21
votes
Accepted
What is StringCT?
StringCT is an upgrade to the existing RingCT MLSAG ring signatures. It was initially informally known as RuffCT in honor of Tim Ruffing, who is one of the authors of the paper (soon to be published) ...
- 8,518
20
votes
Accepted
What are bulletproofs?
Most of the information below is taken from this post on the GetMonero website.
To understand bulletproofs, you need to first understand what a range proof is. According to the post:
A range proof ...
- 8,826
18
votes
How does Monero privacy and security compare to Zcash?
Adding this answer to make it simpler to those who can not understand the top response.
ZCash uses a new cryptography tool called zk-SNARK (don't worry about the name). This is different than the ...
- 8,826
13
votes
Accepted
What is RingCT and how does it make Monero private?
Yes, that is true, but that is not the only thing. The main privacy enhancing features of Monero are:
Ring signatures: make transactions harder to trace by obscuring the output of the true sender in ...
- 3,327
13
votes
Accepted
In ringct, how are the range proofs kept separate from the pedersen commitments in a transaction?
Suppose the sender wants to create a Pedersen Commitment to the amount of 23 XMR for a new output pubkey in a transaction. Without range proof, the sender simply creates the commitment as:
C = a G + ...
- 2,485
12
votes
How will the ring CT fork be rolled out?
Does it mean that no upgrade will be required prior to RCT HF?
This is currently correct. However, Ring CT is also in a testing phase on testnet. Therefore, there exists a possibility that bugs are ...
- 15.3k
11
votes
Accepted
What are Borromean signatures?
I happened to have read Greg Maxwell's paper recently, so here I try to lay down my interpretation in a bit abstract manner:
Before talking about the Borromean scheme, let us recapitulate the current ...
- 2,485
11
votes
Accepted
Can someone walk me through a simple example to explain how RingCT works?
Let's say you'll use two of your outputs, 12.34 XMR and 7.89 XMR and send 18.37 XMR to your recipient for a fee of 0.022 XMR and change of 1.838 XMR. If you use mixin of 4, you'll be creating two ...
- 2,485
10
votes
Accepted
Is Monero the first cryptocurrency to use Confidential Transactions (RingCT), 0MQ, and LMDB?
RingCT
RingCT was developed by Monero Research Labs specifically for coins with ring signatures (and even more specifically Monero). Monero is by far the most common of these, and Monero is the first ...
- 8,826
10
votes
What are 3 types of Ring CT transactions?
Null is used for coinbase transactions. There are no inputs to sign, so no signatures can be provided. If a miner uses this mode (as opposed to tx.version == 1) then the coinbase output can be used as ...
- 906
10
votes
Accepted
How will the range proof size reduction be accomplished?
This is a bit speculative, as I do not know exactly what is planned.
1024+ bytes is quite a reduction, so my guess is that the range will be reduced. Currently the spender must prove the output is in ...
- 906
9
votes
Accepted
Are RingCT signatures malleable?
The transaction ID is based on the hash of everything in the transaction, and the MLSAGs sign everything in the transaction except the MLSAGs themselves.
Therefore, changing anything in the ...
- 34.9k
9
votes
Can the size of range proofs be reduced?
They are currently 6304 bytes (per output).
This will drop in the future by at least 1024 bytes. Beyond that will change (or not) with design decisions yet to be made.
- 2,472
9
votes
Accepted
Are Confidential Transactions in Monero perfectly binding or hiding?
Perfectly hiding. I don't think perfectly binding even existed at the time RCT was developed (not sure, though).
As to what should be chosen, think about this:
We can always replace lost money, ...
- 20k
8
votes
Accepted
What are MLSAGs, and what is their significance for Monero and/or RingCT?
MLSAG is an acronym for "Multilayered Linkable Spontaneous Anonymous Group". The MLSAG signatures are the type of signatures used by Shen Noether's Ring Confidential Transactions [1], based upon ...
- 34.9k
8
votes
Accepted
Can I manually check consistency of Pedersen Commitments in RingCT?
