Hot answers tagged

57

As described by Monero Research Lab academic Shen Noether with regard to the anonymity set: Monero (although the zcash proponents note that a ring signature is a "smaller" anonymity set, they usually don't mention that the stealth address factor actually means that each transaction is masked, whereas the ring signatures provide additional ...


21

There is a command to lock coins when you make a transaction by RPC in simplewallet. I don't think it's implemented in the command line interface. It's the unlock_time parameter in the JSON RPC transfer, described in the source code here: https://github.com/monero-project/bitmonero/blob/eb1b87d2393f34caa9698bec23a4b78fa57da752/src/cryptonote_core/...


20

Most non coinbase Monero transactions are currently around 2,000 bytes (but with significant variation) which is somewhere in the neighborhood of 8 times larger than most Bitcoin non coinbase transactions. The reason why RingCT should help eliminate the need for extremely large Monero transactions is that RIngCT no longer will require the use of outputs of ...


20

StringCT is an upgrade to the existing RingCT MLSAG ring signatures. It was initially informally known as RuffCT in honor of Tim Ruffing, who is one of the authors of the paper (soon to be published) from which this new type of ring signature originates. The initials of all of the authors of the paper are RTRS, so RTRS Ring CT == STRRRingCT == StringCT. ...


19

Most of the information below is taken from this post on the GetMonero website. To understand bulletproofs, you need to first understand what a range proof is. According to the post: A range proof allows anyone to verify that a commitment represents an amount within a specified range, without revealing anything else about its value. Monero uses the ...


17

Basic idea can be explained by simple arithmetics. Now, we're checking that sum of all inputs must be equal to sum of all outputs. For example: 1+2+3+4 = 3+5+2 Literally, "what comes in must come out", and that's how we assert no coins were created or destroyed in the transaction. And you can see the amounts. If you multiply everything by some random ...


17

RingCT is based on the Confidential Transactions research you cited (combined with ring signatures) RingCT just like Confidential Transactions hides the amount of each transaction. Unlike Confidential Transactions, RingCT will also make the payments unlinkable. Confidential Transactions include a cryptographic proof that the sum of the input amounts is ...


17

Adding this answer to make it simpler to those who can not understand the top response. ZCash uses a new cryptography tool called zk-SNARK (don't worry about the name). This is different than the ring signatures that Monero uses. Without getting into too much detail, this is how they both work: zk-SNARKs use the entire blockchain when making transactions, ...


16

We can get a rough idea of a cost lower bound by doing the following: This command looks at the tx_outputs database, which lists all the outputs on the blockchain: mdb_stat -s tx_outputs ~/.bitmonerod/lmdb We see that this database holds 17896556 entries. In order to get 20% of the entries, an attacker would have to create about 4.5 million new outputs (...


15

Non coinbase transactions can start at a couple hundred bytes, and can go up in size a lot if they have a large number of inputs. The main factors driving up size is the number of inputs and mixin. When sending a large amount, if the sending wallet only has small inputs, it will have to include a lot of them in the transaction (and possibly even send ...


13

Full nodes cannot prune the range proofs entirely in a trustless manner. SPV nodes and those relying on checkpoints could benefit in the manner described by Monero Research Labs below: While the range proofs are large, using a transaction hashing scheme that signs the transaction "prefix" (both input indices and outputs) and stores the range proof, ...


13

Yes, that is true, but that is not the only thing. The main privacy enhancing features of Monero are: Ring signatures: make transactions harder to trace by obscuring the output of the true sender in a set of n other outputs on the blockchain, indistinguishable with respect to their amounts, which are all the same (currently), or all hidden (under ringCT, ...


13

Suppose the sender wants to create a Pedersen Commitment to the amount of 23 XMR for a new output pubkey in a transaction. Without range proof, the sender simply creates the commitment as: C = a G + 23 H where a is a random scalar. With range proof, there's an assumption in the protocol that any committed amount falls within a certain range; let's say ...


12

Monero transaction confirmations are very quick on modern computers. With LMDB estimates from developers Smooth and NoodleDoodle are that Monero can handle 1700 TPS (up from 1600 TPS pre LMDB). Confirmation time is definitely not the limiting factor. Many nodes do not have the bandwidth to support 1700 TPS based on current transaction sizes. Monero can ...


12

Does it mean that no upgrade will be required prior to RCT HF? This is currently correct. However, Ring CT is also in a testing phase on testnet. Therefore, there exists a possibility that bugs are found that have to be fixed before the v4 fork enables Ring CT transactions on mainnet. If this happens, it would be wise to upgrade your software to the latest ...


