20

Monero doesn't use EdDSA, which all of those libraries are specifically set up for. We don't use SHA512 at all, but rather Keccak (~SHA3). We don't use secret keys as seeds like EdDSA does, but rather as scalars. If you look at ed25519.py on L63, you can see what I'm talking about. Change the function to look like this: def publickey(sk): a = decodeint(...


11

https://safecurves.cr.yp.to/ (joint work between Daniel J. Bernstein, University of Illinois at Chicago, USA, and Tanja Lange, Technische Universiteit Eindhoven, Netherlands) has rated Curve25519 as "safe" The specific reasons why CryptoNote creators chose Curve25519 are unclear but it appears to be trusted by top cryptographers. Monero developers trust ...


10

While interesting, it's not really applicable to cryptography utilized by Monero as the trapdoored one is specific to 1024-bit prime numbers. Monero utilizes elliptic curve cryptography, more specifically the curve Ed25519, which has been time tested as it has been pointed out here. The DH scheme is indeed used, but it's not the same kind, but the one ...


10

The underlying Elliptic Curve that is used for Monero's cryptography is the Twisted Edwards curve Ed25519, and this is the same curve used in applications like OpenSSH, Tor, Tox, I2P, Facebook Messenger, Google, Whatsapp, and others. That doesn't, by itself, guarantee that it is flawless, but it is a very good endorsement IMO, and it is a bigger test of time ...


8

G is the base point of the Ed25519 elliptic curve. The x coordinate is not written explicitly because it can be found back using the y coordinate, the sign of x and the equation of the curve (x is positive for G). Points on the Ed25519 curve are represented by 32 bytes. These 32 bytes are in fact the little-endian representation of a 256-bit number. bits 0 ...


8

Looks like it was being exploited on Bytecoin For example, these 2 transactions spend the output 26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05 twice! http://chainradar.com/bcn/transaction/cef289d7fab6e35ac123db8a3f06f7675b48067e0dff185c72b140845b8b3b23 http://chainradar.com/bcn/transaction/...


7

One weakness that Bitcoin and Monero both share are from quantum computing. With quantum computing, significantly less energy would be required to crack private keys. Therefore Monero is (essentially) equally secure, withstanding that quantum computation is not available.


7

This image says that all the energy of the sun would not be enough to try all the Bitcoin private keys (256-bit keys). The elliptic curve that Monero uses works with 255-bit private keys, and trying all of them would not be feasible either.


7

Given a finite group of integers, any group element Z in a group of order n, Z^n will always equal the identity element (order == number of elements in group). ECC has an equivalent abstraction - multiplying any point in a finite group by the order of the group will result in the identity element. The identity element is analogous to zero in the set of ...


6

Although it wasn't clear to the reviewers at the time, the constants are standard ed25519 constants from DJB et al. You can read about it here, especially section "Choice of curve" starting on the bottom of page 7.


5

Monero's existing mnemonic scheme simply translates back and forth between a 32 byte scalar and a 25-word checksummed mnemonic. At the moment, that's used to store the 32 byte seed. There is no reason it can't be used to produce a mnemonic from the 32 byte private view key. However, you need to know both your private view key and your public spend key in ...


5

In your system although the recipient can still find his transaction using R, he would also need to know r for deriving the corresponding private key. You could fix that by making r also public, and still only the user would be able to derive the private key ra+b, but then everyone in the network can figure out that the recipient was the address (A,B)... ...


4

You can check if a point is on the curve by attempting to decode it (it is checked as part of that). In c this is here, but that doesn't make a lot of sense. In python (ctrl+f "isoncurve", which is called by "decodepoint"), it's laid out pretty succinctly. It doesn't cost much. Now, I realize this isn't the answer to your question, but I think it might be ...


4

The above answer by Lee Clagett is also helpful for understanding how the exploit on Bytecoin took place, which is different and less effective than the exploit discovered by MRL. The attacker first transferred funds from a valid Ed25519 point to a low-order point. Let us denote this low-order point as P. The signature for double-spend checking consists of a ...


4

G is a universally agreed-upon base point. Almost everyone that uses ed25519, including Monero, uses the same G. H is an agreed-upon base point within Monero's implementation of the Pedersen commitment scheme. It is chosen arbitrarily such that it is impossible to know the discrete log with respect to G (i.e. there is some x such that xG == H, but x will ...