As in my post to MRL Issue #6, I now figured out what pseudoOuts mean. Assuming the outPk means the output commitments, what I'd like to know (assuming the ring signature is valid), would be to see ...
- 2,485
8
votes
Accepted
Does the key vector approach in RingCT represent linkability among transactions? Can it be exploited by blockchain analysis?
smooth (and I) expressed concern about this same thing during the implementation. The good news is Shen came up with an alternate construction where one MLSAG is used per input rather than combined (...
- 2,472
8
votes
Accepted
Confidential transaction shows amounts
The input comes from a non-RingCT transaction. The outputs are RingCT outputs, and are therefore reflected as 0.
- 5,515
7
votes
Accepted
How can I assist in testing RingCT on the Monero testnet?
You can help by performing the most unlikely actions that should still work, keeping track of what you do, and reporting what doesn't work.
Sending transactions to other addresses is the obvious case,...
- 34.9k
6
votes
Accepted
Vcash privacy and scaling compared with Monero?
Unlike Monero which has many developers, Vcash arguably has a bus factor of 1. After recently being doxxed, its developer is alleged to have made harmful changes to the code before abandoning the ...
- 500
6
votes
Issue with unforgeability proof of ASNL in RingCT paper
Github user divbit responded to the issue on Github here. To quote:
Hi, the paper states that it is a sketch of a proof (mainly it's a sketch because the things are no more efficient than the ...
- 15.3k
6
votes
How much larger are Monero transactions compared to the average Bitcoin transaction?
2021 update to account for bullet proofs and fixed ring sizes
Real (non-coinbase) transactions in Monero are generally
1425 bytes each now.
The median Bitcoin transaction size is 224 bytes.
- 643
6
votes
Accepted
With RingCT on, can I lower mixin safely to save on tx fees?
As in my comment:
The transaction size is mainly determined by the number of outputs. The number of inputs and mixin have smaller impact on the tx size. To be more precise, each output comes with a ...
- 2,485
6
votes
Accepted
Will a large and sustained increase in Monero transactions resolve the current issues of the dynamic block size penalty function?
Maybe it would.
In theory, to smoothly function as "originally intended" would mean the median block size would somehow have to grow to the point where one TX is 1.2% of the median, which translates ...
- 20k
6
votes
Accepted
Is the 'pseudoOuts' of 'rctSig' the commitment on input amounts for simple RCT
Yes, the pseudoOuts are new commitments calculated for your real inputs. Each pseudoOut is calculated as pseudoOut = aG + bH where a is a newly generated mask (also known as a blinding factor) and b ...
- 8,518
6
votes
Accepted
Where is the encrypted mask value?
As of the March 2019 hard fork, commitment masks are deterministically derived from the per-output shared secret. This means the ECDHinfo part of the transaction will no longer store the encrypted ...
- 8,518
5
votes
Accepted
How will transaction fees be calculated after RingCT?
I said I'd replay when I knew more in the comment above, so better late than never:
RingCT transactions currently clock at about 13 kB for 2 inputs and 2 outputs at mixin 3. Only one output can get ...
- 34.9k
5
votes
How many transactions per second can the Monero network handle?
Bandwidth is currently the limiting factor.
Assuming an average transaction size of around 15 KiB, nodes can handle ~8 tx/s with every Mbit/s connection speed.
There is no real answer to how many ...
- 306
5
votes
Accepted
RingCT migration to Borromean Ring Signatures and testing
Sadly, most people will not help test on testnet. The changes pass all tests, and some low volume of transactions is flowing. The kind of bug that was found by RandomRun isn't a type of bug that can ...
- 34.9k
5
votes
Accepted
How do ringct transactions use previous non-ringct outputs in a ring signature with ringct?
I'd say it's pretty straightforward. In the normal situation where input and output are both Pedersen Commitments, i.e.,
C_i = x_i G + a_i H
D_j = y_j G + b_j H
, the network confirms the ...
- 2,485
Only top scored, non community-wiki answers of a minimum length are eligible