15
votes
Accepted
If I send two transactions to the same recipient, can they infer the true sender?
Your public address will never appear on the blockchain. What you're spending is amounts sent to one-time destinations so they're unlinked. Not only that, but each one-time addres will be "mixed" with ...
- 20k
11
votes
Accepted
Can someone walk me through a simple example to explain how RingCT works?
Let's say you'll use two of your outputs, 12.34 XMR and 7.89 XMR and send 18.37 XMR to your recipient for a fee of 0.022 XMR and change of 1.838 XMR. If you use mixin of 4, you'll be creating two ...
- 2,485
9
votes
What's the point of ring signatures if stealth addresses hide the actual addresses anyways?
Stealth addresses mask a receiver, so 5 different people could all send XMR to the same address, but the construction of stealth addresses is such that none of the 5 people could tell that any of the ...
- 3,737
8
votes
Accepted
What are MLSAGs, and what is their significance for Monero and/or RingCT?
MLSAG is an acronym for "Multilayered Linkable Spontaneous Anonymous Group". The MLSAG signatures are the type of signatures used by Shen Noether's Ring Confidential Transactions [1], based upon ...
- 34.9k
7
votes
Accepted
What signature prevents me from spending others' coins?
Section 4.4 of CN white-paper describes this. With the ring signature, all the keys used are equivalent, so you can't say which one is the actual signer. The signature can be checked against any of ...
- 20k
7
votes
Accepted
How are outputs chosen on the blockchain for ring signatures in a transaction?
You must choose mix inputs of the same amount as the one you are spending. Other than that there are no restrictions, though it's not a good idea to choose a really recent output (less than 10 blocks ...
- 2,472
7
votes
What's the point of ring signatures if stealth addresses hide the actual addresses anyways?
Stealth addressing provides unlinkability (outputs are not associated with wallet addresses on the blockchain). Ring signatures provide untraceability.
Untraceability means that the source of funds ...
- 8,518
5
votes
Accepted
Understanding MLSAG in Monero transaction
Page 11 in that paper is still only concerned with the general ring signature case, not particularly focused on the Pedersen Commitment part.
The MGs field corresponds to the struct mgSig in src/...
- 704
5
votes
Accepted
Can an output be used as a decoy after it has been spent?
Any output can be used as a "decoy" at any time after it matures, whether this is before or after it's been spent.
In the general case [1], the network cannot determine when an output is spent, and ...
- 34.9k
5
votes
Accepted
Will quantum computer break ring signatures?
"Normal" ring signatures aren't broken (meaning the true signer is revealed) by QC, but their security certainly is (unforgeability). However, the traceable version Monero uses (for double-spending ...
- 2,472
5
votes
Accepted
How do ringct transactions use previous non-ringct outputs in a ring signature with ringct?
I'd say it's pretty straightforward. In the normal situation where input and output are both Pedersen Commitments, i.e.,
C_i = x_i G + a_i H
D_j = y_j G + b_j H
, the network confirms the ...
- 2,485
5
votes
With a Churn: does it increase privacy more to do 1 TX with RingSize14 or 2 TX with RingSize7 or is it exactly the same?
If you churn twice, and every input you reference came from transactions that used ring size 7 (where one of those transactions would have been your first churn transaction), then your anonymity set ...
- 8,518
5
votes
Accepted
Detecting the real output in ring signature
The reason we use elliptic curve multiplication is that it is a trapdoor function. This means you can multiply by a point, but you can't divide by a point. Trapdoor functions are an essential ...
- 8,518
5
votes
Accepted
What exactly are bulletproofs replacing in monero?
Bulletproofs are used to prove that the amounts in confidential transactions are in range, so you can't do underhanded things like creating negative amounts. They replace Borromean range proofs. They ...
- 34.9k
4
votes
How "one-time ring signatures" anonymise the sender of a transaction?
I will copy my comment from my blog as follows.
