Skip to main content
21 votes
Accepted

Why/how does monero generate public ed25519 keys without using the standard public key generation provided by ed25519 libraries?

Monero doesn't use EdDSA, which all of those libraries are specifically set up for. We don't use SHA512 at all, but rather Keccak (~SHA3). We don't use secret keys as seeds like EdDSA does, but rather ...
Luigi's user avatar
  • 2,462
11 votes
Accepted

Comparison of Curve25519 with secp256k1?

https://safecurves.cr.yp.to/ (joint work between Daniel J. Bernstein, University of Illinois at Chicago, USA, and Tanja Lange, Technische Universiteit Eindhoven, Netherlands) has rated Curve25519 as "...
David's user avatar
  • 420
10 votes
Accepted

Is a Monero key backdoor possible?

While interesting, it's not really applicable to cryptography utilized by Monero as the trapdoored one is specific to 1024-bit prime numbers. Monero utilizes elliptic curve cryptography, more ...
JollyMort's user avatar
  • 19.9k
10 votes

Is a Monero key backdoor possible?

The underlying Elliptic Curve that is used for Monero's cryptography is the Twisted Edwards curve Ed25519, and this is the same curve used in applications like OpenSSH, Tor, Tox, I2P, Facebook ...
user141's user avatar
  • 3,327
10 votes
Accepted

What is the 'base point' (G) from the whitepaper and how is it represented as a single hex value?

G is the base point of the Ed25519 elliptic curve. The x coordinate is not written explicitly because it can be found back using the y coordinate, the sign of x and the equation of the curve (x is ...
glv's user avatar
  • 3,334
8 votes

How does the recent patched key image exploit work in practice?

Looks like it was being exploited on Bytecoin For example, these 2 transactions spend the output 26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05 twice! http://chainradar.com/bcn/...
JollyMort's user avatar
  • 19.9k
7 votes

How strong is Monero cryptography against brute-force attacks?

One weakness that Bitcoin and Monero both share are from quantum computing. With quantum computing, significantly less energy would be required to crack private keys. Therefore Monero is (...
Daniel Ternyak's user avatar
7 votes

How strong is Monero cryptography against brute-force attacks?

This image says that all the energy of the sun would not be enough to try all the Bitcoin private keys (256-bit keys). The elliptic curve that Monero uses works with 255-bit private keys, and trying ...
glv's user avatar
  • 3,334
7 votes
Accepted

How does the recent patched key image exploit work in practice?

Given a finite group of integers, any group element Z in a group of order n, Z^n will always equal the identity element (order == number of elements in group). ECC has an equivalent abstraction - ...
Lee Clagett's user avatar
6 votes
Accepted

How were Monero elliptic curve constants chosen?

Although it wasn't clear to the reviewers at the time, the constants are standard ed25519 constants from DJB et al. You can read about it here, especially section "Choice of curve" starting on the ...
Luigi's user avatar
  • 2,462
6 votes

Curve used in Monero - A Subgroup of Ed25519?

Building on Knaccc's answer. Curve25519 The first step to build an Elliptic curve library is to define a field of prime characteristic. In this case, the field is 2^255 - 19, I denote this with K. ...
user679128's user avatar
5 votes
Accepted

Is a mnemonic for view only wallet possible?

Monero's existing mnemonic scheme simply translates back and forth between a 32 byte scalar and a 25-word checksummed mnemonic. At the moment, that's used to store the 32 byte seed. There is no ...
knaccc's user avatar
  • 8,468
5 votes
Accepted

Why does the stealth address involve a hash function?

In your system although the recipient can still find his transaction using R, he would also need to know r for deriving the corresponding private key. You could fix that by making r also public, and ...
user141's user avatar
  • 3,327
4 votes
Accepted

How to see that the RingCT commitment parameter H is in fact a multiple of the base point G

You can check if a point is on the curve by attempting to decode it (it is checked as part of that). In c this is here, but that doesn't make a lot of sense. In python (ctrl+f "isoncurve", which is ...
Luigi's user avatar
  • 2,462
4 votes
Accepted

Do stealth address only work with elliptic curve cryptography ?

Monero's stealth addressing works like this: You start with a destination wallet address, which is a pair of public keys A, B which have corresponding private keys a, b known only to the recipient. A ...
knaccc's user avatar
  • 8,468
4 votes

How does the recent patched key image exploit work in practice?

