20

Best is to sign a message consisting of your address, with your address. The sign and verify commands have been merged just yesterday: https://github.com/monero-project/bitmonero/pull/818 First, make a file with the data you want. It just happens that, when creating a wallet, your address is saved in WALLETNAME.address.txt. Then, sign: sign WALLETNAME....


13

No, or it'd be a break of the crypto. Poloniex can probably get a lower bound (probably much lower than the real number), since it's the main Monero exchange and has been for a long time. But from the blockchain, no. Every single output on the blockchain is on its own one time address, and can't be attached to a standard address without that standard address'...


11

Well, private spend keys are 64 character hex strings, see here: https://moneroaddress.org That will give you around 1e77 possible private keys. If n is the number of possible private keys, and you only generated two private spend keys, the odds they would be the same is: 1 - (n-1)/n Which Python tells me is 0.0 due to floating point arithmetic. In ...


9

The question should be answered here: Monero private key collision TL;DR: There are 2^256 possible private spend keys, which would take 3.67×10^66 years to generate all of them at a rate of 1000 per second. So while it is theoretically possible to have someone else generate the same key, as long as there is a large enough entropy pool for the random ...


6

First note that you can only obtain the private tx key for outgoing transactions, because it's randomly generated by the sender. In the GUI, first go to History tab. Subsequently, you can obtain the private tx key by clicking on Details of the relevant outgoing transaction. Lastly, bear in mind that if you have to rebuild your wallet cache (after you, for ...


5

It will get wrapped around because it's later passed through sc_reduce32 function which performs mod l operation on the input. See below example using silent Matt's big int library which is loaded with llcoins. Easiest to just open the developer tab and type stuff into JS console. To calculate 2^252 + 27742317777372353535851937790883648493: l = JSBigInt(2)...


5

Previously, a method to prove a payment would have been just to reveal the TX secret key r. This worked, because someone knowing the r and the destination address can only unmask destination one-time keys (aka output) in that particular TX and verify that funds sent to some one-time key were indeed sent to a correct address. Problem is, if you reveal r, it'...


5

Two people might independently generate the same address. As Matt2048 says, this is cryptographically negligible, assuming perfectly equiprobable distribution. If someone else was to generate an address, they'd have to check whether there are any Monero on it though, and that isn't free. It can take about 20 minutes to scan the blockchain for a new address. ...


5

There was almost two questions packed into one here (the title and final paragraph), so I'll answer the other. The function sc_reduce32 was written to prevent against data leakage via timing analysis. Division ASM instructions and alternate code branches take a variable number of cycles to complete, and the relative timings could leak data to an observer. So ...


5

I experimented with this using javacsript biginteger library and it is what it says - just a mod l operation. Endianness and encoding could make some confusion, though. From your code it looks like the difference is just in the input/output format. One uses a string with base16 encoding, and the other one uses a byte array. They should both represent the ...


5

Originally Monero used non-deterministic wallets. Deterministic (and mnemonics) are a convenience feature. Take a look at the --non-deterministic command-line flag, which will generate a non-deterministic wallet, and also --restore-from-keys flag, which will restore a non-deterministic wallet (by prompting for the view and spend keys). No functionality is ...


5

Installing a new firmware on a Trezor, it won't be possible to import private keys. Because of the way Hierarchical Deterministic wallets work, a new seed and wallet will be created (with its own set of private keys). Therefore, you should temporarily transfer your bitcoin to another safe offline device while you set up the new firmware and seed and make ...


5

To answer the question for Zcash, spending keys are 252 bits (all of which are valid). There's no practical difference between 252 and 256 bits in terms of the probability of collision for a properly working RNG; both are close enough to zero for reasonable bounds on the number of keys that will ever be generated. For how to calculate this probability, see ...


4

The likelihood of a collision is theoretically 1 in 2^256 which is a number with 78 digits. It's the likelihood of winning the lottery 7 times in a row, or something along those lines. Unless, of course, the random number generator is broken somehow and the "rolls" could be predicted, which I don't believe is the case here. If you were concerned about the ...


4

Great suggestion by PyRulez. Making up a song with the words is another way to memorise them. Of course, this doesn't mean you should only have the song, you need to have a physical backup too just in case!


4

Well you could get your Monero 256 hexadecimal private key from here: https://xmr.llcoins.net/addresstests.html Field#3 (Do not confuse with Field #2) And then use https://www.bitaddress.org to Bip38 encrypt the 256 hex private key. Once you have your Bip38 address like this: 6PRKb345MjC34YBJMxcp5drjqe72GVVt2QsiwjN2bhLe14tfshLYSBKdS7, all you have to do ...


