20

Stealth addresses take care of the receiver's privacy, not the sender's. In cryptocurrency, the ability to spend a certain amount of coins is the same as the knowledge of the private key to the public key associated with the coins. So (simplifying a bit), in Bitcoin if there is 1 bitcoin associated to the public key P and if Bob knows the corresponding ...


18

This is a complex topic that loses many in forest of cryptographic trees, but the following highlights important points required to understand and follow stealth address concepts. Stealth address technology originated from Cryptonote technology, but Bitcoin (e.g. libbitcoin) and its altcoins can also implement stealth addresses. For Bitcoin and its ...


10

In Monero, coins are received to a unique, one-time stealth address. The formula for stealth addresses is as follows: P = Hs(rA)G + B Where: P -- the final stealth address (one-time output key, the destination where funds will actually be sent); Hs* -- a hashing algorithm that returns a scalar (i.e., the hash output is interpreted as an integer and ...


10

The big advantage is that enforcing one time addresses at the protocol level will prevent people from forgetting, or not bothering with using them. In fact, reusing an address in Monero leads to an output becoming unspendable (since two outputs will also have an identical key image). If the protocol was changed to allow address reuse, it would of course ...


9

If the auditor wanted to confirm you had sent funds to a specific address, they'll then need to have the view key of that address also. The only thing the view key of your address can determine which outputs were sent to its corresponding public key. The key images can confirm when a transaction took place, and how much was was moved from your address. It ...


9

Many cryptocurrency users are either uniformed about best privacy practices or too lazy or undisciplined to use them. Automatic stealth addressing adds privacy by unlinkability without requiring any extra thought or effort from users. Monero stealth addresses also have some synergistic benefits when combined with ring signatures (and soon RingCT) which are ...


9

Stealth addresses mask a receiver, so 5 different people could all send XMR to the same address, but the construction of stealth addresses is such that none of the 5 people could tell that any of the other 5 people sent XMR to the same address. All they would see are five outputs to five random stealth addresses, and they only know the true address that ...


7

Stealth addressing provides unlinkability (outputs are not associated with wallet addresses on the blockchain). Ring signatures provide untraceability. Untraceability means that the source of funds in a transaction cannot be determined, even by the person or exchange that sent you the funds that you use in the transaction. It means that if a vendor's wallet ...


7

Here's one example: 47c99dab149170154cf1cdfb7e6a5993e1683e9d952aa0502b7b9f27f4129735 This is the public key for the first output in tx http://moneroblocks.info/tx/e706b52d74f74da37f0c016b976ede566fabf106c344a0fe1fb18cdb3751b0f6, the last tx made as of now. I won't give the private key to it, both because I don't know it, and because it'd allow you to spend ...


6

Q: What are stealth addresses? Stealth addresses are what ensure the unlinkability of Monero transactions. Someone can publish a Monero address and be assured that all incoming payments will be sent to unique one-time-use addresses that cannot be linked to either the published address or any other address connected to the transaction. Q: How they are ...


6

Here is a functional example for deriving a Monero stealth address, developer mechanics not cryptographic theory. Results below duplicate functionality that is part of Crypto Note Test Address. It is worth noting custom bytes_to_words, sc_reduce32, and secret_key_to_public_key executables (coded in C or C++) below were named after Monero's functions that ...


6

"Stealth Address" is really just a fancy name for a neat use of Elliptic Curve Diffie-Hellman key exchange. Its use in Monero is described here in detail, but not under that name. This allows for the sender to effectively salt the output and privately communicate the salt to the recipient. I have no idea who and when coined the term "stealth address" to ...


5

There is no way and there won't ever be a way. This is becasue Monero is unlinkable, meaning no two destinations can be linked together. In other words, nobody can tell where certain Monero went to, so can't really calculate any stats. This is achieved by utilizing stealth addresses, where the sender generates a one-time destination from the recipient's ...


5

In your system although the recipient can still find his transaction using R, he would also need to know r for deriving the corresponding private key. You could fix that by making r also public, and still only the user would be able to derive the private key ra+b, but then everyone in the network can figure out that the recipient was the address (A,B)... ...