As a prerequisite for understanding, my blog was lacking a layman’s introduction on Cryptonote’s ring signatures:
I will expound a little bit on the ...
- 171
4
votes
How does RingCT work with / without coefficients?
The equation is rct = x*G + a*H(G) where * indicates scalar point multiplication in the ed25519 curve, x is the "mask", G is the base point of the curve (group generator), a is the actual amount, and ...
- 906
4
votes
Commitments for RCTTypeSimple transactions
That additional commitment used in the "RCTSimple" scheme is called "pseudo output". And the short answer is NO: the original input commitment and the pseudo output commitment are guaranteed to commit ...
- 704
4
votes
Accepted
How is the number of ring members selected?
Ring size is currently fixed to 11 (10 decoys).
It's defined at a protocol level, so no transaction will be accepted by the network from a wallet not sending transactions with ring size 11.
For ...
- 19.4k
4
votes
Accepted
What is Triptych and how does it relate to Monero ring signatures?
In Monero currently, we use a ring signature comprising of 10 decoy inputs to each input being spent - so a ring size of 11 - and it scales linearly. This last point is what prevents us from using a ...
- 19.4k
3
votes
Accepted
Ring signatures and the long view
This issue is a known problem. A solution is discussed here: https://github.com/monero-project/monero/issues/1673.
A solution hasn't been created yet but the general plan is, as you suggested, to use ...
- 46
3
votes
Can someone show an actual example of a Monero transaction that uses two distinct private keys?
In Monero, every output has a one-time (unique) public key. No output on the blockchain can be associated with any particular wallet address because these output public keys are not the same as your ...
- 8,518
3
votes
What all information we can gather from a Monero wallet address?
No.
No. Naturally, you can only know about what you sent to that address. You can't know whether that address ever received anything else from the side. When the target spends what you sent to them, ...
- 20k
3
votes
Accepted
Is there anyway to calculate how much privacy is gained by increasing the ring size of a transaction?
A mixin of 4 means there are 4 decoys in addition to the real input, which means the ring size is 5.
No ring would be needed at all if your output could never be associated with you. However, the ...
- 8,518
3
votes
Accepted
How are transactions validated in monero vs bitcoin?
And KeyImages link to addresses which links to inputs
Any particular key image specified in a ring signature in a transaction must correspond to one of the output public keys (sometimes called ...
- 8,518
3
votes
Accepted
How does signing the hash of the public key show that the signer knew the private key?
How does signing the hash of the public key show that the signer knew the private key?
That's what signatures do. They prove that a private key must have been known for a particular public key that ...
- 8,518
3
votes
Accepted
How to get the base transaction hash from the blocktemplate_blob
"prefix", "base" and "prunable" just refer to parts in the transaction.
Given the transaction hash is:
H(H(prefix) || H(base) || H(prunable))
"prefix" refers to these fields.
"base" refers to the ...
- 19.4k
3
votes
Accepted
Duplicate ring members
A ring may not include the same input more than once. Prior to v6, duplicate ring members were allowed. This is enforced by the protocol (otherwise it wouldn't be a rule, would it).
Distinct rings in ...
- 34.9k
3
votes
Accepted
Results of scalarmultKey in MiniNero and monero-project are different
As @knaccc astutely points out, your keys are not valid.
An example with valid test keys, in Python:
p = '644206dabcd3014180f120c0d3da7fc167701a310ca520467199fcefbd7e0109'
P = '...
- 19.4k
3
votes
How to do MLSAG signatures with vin of type 0 (miner)?
There is no MLSAG signature on tx type gen.
- 19.4k
2
votes
Blockchain syncing and transactions verification
Unless you had --fast-block-sync 0 as a command-line flag, it should've already been skipping both POW checks and ring signature checks. With the transaction rates we've had in much of the coin's ...
- 2,472
Only top scored, non community-wiki answers of a minimum length are eligible