4

Monero can be made to be compliant with the spirit of BIPs 32, 38, 39 and 44. The main issue is BIP 32, 39 and 44 public keys and addresses can't be synthesized using traditional Bitcoin methodologies. BIP 38 has two capabilities. Both are concisely documented at https://github.com/libbitcoin/libbitcoin/wiki/Altcoin-Version-Mappings#bx---key-encryption-...


4

Both the official CLI and GUI will allow you to restore a wallet from keys. In order to import a wallet from keys you need (i) the private spend key, (ii) the private view key, and (iii) the public address. Note that in the current implementation the private spend key is deterministic. Thus, if you only have the private spend key, you can easily "derive" the ...


4

The key image of the real output being spent in a transaction is consistent, regardless of the choice of other outputs referenced as decoys. Therefore if you attempt to spend an output twice, and each time a different set of decoys are chosen, then from the perspective of any nodes listening for transactions it will be obvious which output is the real ...


4

There is a tradition in Monero that when you want to come up with a public key for which there is no known private key, you calculate that public key as H = hash_to_point(G), which in hex is 8b655970153799af2aeadc9ff1add0ea6c7251d54154cfa92c173a0dd39c1f94. Therefore providing proof of payment to any wallet with H as the public spend key would be proof of ...


3

That's almost right. Due to specifics of underlying elliptic cryptography, the biggest private key is l-1, where l is defined in the CN whitepaper as: l = 2^252 + 27742317777372353535851937790883648493 Anything bigger than that will get wrapped around by performing mod l operation so you'll always end up with a private key below l. Also, private view key ...


3

I'd recommend sticking with xprv and xpub in accordance with the BIP43 recommendation which states: Because this scheme can be used to generate nodes for more cryptocurrencies at once, or even something totally unrelated to cryptocurrencies, there's no point in using a special version magic described in section "Serialization format" of BIP32. We suggest ...


3

In Monero, every output has a one-time (unique) public key. No output on the blockchain can be associated with any particular wallet address because these output public keys are not the same as your wallet's public keys. Outputs can be spent if there is knowledge of the one-time private key that corresponds to the output's one-time public key. Therefore, ...


3

Is the number of possibilties of the 24 words the same as the 256 bits? So: are there 2^255 possible 24 word combinations or is it only a subset of the possibilities? Actually, it's just a little bit more than needed to encode a 256-bit number. Possible 24 word combinations (=1626^24) > possible 256 bits combinations (=2^256). If it is just a subset, it ...


3

There's an additional step performed, called "normalization". It's just a modulo operation with l. See sc_reduce32 ... is it really supposed to be that complicated? Oh and note that mnemonic is decoded to seed and then: spendkey = sc_reduce(seed) viewkey = sc_reduce(keccak(spendkey)) New versions of wallets roll a random 256bits, normalize it and use ...


3

One method is to use this tool (made by Luigi from Monero core team). enter your mnemonic into field 1. enter a password into field 8. select 'CN Add' as the method, and click encrypt As described on the page, this works as following: In the "CN Add" method, the key is hashed with CryptoNight, then interpreted as a private key/scalar and added to the ...


3

One good way to memorize something is by telling a story. Unfortunately, turning a bunch of completely random words into one is quite hard. Luckily, if you limit the words just slightly, we get Mad Libs Let's assume that there are 8192 words in each part of speech 8192 words (it will vary wildly, but that's a rough estimate. When you actually do this, do ...


3

A private spend key is a positive integer lesser than l = 7237005577332262213973186563042994240857116359379907606001950938285454250989 (which is a 253-bit integer). The usual process to make a private spend key is to generate a random 256-bit integer and then reduce it modulo l. The private spend keys are usually represented in one of the following ways: ...


2

Yes it does make sense for Monero to support BIP 39 words used by traditional HD hardware wallets such as Trezor, Keepkey or Ledger. We will see how much the https://forum.getmonero.org/4/academic-and-technical/2495/experimental-trezor-firmware-testing distribution for tailored Monero Trezor firmware, a forked simplewallet, and a forked trezorctl command ...


2

Monero currently uses MLSAG ring signatures for the ring of possible outputs being spent. Borromean ring signatures are currently used only for the 'range proofs' which demonstrate that output amount Pedersen commitments are not negative. Later this year, the Borromean signatures for range proofs will be swapped out in favor of Bulletproofs, which are more ...


Only top voted, non community-wiki answers of a minimum length are eligible