytecoin For example, these 2 transactions spend the output 26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05 twice! http://chainradar.com/bcn/...
user avatar
  • 19.8k
7 votes

Monero technology information

A good place to start would be https://getmonero.org/home, try looking at the various topics under Knowledge Base. If you have further specific questions, you can ask on Reddit, IRC, or here.
user avatar
7 votes

How strong is Monero cryptography against brute-force attacks?

One weakness that Bitcoin and Monero both share are from quantum computing. With quantum computing, significantly less energy would be required to crack private keys. Therefore Monero is (...
user avatar
7 votes

How strong is Monero cryptography against brute-force attacks?

This image says that all the energy of the sun would not be enough to try all the Bitcoin private keys (256-bit keys). The elliptic curve that Monero uses works with 255-bit private keys, and trying ...
user avatar
  • 3,304
7 votes
Accepted

Can you make contingent payments in Monero?

Indeed you can. Let's say Alice has Y XMR and Bob knows a secret s. Let's also say that there is program C that checks if s is correct (I will assume that C is known by both Alice and Bob, but this ...
user avatar
  • 3,120
7 votes

When you sign a Monero transaction, are you signing a hash?

All¹ asymmetric signature protocols calculate a hash of the message and then apply the “mathematical” transformation to this hash. This includes EdDSA which Monero relies on. The reason is that all ...
user avatar
7 votes
Accepted

What signature prevents me from spending others' coins?

Section 4.4 of CN white-paper describes this. With the ring signature, all the keys used are equivalent, so you can't say which one is the actual signer. The signature can be checked against any of ...
user avatar
  • 19.8k
7 votes
Accepted

How does the recent patched key image exploit work in practice?

Given a finite group of integers, any group element Z in a group of order n, Z^n will always equal the identity element (order == number of elements in group). ECC has an equivalent abstraction - ...
user avatar
6 votes

Is there information available about the Levin protocol?

I did find the following information: Some information about the history you can find here. It is part of the so called 'epee' library. The creator is a Russian programmer called Andrey N. ...
user avatar
  • 589
6 votes

Issue with unforgeability proof of ASNL in RingCT paper

Github user divbit responded to the issue on Github here. To quote: Hi, the paper states that it is a sketch of a proof (mainly it's a sketch because the things are no more efficient than the ...
user avatar
  • 14.9k
6 votes
Accepted

How were Monero elliptic curve constants chosen?

Although it wasn't clear to the reviewers at the time, the constants are standard ed25519 constants from DJB et al. You can read about it here, especially section "Choice of curve" starting on the ...
user avatar
  • 2,422
6 votes

Can Monero's privacy features be integrated into (copied) by bitcoin?

One of the key privacy features for Monero goes beyond the use of stealth addresses, ring signatures and confidential transactions (coming January '17). More so it's the fact that all of these ...
user avatar
6 votes

Can a One-Time public key be used for more than one payment?

However, could a one-time public key receive Monero more than once (as in thousands of times) Yes, but it is certainly not practical. There are basically two reasons as two why. First, sending Monero ...
user avatar
  • 14.9k
6 votes
Accepted

What cryptography primitives/concepts, other than the basic ones, does Monero use?

Pedersen Commitments and Range Proofs See https://people.xiph.org/~greg/confidential_values.txt
user avatar
  • 8,398

Only top scored, non community-wiki answers of a minimum length are eligible