24

From Cryptonote Address Tests Cryptonote Public Addresses differ in several ways compared to Bitcoin. First, Cryptonote uses two keypairs, known as the spend keypair and the view keypair. Furthermore, these keys are EdDSA (specifically ed25519) keys, whereas Bitcoin uses ECDSA (specifically secp256k1) keys. Finally, Cryptonote Public Addresses are direct ...


19

Monero doesn't use EdDSA, which all of those libraries are specifically set up for. We don't use SHA512 at all, but rather Keccak (~SHA3). We don't use secret keys as seeds like EdDSA does, but rather as scalars. If you look at ed25519.py on L63, you can see what I'm talking about. Change the function to look like this: def publickey(sk): a = decodeint(...


15

Indeed it can. Let's say Alice has Y XMR and Bob has Z BTC, and they want to trade. Alice and Bob setup a multisig wallet (see this). Alice creates (but does not sign) a transaction of Y XMR to the multisig wallet. Alice and Bob mutually sign a transaction from the multisig wallet that sends Y_1 XMR < Y XMR to itself, but locked for 48 hours. They also ...


13

Suppose the sender wants to create a Pedersen Commitment to the amount of 23 XMR for a new output pubkey in a transaction. Without range proof, the sender simply creates the commitment as: C = a G + 23 H where a is a random scalar. With range proof, there's an assumption in the protocol that any committed amount falls within a certain range; let's say ...


11

Firstly, Monero relies on the safety of Ed25519 (as opposed to secp256k1 for Bitcoin) and EdDSA. Note that if EdDSA/Ed25519 breaks, a lot more than Monero will be impacted, including SSH, Tor, I2P, OpenBSD, GnuPG and many more From the Surae Noether CryptoNote white paper review Implementation and use key images to prevent double spending The CN ...


11

As explained by Papa Lazzarou, Monero addresses contain two public keys (the spend key and the viewkey). As for the integrated addresses, these include the same information, plus an extra 8 byte short payment ID, serialized in the same way into the address. Those payment IDs are automatically encrypted on the blockchain, whereas full length standalone ones ...


11

The simple answer would be no. The codebases simply aren't in any way similar. Bitcoin devs would need to do a massive rewrite of the code to implement ring sigs with confidential transactions, it would require a hardfork and would likely break functionality with code outside of Bitcoin such as wallets and such. The longer answer would be maybe. It could ...


10

The underlying Elliptic Curve that is used for Monero's cryptography is the Twisted Edwards curve Ed25519, and this is the same curve used in applications like OpenSSH, Tor, Tox, I2P, Facebook Messenger, Google, Whatsapp, and others. That doesn't, by itself, guarantee that it is flawless, but it is a very good endorsement IMO, and it is a bigger test of time ...


10

While interesting, it's not really applicable to cryptography utilized by Monero as the trapdoored one is specific to 1024-bit prime numbers. Monero utilizes elliptic curve cryptography, more specifically the curve Ed25519, which has been time tested as it has been pointed out here. The DH scheme is indeed used, but it's not the same kind, but the one ...


10

I happened to have read Greg Maxwell's paper recently, so here I try to lay down my interpretation in a bit abstract manner: Before talking about the Borromean scheme, let us recapitulate the current ring signature scheme described in MRL-0005. The signature data looks like: R = (M, {P_1,...,P_n}, c_1, {r_1,...,r_n}) where M is some message's hash, each ...


9

In the interest of pedantry (and since I can't comment -_-): You sign the hash of the transaction prefix. In Monero that is everything but the signatures. (at the above answer) Monero relies on ed25519, not EdDSA. EdDSA is a particular signature system (completely absent in Monero). Monero's ring signatures are presently the Fujisaki-Suzuki variety, ...


9

The problem was exactly that - possible forgery. In the RCT paper, there was a proof that you can't forge ASNL range proof which later turned out to have an error. See here for more details. Why do we need these proofs / signatures? From the RCT paper (emphasis mine): ... as -1 is a very large number modulo the curve group order, free money has been ...


9

Let's say you'll use two of your outputs, 12.34 XMR and 7.89 XMR and send 18.37 XMR to your recipient for a fee of 0.022 XMR and change of 1.838 XMR. If you use mixin of 4, you'll be creating two rings with 5 output keys contained in each. You'll pick a secret index between 1 and 5 for each ring, so let's say you picked 2 for the first and 4 for the second. ...


