20

The auditor will see that you have omitted part of the key images. The auditor can see all the outputs received by your account. Without the spend key, the auditor cannot generate the key images corresponding to those, however. In order to prove your balance, you generate a signed list of key images (see https://github.com/monero-project/bitmonero/pull/928 ...


14

Monero are always sent to the one-time destination (public key) P. In the CN whitepaper, the corresponding private key is referred to as x. When you're spending, you're combining your P with a couple of other ones in a ring signature and signing with the x. Only one of the Ps will be spent, but the ring signatures hide which one. In other words, the ...


11

The key image is an alternate public key computed on a second base point, specifically Hp(P), instead of G. It is required in traceable ring signature construction to ensure multiple signatures with the same real key are linked (and thus rejected by the Monero protocol).


9

If the auditor wanted to confirm you had sent funds to a specific address, they'll then need to have the view key of that address also. The only thing the view key of your address can determine which outputs were sent to its corresponding public key. The key images can confirm when a transaction took place, and how much was was moved from your address. It ...


9

Every fund is associated with its output public key P = x G and the secret key x is ultimately the only thing needed for spending the fund (i.e., for generating a valid signature), just like Bitcoin. A key image I = x Hash(P) where Hash(.) is a hash function that maps arbitrary data to a curve point, is merely needed to prevent double spending while ...


8

Looks like it was being exploited on Bytecoin For example, these 2 transactions spend the output 26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05 twice! http://chainradar.com/bcn/transaction/cef289d7fab6e35ac123db8a3f06f7675b48067e0dff185c72b140845b8b3b23 http://chainradar.com/bcn/transaction/...


7

Given a finite group of integers, any group element Z in a group of order n, Z^n will always equal the identity element (order == number of elements in group). ECC has an equivalent abstraction - multiplying any point in a finite group by the order of the group will result in the identity element. The identity element is analogous to zero in the set of ...


7

Is it possible to get a transaction key image from a Paperwallet without exposing the spendkey or seed? It depends on your definition of "expose". Key images can of course be computed offline, even by some self-contained hypothetical device, but you are still "exposing" your spend key to that device. You could do the necessary math on paper if you want, ...


7

Section 4.4 of CN white-paper describes this. With the ring signature, all the keys used are equivalent, so you can't say which one is the actual signer. The signature can be checked against any of the public keys used in the ring. Let's define our one-time keys as P = xG Where P is the public key, x the private key, and G the EC basepoint. If we let the ...


6

No, he can not. An "output" is actually a one-time key-pair. It consists of an one-time public key, which resides on the blockchain, can be seen by everyone (but it can be matched to a wallet only by having the private view key and the public spend key), and acts as a container which holds some funds. It has a corresponding private key, which can be ...


5

Any output can be used as a "decoy" at any time after it matures, whether this is before or after it's been spent. In the general case [1], the network cannot determine when an output is spent, and thus does not treat spent outputs differently from unspent ones. Indeed, if the network could determine whether any output was spent, it would mostly defeat the ...


5

There are two hash functions you'll see referenced often with Monero - there is Hs and Hp. Hs means "hash to scalar", meaning take a keccak(256) hash and then ensure the result is a "scalar" (a positive integer less than 2252 + 27742317777372353535851937790883648493). Hp means "hash to point", meaning take a keccak(256) hash, interpret the resulting bytes ...


5

The layman's way to look at what a key image is would be that it allows the Monero network to quickly confirm whether an output as been spent or not. In other words, the key image is a necessary component of Monero's opaque blockchain ecosystem, because it allows for the prevention of double-spends. For more information on this concept, please refer to ...


5

It is impossible to calculate what the address is that corresponds to a given one-time address (there are actually multiple possibility). It is possible to check if a transaction corresponds to a given address. An auditor would need both your outgoing tx keys, and an address book to figure out where the funds are going.


5

Page 11 in that paper is still only concerned with the general ring signature case, not particularly focused on the Pedersen Commitment part. The MGs field corresponds to the struct mgSig in src/ringct/rctTypes.h: typedef std::vector<key> keyV; //vector of keys typedef std::vector<keyV> keyM; //matrix of keys (indexed by column first) struct ...