5

A brain wallet should always be created offline, preferably on a computer that will never touch the Internet once you decide to use it for a key generator. Make sure any JavaScripts you are using can be initiated offline. Agree that there is a huge computing penalty for having to scan a blockchain for a given viewkey to identify associated stealth ...


5

It is impossible to calculate what the address is that corresponds to a given one-time address (there are actually multiple possibility). It is possible to check if a transaction corresponds to a given address. An auditor would need both your outgoing tx keys, and an address book to figure out where the funds are going.


5

Every single transaction uses stealth addresses. There's no way to opt-out of it. So you can just use any block explorer and view a Monero transaction, and you will see that the outputs don't go to the 95-character long Monero addresses (that start with a 4) but go to some random 64-character 'address'.


4

Unless the sender included such information in the transaction (ie, an unencrypted payment id that is identical in both transactions, or very specific amounts sent), it is not possible to determine that two transactions where to the same standard address. In Cryptonote, all outputs go to a separate one time address. Those one time addresses are generated in ...


4

First, to clarify again, the question is about one-time addresses, i.e. stealth addresses, which are different than the public addresses. The public addresses can be reused freely, whereas the stealth addresses cannot. For consistency, I'll only use the term stealth address (one-time address) in this answer. To answer your question, we first need a bit of ...


4

In monero transactions every output is sent to a One-Time Public Key (stealth address), which is derived from the recipient Public Key, the position or index of the output in the transaction and a random number generated by the sender. As ferretinjapan explained, only the receiver may check if that One-Time Key is derived from his Public Key.


4

You don't, it is created for you when you send. You don't see stealth addresses directly unless you look at a block explorer. Every new output you send is sent to a new one-time stealth address that the recipient can derive the private key for.


4

You can see the public keys for your outputs with: incoming_transfers verbose For spent ones, or unspent ones, respectively: incoming_transfers verbose unavailable or incoming_transfers verbose available Verbose mode will also give you the key image for each output.


4

The reason we use elliptic curve multiplication is that it is a trapdoor function. This means you can multiply by a point, but you can't divide by a point. Trapdoor functions are an essential component in any asymmetric encryption scheme (i.e. anything involving public and private keys). If we didn't need a trapdoor function, there would be no point in using ...


3

No. No. Naturally, you can only know about what you sent to that address. You can't know whether that address ever received anything else from the side. When the target spends what you sent to them, you won't be able to tell if it was your target who did the spending or someone else who just happened to include output of your TX as his "decoy" input (look up ...


3

Yes, it's possible. In theory, the person spending it could choose which to spend. This is possible because outputs are referenced by block height & index so even if one-time public key is the same, you could specify one or the other. You won't be allowed to spend the same key twice, because it will have the same key image, but you could pick which one ...


3

The CNS006 is correct. In the past outputs had to be split into denominations and without concatenations that'd generate multiple identical outputs (of different amounts) to the same wallet, effectively burning all but 1. With the concatenation, it's guaranteed that outputs will be unique, even if going to the same address.


3

Private spend and view keys for public Monero addresses are generated here: https://github.com/monero-project/monero/blob/102a51bcd48a3cd2cb794aab7dbe243393f155b3/src/cryptonote_basic/account.cpp#L81 Stealth addresses are generated here as part of generating a transaction: https://github.com/monero-project/monero/blob/...


3

Monero's stealth addressing works like this: You start with a destination wallet address, which is a pair of public keys A, B which have corresponding private keys a, b known only to the recipient. A Diffie-Hellman exchange is performed, resulting in a shared secret which can be transformed to produce a private key s. A public key S corresponding to the ...


3

The reason we use ECC multiplication (which I'm sure you know is not just regular integer multiplication) is that it is a homomorphic trapdoor function. You could potentially use unpadded RSA to achieve the same objective https://en.wikipedia.org/wiki/Homomorphic_encryption However, the reason that all cryptocurrencies use ECC and not RSA is that RSA ...


Only top voted, non community-wiki answers of a minimum length are eligible