9

Perfectly hiding. I don't think perfectly binding even existed at the time RCT was developed (not sure, though). As to what should be chosen, think about this: We can always replace lost money, but we can't ever replace lost privacy.


8

As in my post to MRL Issue #6, I now figured out what pseudoOuts mean. Assuming the outPk means the output commitments, what I'd like to know (assuming the ring signature is valid), would be to see the following hold: sum_j{pseudoOuts[j]} = sum_i{outPk[i]} + fee*H What I'm missing in Luigi's JS code is a way to get fee*H. Edit: Luigi kindly answered my ...


8

Since StackExchange prefers content to be on the site rather than through links, I've transcribed and annotated the information from luigi1111 on PasteBin to make it more accessible for readers. Stealth Short Payment IDs This is a proposal for shortening both "user" and "blockchain" payment IDs from 256 bit (32 bytes) to 64 bit (8 bytes), incorporating a ...


8

Looks like it was being exploited on Bytecoin For example, these 2 transactions spend the output 26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05 twice! http://chainradar.com/bcn/transaction/cef289d7fab6e35ac123db8a3f06f7675b48067e0dff185c72b140845b8b3b23 http://chainradar.com/bcn/transaction/...


7

A good place to start would be https://getmonero.org/home, try looking at the various topics under Knowledge Base. If you have further specific questions, you can ask on Reddit, IRC, or here.


7

One weakness that Bitcoin and Monero both share are from quantum computing. With quantum computing, significantly less energy would be required to crack private keys. Therefore Monero is (essentially) equally secure, withstanding that quantum computation is not available.


7

This image says that all the energy of the sun would not be enough to try all the Bitcoin private keys (256-bit keys). The elliptic curve that Monero uses works with 255-bit private keys, and trying all of them would not be feasible either.


7

Indeed you can. Let's say Alice has Y XMR and Bob knows a secret s. Let's also say that there is program C that checks if s is correct (I will assume that C is known by both Alice and Bob, but this could be modified). For example, in the case of P2SH, it could check that Hash(s)=x for some x, or could check if a painting is beautiful or not. 1-4. Do step 1-...


7

All¹ asymmetric signature protocols calculate a hash of the message and then apply the “mathematical” transformation to this hash. This includes EdDSA which Monero relies on. The reason is that all those mathematical transformations work on fixed-size numbers (of about a few hundred bits). Hashing condenses the information into this fixed size, with the ...


7

Section 4.4 of CN white-paper describes this. With the ring signature, all the keys used are equivalent, so you can't say which one is the actual signer. The signature can be checked against any of the public keys used in the ring. Let's define our one-time keys as P = xG Where P is the public key, x the private key, and G the EC basepoint. If we let the ...


7

Given a finite group of integers, any group element Z in a group of order n, Z^n will always equal the identity element (order == number of elements in group). ECC has an equivalent abstraction - multiplying any point in a finite group by the order of the group will result in the identity element. The identity element is analogous to zero in the set of ...


6

I did find the following information: Some information about the history you can find here. It is part of the so called 'epee' library. The creator is a Russian programmer called Andrey N. Sabelnikov, who seems to be well known for creating a botnet. The original code is located on Github. It doesn't seem to be used anywhere else besides some ...


6

Github user divbit responded to the issue on Github here. To quote: Hi, the paper states that it is a sketch of a proof (mainly it's a sketch because the things are no more efficient than the Borromean ones which are mentioned could be used on a previous page, and possibly less efficient according to the Borromean paper, in some cases (e.g. higher bases ...


6

Although it wasn't clear to the reviewers at the time, the constants are standard ed25519 constants from DJB et al. You can read about it here, especially section "Choice of curve" starting on the bottom of page 7.


6

One of the key privacy features for Monero goes beyond the use of stealth addresses, ring signatures and confidential transactions (coming January '17). More so it's the fact that all of these features are default-on. That's a tremendous improvement over competitors today, all of which offer optional private transactions with the default being transparent. ...


6

However, could a one-time public key receive Monero more than once (as in thousands of times) Yes, but it is certainly not practical. There are basically two reasons as two why. First, sending Monero to the same one-time public key (stealth address) will be detrimental to unlinkability, i.e., it will create linkability between payments. In addition, sending ...


6

Pedersen Commitments and Range Proofs See https://people.xiph.org/~greg/confidential_values.txt


Only top voted, non community-wiki answers of a minimum length are eligible