5

1. What is the hash function Hp? The Hp is the hash-to-point function. Result of that would be some random point on the Ed25519 curve. In the CN whitepaper it's defined as: H_p: a deterministic hash function E(F_q) -> E(F_q) If I understand well, it takes any point on the curve, and yields a random point on the same curve. The implementation is in the ...


4

The reason we use elliptic curve multiplication is that it is a trapdoor function. This means you can multiply by a point, but you can't divide by a point. Trapdoor functions are an essential component in any asymmetric encryption scheme (i.e. anything involving public and private keys). If we didn't need a trapdoor function, there would be no point in using ...


4

The above answer by Lee Clagett is also helpful for understanding how the exploit on Bytecoin took place, which is different and less effective than the exploit discovered by MRL. The attacker first transferred funds from a valid Ed25519 point to a low-order point. Let us denote this low-order point as P. The signature for double-spend checking consists of a ...


4

In monero transactions every output is sent to a One-Time Public Key (stealth address), which is derived from the recipient Public Key, the position or index of the output in the transaction and a random number generated by the sender. As ferretinjapan explained, only the receiver may check if that One-Time Key is derived from his Public Key.


4

Looking at the code, we can see how it's generated. void crypto_ops::generate_key_image(const public_key &pub, const secret_key &sec, key_image &image) { ge_p3 point; ge_p2 point2; assert(sc_check(&sec) == 0); hash_to_ec(pub, point); ge_scalarmult(&point2, &sec, &point); ge_tobytes(&image, &point2);...


4

It is my understanding that the Monero trezor firmware uses the private view key. Monero Trezor has access to all your keys, but it's contained in the device and thus safe to use. This might lead to some privacy concerns. There can be no privacy concerns considering how everything works. Only you have access to your keys and the keys never leave the ...


4

When you send TXO A, it doesn't stay unchanged in wallet 2, it it now a new TXO A2 (with a one time address for wallet 2) that can't be linked with certainty to TXO A because of the ring signature. According to the CryptoNote whitepaper, the key image is computed from the one-time key pair associated to the transaction output: I = x*H(P) where: I is the ...


4

The key image is not the same as the actual key, so they should not be able to sign a transaction without the actual key. The key image prevents double spends, but it is not sufficient in of itself to spend coins.


4

The issue sounds like a wallet has a wrong view of what outputs are spent. A fix would be to rescan the wallet (rescan_spent or rescan_bc in Monero's wallet, or delete the cache file). The "full reward zone" is completely and entirely unrelated to potential wallet sync issues.


4

The key image of the real output being spent in a transaction is consistent, regardless of the choice of other outputs referenced as decoys. Therefore if you attempt to spend an output twice, and each time a different set of decoys are chosen, then from the perspective of any nodes listening for transactions it will be obvious which output is the real ...


4

An output has public key P and private key x, where P = xG and G is the well-known ed25519 base point. The key image is I=x*Hp(P) where Hp() is a function that takes a hash of P and returns a valid curve point. Couldn’t you just hash the private key of the real input? Take a look at the section 3.4 Back’s Linkable Spontaneous Anonymous Group (bLSAG) ...


3

The easiest thing to do, in my view (due to it being the most thorough), is to set up a normal wallet and daemon on an air-gapped computer (one not connected to the internet). Your air-gapped wallet will contain both the private viewkey and the private spendkey. You can periodically save a copy of the blockchain from an internet-facing computer, transfer ...


3

Another explanation: there is a one-to-one mapping between an output public key P and its key image I as I=x*H_p(P) where x is the private key of P and H_p() is a hash-to-pubkey function. What's important here is that this mapping is secret and can be established only by the wallet owner knowing x. Also note that it's easy for anyone to tell that a given ...


3

The signature verification algorithm will only return a "correct signature" result if P is equal to x·G (i.e. the real spent output's public key is derived from the output's secret spend key x) and if I is equal to x·Hp(P) (i.e. the key image I is derived from the output's secret spend key x). If you can understand the algorithms on page 6 of MRL-0003, you ...


3

The hash_to_ec function in Mininero is not the same as the one used in the Monero C codebase. You need to use hashToPointCN from Mininero instead. See https://github.com/monero-project/mininero/blob/master/mininero.py#L238 If you're looking for the C version of this, you can find it named hash_to_ec here: https://github.com/monero-project/monero/blob/...


Only top voted, non community-wiki answers of a minimum length are eligible