The above answer by Lee Clagett is also helpful for understanding how the exploit on Bytecoin took place, which is different and less effective than the exploit discovered by MRL. The attacker first ...
kenshi84's user avatar
  • 2,475
4 votes

Curve used in Monero - A Subgroup of Ed25519?

To this end, the field elements in the implementation of Monero seem to be multiplied by 8 to ensure they lie in the smaller subgroup The group elements are multiplied by 8 to ensure they lie in ...
knaccc's user avatar
  • 8,468
3 votes

Who Generates parameters G & H for Pedersen commitment in Monero?

G is a universally agreed-upon base point. Almost everyone that uses ed25519, including Monero, uses the same G. H is an agreed-upon base point within Monero's implementation of the Pedersen ...
knaccc's user avatar
  • 8,468
3 votes
Accepted

Multiplication over an elliptic curve using the monero cryptographic libraries

Assuming G is the base point and i is a scalar (the convention is to write points in capital letters and scalars in lowercase letters): rct::key tmp; sc_mul(i.bytes, i.bytes, i.bytes); // i = i^2 ...
user36303's user avatar
  • 34.9k
3 votes
Accepted

What is elliptic curve cryptography and why is it important to Monero?

Elliptic curve cryptography (ECC) is a form of public-key cryptography where mathematical properties of elliptic curves are used to ensure security of cryptographic methods used. This allows to ...
JollyMort's user avatar
  • 19.9k
3 votes
Accepted

How to convert monero's curve25519 basepoint to bouncycastle

Monero uses ed25519. The code in the github link you referenced (which I helped write) uses curve25519 instead of ed25519. The reason is that that code was to prototype RTRS RingCT, which relies ...
knaccc's user avatar
  • 8,468
3 votes
Accepted

Possible error in book Zero to Monero: Second Edition

Is this an error or am I misunderstand something? No it is not an error, you are misunderstanding. Since the group is cyclic, we can identify it with... Next we check if 5 is in... Group elements ...
jtgrassie's user avatar
  • 19.1k
2 votes

Is a Monero key backdoor possible?

Monero has a sound cryptographic protocol which has been time tested for about the past 3 years. To answer your question, Monero doesn't have any back door, and brute-forcing Monero isn't possible ...
MoneroWarrior's user avatar
2 votes
Accepted

Generating key derivation in construct_miner_tx

Let's start by first defining a couple of things. Outputs created in a coinbase transaction can later be spent by using them as inputs to a subsequent transaction. A transaction also has a public key, ...
jtgrassie's user avatar
  • 19.1k
2 votes
Accepted

What are the hex representations of the small subgroup curve points on Ed25519?

Small subgroup of size 1: 0100000000000000000000000000000000000000000000000000000000000000 Small subgroup of size 2: ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f ...
knaccc's user avatar
  • 8,468
2 votes

Do stealth address only work with elliptic curve cryptography ?

Stealth addresses can be supported by any public private key cryptography that supports a Diffie-Hellman (DH) Key Exchange. DH Key Exchanges are not unique to elliptic curve cryptography. The first ...
skaht's user avatar
  • 1,576
2 votes
Accepted

How to compute ringct multisignature key images? (Disambiguation of MRL005)

1 & 2 - Pe | Pj is concatenation of the keys. 3 - Keccak, although as @knaccc comments, H() is not simply a hash function, it's hash-to-point, so should read Hp().
jtgrassie's user avatar
  • 19.1k
2 votes
Accepted

ed25519 problem with libsodium implementation S_a + S_b = (s_a+s_b)*G

This: sodium.crypto_core_ed25519_add(sumPrivate, s_a, s_b); //sumPrivate = s_a + s_b is wrong. crypto_core_ed25519_add adds points, not scalars. For adding scalars you should use ...
jtgrassie's user avatar
  • 19.1k
1 vote
Accepted

How can we be sure that there is no bias in calculating H?

This question seems to boil down to whether Keccak is suitable for the random oracle model. This answer on crypto.stackexchange.com should answer your question: https://crypto.stackexchange.com/q/...
user679128's user avatar
1 vote

Implementation of monero on other curves

There are two birationally equivalent variants of X25519, which are Curve25519 and Ed25519. Monero uses only Ed25519. There might be performance reasons for using Curve25519 vs Ed25519 depending on ...
knaccc's user avatar
  • 8,468

Only top scored, non community-wiki answers of a minimum length are eligible