17

RingCT is based on the Confidential Transactions research you cited (combined with ring signatures) RingCT just like Confidential Transactions hides the amount of each transaction. Unlike Confidential Transactions, RingCT will also make the payments unlinkable. Confidential Transactions include a cryptographic proof that the sum of the input amounts is ...


16

We can get a rough idea of a cost lower bound by doing the following: This command looks at the tx_outputs database, which lists all the outputs on the blockchain: mdb_stat -s tx_outputs ~/.bitmonerod/lmdb We see that this database holds 17896556 entries. In order to get 20% of the entries, an attacker would have to create about 4.5 million new outputs (...


15

Your public address will never appear on the blockchain. What you're spending is amounts sent to one-time destinations so they're unlinked. Not only that, but each one-time addres will be "mixed" with a few others. With this, there's no way to link the two payments together. To the recipient, they will seem unrelated unless you tell him yourself they're ...


13

There are many other CryptoNote coins but their communities, usage, trading volumes and hashrate are much smaller than Monero. Here is a chronicalogical graphic of many of the coins and from where they were forked: https://en.wikipedia.org/wiki/CryptoNote#/media/File:Forks-tree-fixed.png You mentioned Boolberry, which like Aeon was an innovator in the area ...


11

There's less than a couple dozen CN based currencies. See http://mapofcoins.com/bytecoin. Shadowcash tried to implement ring signatures on a Bitcoin code base. See https://shnoe.wordpress.com/2016/02/11/de-anonymizing-shadowcash-and-oz-coin/. To my knowledge, no non-CN coin uses Cryptonight. -- Oops, I misread that last question, see lethos3's answer to ...


10

This is possible with a "daughter" project of Monero called URS (Unique Ring Signatures) and was introduced by core-team member tacotime. From the README of the repository: URS can be used to sign plaintext or binaries anonymously (among a group of known users). That is a user can sign a message, hiding among a group of known/registered users, that ...


10

Let's say you'll use two of your outputs, 12.34 XMR and 7.89 XMR and send 18.37 XMR to your recipient for a fee of 0.022 XMR and change of 1.838 XMR. If you use mixin of 4, you'll be creating two rings with 5 output keys contained in each. You'll pick a secret index between 1 and 5 for each ring, so let's say you picked 2 for the first and 4 for the second. ...


9

The members of the MRL have all earned their PhD (which fact the website does not reflect at present) in various mathematical fields. Their publications have received various levels of peer review. The RingCT paper, for instance, has been submitted to the Ledger journal, and has been approved to be included in the first edition. To answer the two other ...


9

In the interest of pedantry (and since I can't comment -_-): You sign the hash of the transaction prefix. In Monero that is everything but the signatures. (at the above answer) Monero relies on ed25519, not EdDSA. EdDSA is a particular signature system (completely absent in Monero). Monero's ring signatures are presently the Fujisaki-Suzuki variety, ...


9

Stealth addresses mask a receiver, so 5 different people could all send XMR to the same address, but the construction of stealth addresses is such that none of the 5 people could tell that any of the other 5 people sent XMR to the same address. All they would see are five outputs to five random stealth addresses, and they only know the true address that ...


8

MLSAG is an acronym for "Multilayered Linkable Spontaneous Anonymous Group". The MLSAG signatures are the type of signatures used by Shen Noether's Ring Confidential Transactions [1], based upon Gregory Maxwell's Confidential Transactions [2] and Nicolas van Saberhagen's Ring Signatures [3]. [1] https://lab.getmonero.org/pubs/MRL-0005.pdf [2] https://people....


8

Monero does not support multisig at the moment. It will at some point, probably not very long after RingCT is merged, since that work relies on RingCT building blocks. Cryptonote itself does not support multisig either, but Bytecoin (Cryptonote's first actual currency) does support it for mixin 0 (ie, without ring signatures involving other outputs). Monero'...


7

This is a legitimate concern for centrally controlled CryptoNote coins such as Bytecoin (BCN). Approximately 80% of BCN had already been mined as of the time it became known to most of the cryptocurrency community in 2014. Assuming one person or a small group controlled all of the outputs generated up to that point the attack you describe is a very real ...


7

As of the Monero 0.9.0 Hydrogen Helix release the minimum mixin is 2 (2 foreign outputs per ring for a total of 3) with the exception of dust transactions. The minimum mixin will be raised to 4 in a future fork probably at the same time as RingCT according to discussions from the most recent developer meeting. The numbers above along with the simplewallet ...


