20 votes
Accepted

Can I fake a balance by giving the view key to an auditor but omitting some transactions and key images?

The auditor will see that you have omitted part of the key images. The auditor can see all the outputs received by your account. Without the spend key, the auditor cannot generate the key images ...
  • 34.6k
15 votes
Accepted

What is a key image?

Monero are always sent to the one-time destination (public key) P. In the CN whitepaper, the corresponding private key is referred to as x. When you're spending, you're combining your P with a couple ...
  • 19.8k
12 votes

What is a key image?

The key image is an alternate public key computed on a second base point, specifically Hp(P), instead of G. It is required in traceable ring signature construction to ensure multiple signatures with ...
  • 2,432
9 votes
Accepted

Does publishing view key and key images give the auditor the information on where I sent the funds?

If the auditor wanted to confirm you had sent funds to a specific address, they'll then need to have the view key of that address also. The only thing the view key of your address can determine which ...
9 votes
Accepted

Is it safe to share my key images with other people?

Every fund is associated with its output public key P = x G and the secret key x is ultimately the only thing needed for spending the fund (i.e., for generating a valid signature), just like Bitcoin. ...
  • 2,475
8 votes

How does the recent patched key image exploit work in practice?

Looks like it was being exploited on Bytecoin For example, these 2 transactions spend the output 26e8958fc2b227b045c3f489f2ef98f0d5dfac05d3c63339b13802886d53fc05 twice! http://chainradar.com/bcn/...
  • 19.8k
7 votes

Can the import\export key images command can be used to check the balance of a paperwallet?

Is it possible to get a transaction key image from a Paperwallet without exposing the spendkey or seed? It depends on your definition of "expose". Key images can of course be computed offline, even ...
  • 2,432
7 votes
Accepted

What signature prevents me from spending others' coins?

Section 4.4 of CN white-paper describes this. With the ring signature, all the keys used are equivalent, so you can't say which one is the actual signer. The signature can be checked against any of ...
  • 19.8k
7 votes
Accepted

How does the recent patched key image exploit work in practice?

Given a finite group of integers, any group element Z in a group of order n, Z^n will always equal the identity element (order == number of elements in group). ECC has an equivalent abstraction - ...
6 votes
Accepted

How do key images really work?

1. What is the hash function Hp? The Hp is the hash-to-point function. Result of that would be some random point on the Ed25519 curve. In the CN whitepaper it's defined as: H_p: a deterministic ...
  • 19.8k
6 votes
Accepted

Is making a key image public equal to giving the monero in that output away?

No, they cannot. An "output" is actually a one-time key-pair. It consists of a one-time public key, which resides on the blockchain, can be seen by everyone (but it can be matched to a ...
  • 19.8k
5 votes
Accepted

Can an output be used as a decoy after it has been spent?

Any output can be used as a "decoy" at any time after it matures, whether this is before or after it's been spent. In the general case [1], the network cannot determine when an output is spent, and ...
  • 34.6k
5 votes
Accepted

Key-image generation: What does p signify in I = xHp(P)?

There are two hash functions you'll see referenced often with Monero - there is Hs and Hp. Hs means "hash to scalar", meaning take a keccak(256) hash and then ensure the result is a "scalar" (a ...
  • 8,418
5 votes

What is a key image?

The layman's way to look at what a key image is would be that it allows the Monero network to quickly confirm whether an output as been spent or not. In other words, the key image is a necessary ...
5 votes

Does publishing view key and key images give the auditor the information on where I sent the funds?

It is impossible to calculate what the address is that corresponds to a given one-time address (there are actually multiple possibility). It is possible to check if a transaction corresponds to a ...
  • 3,120
5 votes
Accepted

Detecting the real output in ring signature

The reason we use elliptic curve multiplication is that it is a trapdoor function. This means you can multiply by a point, but you can't divide by a point. Trapdoor functions are an essential ...
  • 8,418
5 votes
Accepted

Understanding MLSAG in Monero transaction

Page 11 in that paper is still only concerned with the general ring signature case, not particularly focused on the Pedersen Commitment part. The MGs field corresponds to the struct mgSig in src/...
  • 694
4 votes

How does the recent patched key image exploit work in practice?

The above answer by Lee Clagett is also helpful for understanding how the exploit on Bytecoin took place, which is different and less effective than the exploit discovered by MRL. The attacker first ...
  • 2,475
4 votes

Does publishing view key and key images give the auditor the information on where I sent the funds?

In monero transactions every output is sent to a One-Time Public Key (stealth address), which is derived from the recipient Public Key, the position or index of the output in the transaction and a ...
4 votes
Accepted

What is the deterministic hash to EC function used to construct the key image?

Looking at the code, we can see how it's generated. void crypto_ops::generate_key_image(const public_key &pub, const secret_key &sec, key_image &image) { ge_p3 point; ge_p2 point2;...
  • 19.8k
4 votes

Trezor firmware, private view key, key image and privacy

It is my understanding that the Monero trezor firmware uses the private view key. Monero Trezor has access to all your keys, but it's contained in the device and thus safe to use. This might lead ...
  • 19.8k
4 votes
Accepted

What are the "ingredients" of a key image?

When you send TXO A, it doesn't stay unchanged in wallet 2, it it now a new TXO A2 (with a one time address for wallet 2) that can't be linked with certainty to TXO A because of the ring signature. ...
  • 3,314
4 votes

Is making a key image public equal to giving the monero in that output away?

The key image is not the same as the actual key, so they should not be able to sign a transaction without the actual key. The key image prevents double spends, but it is not sufficient in of itself ...
4 votes
Accepted

bad balanced CURRENCY_BLOCK_GRANTED_FULL_REWARD_ZONE constant

The issue sounds like a wallet has a wrong view of what outputs are spent. A fix would be to rescan the wallet (rescan_spent or rescan_bc in Monero's wallet, or delete the cache file). The "full ...
  • 2,432
4 votes
Accepted

Does the Key Image leak privacy information?

The key image of the real output being spent in a transaction is consistent, regardless of the choice of other outputs referenced as decoys. Therefore if you attempt to spend an output twice, and ...
  • 8,418
4 votes
Accepted

Help needed with calculating a key image

The hash_to_ec function in Mininero is not the same as the one used in the Monero C codebase. You need to use hashToPointCN from Mininero instead. See https://github.com/monero-project/mininero/blob/...
  • 8,418
4 votes
Accepted

Why is a key image xHp(P), and not something simpler like Hs(x)?

An output has public key P and private key x, where P = xG and G is the well-known ed25519 base point. The key image is I=x*Hp(P) where Hp() is a function that takes a hash of P and returns a valid ...
  • 8,418
3 votes

How can I check if a key image has been imported into a view wallet?

The easiest thing to do, in my view (due to it being the most thorough), is to set up a normal wallet and daemon on an air-gapped computer (one not connected to the internet). Your air-gapped wallet ...
3 votes

Is making a key image public equal to giving the monero in that output away?

Another explanation: there is a one-to-one mapping between an output public key P and its key image I as I=x*H_p(P) where x is the private key of P and H_p() is a hash-to-pubkey function. What's ...
  • 2,475
3 votes
Accepted

Is it easily provable by a third party that the key image used in a transaction is associated with the spent output without revealing the (P,I) pair?

The signature verification algorithm will only return a "correct signature" result if P is equal to x·G (i.e. the real spent output's public key is derived from the output's secret spend key x) and if ...
  • 3,314

Only top scored, non community-wiki answers of a minimum length are eligible