24
votes
Accepted
Why are Monero addresses so long?
From Cryptonote Address Tests
Cryptonote Public Addresses differ in several ways compared to Bitcoin. First, Cryptonote uses two keypairs, known as the spend keypair and the view keypair. ...
- 1,187
21
votes
Accepted
Why/how does monero generate public ed25519 keys without using the standard public key generation provided by ed25519 libraries?
Monero doesn't use EdDSA, which all of those libraries are specifically set up for. We don't use SHA512 at all, but rather Keccak (~SHA3). We don't use secret keys as seeds like EdDSA does, but rather ...
- 2,452
15
votes
Accepted
Can you trustlessly trade Monero for Bitcoin?
Indeed it can. Let's say Alice has Y XMR and Bob has Z BTC, and they want to trade.
Alice and Bob setup a multisig wallet (see this).
Alice creates (but does not sign) a transaction of Y XMR to the ...
- 3,120
13
votes
Accepted
In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?
Suppose the sender wants to create a Pedersen Commitment to the amount of 23 XMR for a new output pubkey in a transaction. Without range proof, the sender simply creates the commitment as:
C = a G + ...
- 2,475
12
votes
What cryptographic assumptions is Monero based on?
Firstly, Monero relies on the safety of Ed25519 (as opposed to secp256k1 for Bitcoin) and EdDSA. Note that if EdDSA/Ed25519 breaks, a lot more than Monero will be impacted, including SSH, Tor, I2P, ...
- 6,563
11
votes
Why are Monero addresses so long?
As explained by Papa Lazzarou, Monero addresses contain two public keys (the spend key and the viewkey).
As for the integrated addresses, these include the same information, plus an extra 8 byte ...
- 34.8k
11
votes
Accepted
What are Borromean signatures?
I happened to have read Greg Maxwell's paper recently, so here I try to lay down my interpretation in a bit abstract manner:
Before talking about the Borromean scheme, let us recapitulate the current ...
- 2,475
11
votes
Can Monero's privacy features be integrated into (copied) by bitcoin?
The simple answer would be no. The codebases simply aren't in any way similar. Bitcoin devs would need to do a massive rewrite of the code to implement ring sigs with confidential transactions, it ...
- 6,484
11
votes
Accepted
Can someone walk me through a simple example to explain how RingCT works?
Let's say you'll use two of your outputs, 12.34 XMR and 7.89 XMR and send 18.37 XMR to your recipient for a fee of 0.022 XMR and change of 1.838 XMR. If you use mixin of 4, you'll be creating two ...
- 2,475
10
votes
Is a Monero key backdoor possible?
The underlying Elliptic Curve that is used for Monero's cryptography is the Twisted Edwards curve Ed25519, and this is the same curve used in applications like OpenSSH, Tor, Tox, I2P, Facebook ...
- 3,327
10
votes
Accepted
Is a Monero key backdoor possible?
While interesting, it's not really applicable to cryptography utilized by Monero as the trapdoored one is specific to 1024-bit prime numbers.
Monero utilizes elliptic curve cryptography, more ...
- 19.9k
9
votes
How do payment ids work?
Since StackExchange prefers content to be on the site rather than through links, I've transcribed and annotated the information from luigi1111 on PasteBin to make it more accessible for readers.
...
- 490
9
votes
When you sign a Monero transaction, are you signing a hash?
In the interest of pedantry (and since I can't comment -_-):
You sign the hash of the transaction prefix. In Monero that is everything but the signatures.
(at the above answer) Monero relies on ...
- 2,452
9
votes
Accepted
What was the problem with ASNL forgery?
The problem was exactly that - possible forgery. In the RCT paper, there was a proof that you can't forge ASNL range proof which later turned out to have an error. See here for more details.
Why do ...
- 19.9k
9
votes
Accepted
Are Confidential Transactions in Monero perfectly binding or hiding?
Perfectly hiding. I don't think perfectly binding even existed at the time RCT was developed (not sure, though).
As to what should be chosen, think about this:
We can always replace lost money, ...
- 19.9k
8
votes
Accepted
Can I manually check consistency of Pedersen Commitments in RingCT?
As in my post to MRL Issue #6, I now figured out what pseudoOuts mean. Assuming the outPk means the output commitments, what I'd like to know (assuming the ring signature is valid), would be to see ...
- 2,475
8
votes
How does the recent patched key image exploit work in practice?
Looks like it was being exploited on Bytecoin
For example, these 2 transactions spend the output 26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05 twice!
http://chainradar.com/bcn/...
- 19.9k
7
votes
Monero technology information
A good place to start would be https://getmonero.org/home, try looking at the various topics under Knowledge Base. If you have further specific questions, you can ask on Reddit, IRC, or here.
- 901
7
votes
How strong is Monero cryptography against brute-force attacks?
One weakness that Bitcoin and Monero both share are from quantum computing. With quantum computing, significantly less energy would be required to crack private keys.
Therefore Monero is (...
- 450
7
votes
How strong is Monero cryptography against brute-force attacks?
This image says that all the energy of the sun would not be enough to try all the Bitcoin private keys (256-bit keys).
The elliptic curve that Monero uses works with 255-bit private keys, and trying ...
- 3,334
7
votes
Accepted
Can you make contingent payments in Monero?
Indeed you can. Let's say Alice has Y XMR and Bob knows a secret s. Let's also say that there is program C that checks if s is correct (I will assume that C is known by both Alice and Bob, but this ...
- 3,120
7
votes
When you sign a Monero transaction, are you signing a hash?
All¹ asymmetric signature protocols calculate a hash of the message and then apply the “mathematical” transformation to this hash. This includes EdDSA which Monero relies on. The reason is that all ...
7
votes
Accepted
What signature prevents me from spending others' coins?
Section 4.4 of CN white-paper describes this. With the ring signature, all the keys used are equivalent, so you can't say which one is the actual signer. The signature can be checked against any of ...
- 19.9k
7
votes
Accepted
How does the recent patched key image exploit work in practice?
Given a finite group of integers, any group element Z in a group of order n, Z^n will always equal the identity element (order == number of elements in group). ECC has an equivalent abstraction - ...
- 906
6
votes
Is there information available about the Levin protocol?
I did find the following information:
Some information about the history you can find here.
It is part of the so called 'epee' library.
The creator is a Russian programmer called Andrey N. ...
- 589
6
votes
Issue with unforgeability proof of ASNL in RingCT paper
Github user divbit responded to the issue on Github here. To quote:
Hi, the paper states that it is a sketch of a proof (mainly it's a sketch because the things are no more efficient than the ...
- 15.1k
6
votes
Accepted
How were Monero elliptic curve constants chosen?
Although it wasn't clear to the reviewers at the time, the constants are standard ed25519 constants from DJB et al. You can read about it here, especially section "Choice of curve" starting on the ...
- 2,452
6
votes
Can Monero's privacy features be integrated into (copied) by bitcoin?
One of the key privacy features for Monero goes beyond the use of stealth addresses, ring signatures and confidential transactions (coming January '17). More so it's the fact that all of these ...
- 698
6
votes
Can a One-Time public key be used for more than one payment?
However, could a one-time public key receive Monero more than once (as in thousands of times)
Yes, but it is certainly not practical. There are basically two reasons as two why. First, sending Monero ...
- 15.1k
6
votes
Accepted
What cryptography primitives/concepts, other than the basic ones, does Monero use?
Pedersen Commitments and Range Proofs
See https://people.xiph.org/~greg/confidential_values.txt
- 8,448
Only top scored, non community-wiki answers of a minimum length are eligible