7

All¹ asymmetric signature protocols calculate a hash of the message and then apply the “mathematical” transformation to this hash. This includes EdDSA which Monero relies on. The reason is that all those mathematical transformations work on fixed-size numbers (of about a few hundred bits). Hashing condenses the information into this fixed size, with the ...


7

With ring CT, the amounts will be obfuscated. Inputs are already obfuscated by using ring signatures. The destination is already obfuscated by using stealth addresses. Only by having the private view key that belongs to the address (and knowing the address), you're able to tell that the output was sent to that address, which is exactly what your wallet does ...


7

Section 4.4 of CN white-paper describes this. With the ring signature, all the keys used are equivalent, so you can't say which one is the actual signer. The signature can be checked against any of the public keys used in the ring. Let's define our one-time keys as P = xG Where P is the public key, x the private key, and G the EC basepoint. If we let the ...


7

Stealth addressing provides unlinkability (outputs are not associated with wallet addresses on the blockchain). Ring signatures provide untraceability. Untraceability means that the source of funds in a transaction cannot be determined, even by the person or exchange that sent you the funds that you use in the transaction. It means that if a vendor's wallet ...


6

You must choose mix inputs of the same amount as the one you are spending. Other than that there are no restrictions, though it's not a good idea to choose a really recent output (less than 10 blocks old -- you'd also have to modify the daemon and/or wallet to do so). The wallet currently chooses outputs as follows: 25% are chosen randomly from "recent outs"...


6

Yes, they are a bit in practice, but according to the RingCT paper of Shen Noether on http://eprint.iacr.org/2015/1098 it seems it cannot be much:


5

Ring signatures are a group of cryptographic signatures with at least one real participant, but no way to tell which in the group is the real one as they all appear valid When sending a transaction, you select some random transaction outputs on the blockchain and mix those with your own coins Mixing enforced across the network, meaning active participation ...


5

"Normal" ring signatures aren't broken (meaning the true signer is revealed) by QC, but their security certainly is (unforgeability). However, the traceable version Monero uses (for double-spending prevention) is indeed able to be broken (meaning public key linked to key image and thus signer revealed) due to the existence of a key image.


5

I'd say it's pretty straightforward. In the normal situation where input and output are both Pedersen Commitments, i.e., C_i = x_i G + a_i H D_j = y_j G + b_j H , the network confirms the consistency of the CT by checking \sum_i C_i = \sum_j D_j + f H where f is the fee. When converting non-RingCT outputs to RingCT outputs, you simply treat non-RingCT ...


5

Any output can be used as a "decoy" at any time after it matures, whether this is before or after it's been spent. In the general case [1], the network cannot determine when an output is spent, and thus does not treat spent outputs differently from unspent ones. Indeed, if the network could determine whether any output was spent, it would mostly defeat the ...


5

Page 11 in that paper is still only concerned with the general ring signature case, not particularly focused on the Pedersen Commitment part. The MGs field corresponds to the struct mgSig in src/ringct/rctTypes.h: typedef std::vector<key> keyV; //vector of keys typedef std::vector<keyV> keyM; //matrix of keys (indexed by column first) struct ...


5

If you churn twice, and every input you reference came from transactions that used ring size 7 (where one of those transactions would have been your first churn transaction), then your anonymity set would be 7^2 = 49. You're therefore far better off making two transactions. If you'd made 3 transactions, your anonymity set would increase fo 7^3 = 343. If ...


5

Bulletproofs are used to prove that the amounts in confidential transactions are in range, so you can't do underhanded things like creating negative amounts. They replace Borromean range proofs. They are smaller in size, and faster to verify, though slower to generate. As used in Monero, they are unrelated to ring signatures, but are part of RingCT, since ...


4

This was answered by core-team member smooth on Reddit: First one has a trusted setup. I don't know what issues there might be with the other one. I remember the MRL guys look at some sublinear ring sig at one point a year or two ago and it had high minimum size, such that it would only be useful for very large mix sets. That could still be an improvement ...


4

Remember that other users (those that are not the "owner" of an output) also use this output in their rings as soon as it appears in the blockchain. So an output might (and most likely will) appear many times in many different rings prior to be actually spent by its owner.


Only top voted, non community-wiki answers of a minimum length are eligible