17 votes
Accepted

What is RingCT and how does it compare to Confidential Transactions?

RingCT is based on the Confidential Transactions research you cited (combined with ring signatures) RingCT just like Confidential Transactions hides the amount of each transaction. Unlike ...
  • 1,491
16 votes
Accepted

Spam attack to gain control of many outputs and undermine privacy

We can get a rough idea of a cost lower bound by doing the following: This command looks at the tx_outputs database, which lists all the outputs on the blockchain: mdb_stat -s tx_outputs ~/....
  • 34.6k
15 votes
Accepted

If I send two transactions to the same recipient, can they infer the true sender?

Your public address will never appear on the blockchain. What you're spending is amounts sent to one-time destinations so they're unlinked. Not only that, but each one-time addres will be "mixed" with ...
  • 19.8k
13 votes
Accepted

Are there more cryptocurrencies based on the cryptonote protocol? If so what are the main differences?

There are many other CryptoNote coins but their communities, usage, trading volumes and hashrate are much smaller than Monero. Here is a chronicalogical graphic of many of the coins and from where ...
11 votes
Accepted

CryptoNote features in other cryptocurrencies

There's less than a couple dozen CN based currencies. See http://mapofcoins.com/bytecoin. Shadowcash tried to implement ring signatures on a Bitcoin code base. See https://shnoe.wordpress.com/2016/02/...
  • 34.6k
11 votes
Accepted

Can someone walk me through a simple example to explain how RingCT works?

Let's say you'll use two of your outputs, 12.34 XMR and 7.89 XMR and send 18.37 XMR to your recipient for a fee of 0.022 XMR and change of 1.838 XMR. If you use mixin of 4, you'll be creating two ...
  • 2,475
10 votes
Accepted

Could Monero help me to implement a safe election for a small group of students?

This is possible with a "daughter" project of Monero called URS (Unique Ring Signatures) and was introduced by core-team member tacotime. From the README of the repository: URS can be used ...
  • 14.9k
9 votes

When you sign a Monero transaction, are you signing a hash?

In the interest of pedantry (and since I can't comment -_-): You sign the hash of the transaction prefix. In Monero that is everything but the signatures. (at the above answer) Monero relies on ...
  • 2,432
9 votes
Accepted

What level of cryptographic review has the current Monero protocol received?

The members of the MRL have all earned their PhD (which fact the website does not reflect at present) in various mathematical fields. Their publications have received various levels of peer review. ...
  • 5,079
9 votes

What's the point of ring signatures if stealth addresses hide the actual addresses anyways?

Stealth addresses mask a receiver, so 5 different people could all send XMR to the same address, but the construction of stealth addresses is such that none of the 5 people could tell that any of the ...
8 votes
Accepted

Does Monero/the CryptoNote Protocol support multi signature wallets?

Monero does not support multisig at the moment. It will at some point, probably not very long after RingCT is merged, since that work relies on RingCT building blocks. Cryptonote itself does not ...
  • 34.6k
8 votes
Accepted

What are MLSAGs, and what is their significance for Monero and/or RingCT?

MLSAG is an acronym for "Multilayered Linkable Spontaneous Anonymous Group". The MLSAG signatures are the type of signatures used by Shen Noether's Ring Confidential Transactions [1], based upon ...
  • 34.6k
7 votes
Accepted

What signature prevents me from spending others' coins?

Section 4.4 of CN white-paper describes this. With the ring signature, all the keys used are equivalent, so you can't say which one is the actual signer. The signature can be checked against any of ...
  • 19.8k
7 votes
Accepted

How are outputs chosen on the blockchain for ring signatures in a transaction?

You must choose mix inputs of the same amount as the one you are spending. Other than that there are no restrictions, though it's not a good idea to choose a really recent output (less than 10 blocks ...
  • 2,432
7 votes

When you sign a Monero transaction, are you signing a hash?

All¹ asymmetric signature protocols calculate a hash of the message and then apply the “mathematical” transformation to this hash. This includes EdDSA which Monero relies on. The reason is that all ...
7 votes
Accepted

Obfuscating the output as well?

With ring CT, the amounts will be obfuscated. Inputs are already obfuscated by using ring signatures. The destination is already obfuscated by using stealth addresses. Only by having the private view ...
  • 19.8k
7 votes

Spam attack to gain control of many outputs and undermine privacy

This is a legitimate concern for centrally controlled CryptoNote coins such as Bytecoin (BCN). Approximately 80% of BCN had already been mined as of the time it became known to most of the ...
  • 4,546
7 votes
Accepted

Mixin 0 (mixin 1) transaction ban

As of the Monero 0.9.0 Hydrogen Helix release the minimum mixin is 2 (2 foreign outputs per ring for a total of 3) with the exception of dust transactions. The minimum mixin will be raised to 4 in a ...
  • 6,533
7 votes

What's the point of ring signatures if stealth addresses hide the actual addresses anyways?

Stealth addressing provides unlinkability (outputs are not associated with wallet addresses on the blockchain). Ring signatures provide untraceability. Untraceability means that the source of funds ...
  • 8,418
6 votes

Are RingCT transaction bigger than an average ring signature transaction?

Yes, they are a bit in practice, but according to the RingCT paper of Shen Noether on http://eprint.iacr.org/2015/1098 it seems it cannot be much:
  • 1,205
5 votes
Accepted

How "one-time ring signatures" anonymise the sender of a transaction?

A ring signature is done over N public keys, and one private key matching one of the N public keys. The public keys are selected from all the outputs on the blockchain that have the same amount as the ...
  • 34.6k
5 votes

How "one-time ring signatures" anonymise the sender of a transaction?

Ring signatures are a group of cryptographic signatures with at least one real participant, but no way to tell which in the group is the real one as they all appear valid When sending a transaction, ...
  • 420
5 votes
Accepted

Will quantum computer break ring signatures?

"Normal" ring signatures aren't broken (meaning the true signer is revealed) by QC, but their security certainly is (unforgeability). However, the traceable version Monero uses (for double-spending ...
  • 2,432
5 votes
Accepted

How do ringct transactions use previous non-ringct outputs in a ring signature with ringct?

I'd say it's pretty straightforward. In the normal situation where input and output are both Pedersen Commitments, i.e., C_i = x_i G + a_i H D_j = y_j G + b_j H , the network confirms the ...
  • 2,475
5 votes
Accepted

Can an output be used as a decoy after it has been spent?

Any output can be used as a "decoy" at any time after it matures, whether this is before or after it's been spent. In the general case [1], the network cannot determine when an output is spent, and ...
  • 34.6k
5 votes
Accepted

Understanding MLSAG in Monero transaction

Page 11 in that paper is still only concerned with the general ring signature case, not particularly focused on the Pedersen Commitment part. The MGs field corresponds to the struct mgSig in src/...
  • 694
5 votes

With a Churn: does it increase privacy more to do 1 TX with RingSize14 or 2 TX with RingSize7 or is it exactly the same?

If you churn twice, and every input you reference came from transactions that used ring size 7 (where one of those transactions would have been your first churn transaction), then your anonymity set ...
  • 8,418
5 votes
Accepted

Detecting the real output in ring signature

The reason we use elliptic curve multiplication is that it is a trapdoor function. This means you can multiply by a point, but you can't divide by a point. Trapdoor functions are an essential ...
  • 8,418
5 votes
Accepted

What exactly are bulletproofs replacing in monero?

Bulletproofs are used to prove that the amounts in confidential transactions are in range, so you can't do underhanded things like creating negative amounts. They replace Borromean range proofs. They ...
  • 34.6k

Only top scored, non community-wiki answers of a minimum length are eligible