3

Assuming G is the base point and i is a scalar (the convention is to write points in capital letters and scalars in lowercase letters): rct::key tmp; sc_mul(i.bytes, i.bytes, i.bytes); // i = i^2 sc_mul(tmp.bytes, a.bytes, i.bytes); // tmp = a * i^2 rct::scalarmultBase(tmp, tmp); // tmp = a * i^2 * G The rct API is easier to use than the fe/ge API, ...


3

Elliptic curve cryptography (ECC) is a form of public-key cryptography where mathematical properties of elliptic curves are used to ensure security of cryptographic methods used. This allows to perform the following in a secure way: Public key encryption, where the sender can encrypt a message using the recipient's public key, and the recipient can decrypt ...


3

Monero uses ed25519. The code in the github link you referenced (which I helped write) uses curve25519 instead of ed25519. The reason is that that code was to prototype RTRS RingCT, which relies heavily on variable base scalar multiplication. Curve25519 is higher performance at variable base scalar multiplication than ed25519. Prior to switching that ...


3

Monero's stealth addressing works like this: You start with a destination wallet address, which is a pair of public keys A, B which have corresponding private keys a, b known only to the recipient. A Diffie-Hellman exchange is performed, resulting in a shared secret which can be transformed to produce a private key s. A public key S corresponding to the ...


2

Monero has a sound cryptographic protocol which has been time tested for about the past 3 years. To answer your question, Monero doesn't have any back door, and brute-forcing Monero isn't possible either, even if all of sun's energy is used in a computer performing such attack. Monero is safe from such issues.


2

Small subgroup of size 1: 0100000000000000000000000000000000000000000000000000000000000000 Small subgroup of size 2: ecffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff7f 0100000000000000000000000000000000000000000000000000000000000000 Small subgroup of size 4: 0000000000000000000000000000000000000000000000000000000000000000 ...


2

Let's start by first defining a couple of things. Outputs created in a coinbase transaction can later be spent by using them as inputs to a subsequent transaction. A transaction also has a public key, which is used as the public part of a secret (it's shared, it's in the tx which is on the blockchain). When constructing a coinbase (miner) transaction, the ...


1

This question seems to boil down to whether Keccak is suitable for the random oracle model. This answer on crypto.stackexchange.com should answer your question: https://crypto.stackexchange.com/q/70707/69644 As far as I know, there is no bias when going from the low order group to the prime subgroup. Sidenote: there was an unrelated attack related to the ...


1

There are two birationally equivalent variants of X25519, which are Curve25519 and Ed25519. Monero uses only Ed25519. There might be performance reasons for using Curve25519 vs Ed25519 depending on whether you're doing variable base or double base scalar multiplication, but I can't think of a reason that Ed25519 would limit you functionally. Curves provide ...


1

Hash to point first uses keccak, and then interprets the result as an EC point. The point is multiplied by 8 to ensure that the point is in the group of the base point G. You can see the implementation in the Monero codebase here: https://github.com/monero-project/monero/blob/8f6f674753bae7494e1ee4569004947d47a4e983/src/crypto/crypto.cpp#L481


1

Yes. There is nothing special about the base point G that you mention. It's just an arbitrary point agreed upon by convention to be used to transform private keys (scalars) into public keys via scalar multiplication. Scalar multiplication with points other than G happens during the Diffie Hellman exchange which is part of the generation of stealth addresses. ...


1

Stealth addresses can be supported by any public private key cryptography that supports a Diffie-Hellman (DH) Key Exchange. DH Key Exchanges are not unique to elliptic curve cryptography. The first half of DF Key exchange occurs in the encoding of the recipient's address. The second half of the DH Key Exchange occurs as info is persistently stored on the ...


1

BIP32 recommends that 256 bits of entropy are used to generate a Bitcoin wallet. See https://github.com/bitcoin/bips/blob/master/bip-0032.mediawiki#Master_key_generation This means that the 13 word, 128 bit seeds used in many Bitcoin wallets actually go against the recommendation in BIP32. Monero is following the recommendations of BIP32 by using 256 bits ...


1

Someone can correct me if I'm wrong, but I don't believe Monero uses Diffie-Hellman keys anywhere. The link you posted also says only that 1024-bit DH keys could be compromised, but for the last several years or more it is common practice to use 2048-bit or higher DH keys. When I set up a VPN, I typically use a 4096-bit DH key. If Monero does use DH keys, ...


Only top voted, non community-wiki answers of a minimum length are eligible