11

Yes, it will. Every time a substantial change is made in one fork, the other forks will find it more difficult to port anything they might want where it conflicts. I'd say the main change from the point of view of mergeability between forks was the LMDB change, which rewrote a large part of the blockchain handling. Cryptonote has also changed a lot since ...


11

If by "reject", you mean prevent that transaction from being mined and being available to your private key, then no. If by "reject", you mean only act on rct payments, then you could ask the client for a monero address to return non-rct payment, possibly minus a small fee to cover the tx fee (for instance, I believe shapeshift will return your monero if you ...


10

RingCT will make multisig easier to implement, as the planned multisig system relies on RingtCT building blocks. Contrary to the Bytecoin multisig, Monero's will not be limited to mixin 0 transactions (in fact, Monero banned mixin 0 transactions in the general case since it is harmful to privacy, so cannot even use that system as it is).


10

Well, looking at a few transactions gives you the answer quite plainly, at least for the Monero side. I'm not familiar with Bitcoin transaction sizes, but I think they're a few hundred bytes, typically. A small tx, 4 inputs and 4 outputs: 1692 bytes. http://moneroblocks.info/tx/f634025ef2d0fd0836ce2a5207e782609c3250cd5f8a0dd5269ce4e5c2f71bb7 A large tx, 21 ...


10

This is possible with a "daughter" project of Monero called URS (Unique Ring Signatures) and was introduced by core-team member tacotime. From the README of the repository: URS can be used to sign plaintext or binaries anonymously (among a group of known users). That is a user can sign a message, hiding among a group of known/registered users, ...


10

RingCT RingCT was developed by Monero Research Labs specifically for coins with ring signatures (and even more specifically Monero). Monero is by far the most common of these, and Monero is the first to include this in their code. Keep in mind that RingCT was based on Confidential Transactions for Bitcoin, so a coin like Bitcoin would implement CT instead. ...


10

I happened to have read Greg Maxwell's paper recently, so here I try to lay down my interpretation in a bit abstract manner: Before talking about the Borromean scheme, let us recapitulate the current ring signature scheme described in MRL-0005. The signature data looks like: R = (M, {P_1,...,P_n}, c_1, {r_1,...,r_n}) where M is some message's hash, each ...


10

Null is used for coinbase transactions. There are no inputs to sign, so no signatures can be provided. If a miner uses this mode (as opposed to tx.version == 1) then the coinbase output can be used as a dummy input in any rct transaction (AFAIK, primarily due to how it is stored in a database). Simple is currently used when a transaction has multiple inputs. ...


10

This is a bit speculative, as I do not know exactly what is planned. 1024+ bytes is quite a reduction, so my guess is that the range will be reduced. Currently the spender must prove the output is in the range [0, 2^64), and if the upper limit were reduced it would reduce the size of the signature. This would not alter security, but would decrease the ...


10

Let's say you'll use two of your outputs, 12.34 XMR and 7.89 XMR and send 18.37 XMR to your recipient for a fee of 0.022 XMR and change of 1.838 XMR. If you use mixin of 4, you'll be creating two rings with 5 output keys contained in each. You'll pick a secret index between 1 and 5 for each ring, so let's say you picked 2 for the first and 4 for the second. ...


9

The signatures, whether pre or post RingCT, are not needed for a node's own use after they are verified. However, pruning them means the node is unable to supply the full chain to peers, since those peers would need the signature so they can check them too. Allowing pruning in that way means the set of full "archival" nodes would be smaller than it otherwise ...


9

The transaction ID is based on the hash of everything in the transaction, and the MLSAGs sign everything in the transaction except the MLSAGs themselves. Therefore, changing anything in the transaction will change the tx hash and thus the ID.


9

They are currently 6304 bytes (per output). This will drop in the future by at least 1024 bytes. Beyond that will change (or not) with design decisions yet to be made.


9

Perfectly hiding. I don't think perfectly binding even existed at the time RCT was developed (not sure, though). As to what should be chosen, think about this: We can always replace lost money, but we can't ever replace lost privacy.


8

The current Monero median block size (last 1,000 blocks) is 286 bytes. The median transaction size is slightly less because some block include multiple transactions. The current median BTC transaction size is 260 bytes. http://moneroblocks.info/stats https://bitcoinfees.21.co/ Monero median (not mean) block sizes are important since they influence the ...


Only top voted, non community-wiki answers of a minimum length are eligible