Hacker News Reader

Comment by KMag | Hacker News Reader

I'm familiar with how ring signatures work, but haven't looked into how the rest of the Monero anonymity works. In order to expand the search space, presumably some of those keys used in the ring signature need to be from people completely unknown to the signer.

I take it that a person just finds a few random strangers' public keys with previous history, and gives them signing power over the coin. Those strangers just have no way of knowing they have signing power because the ring is represented in the unspent coin by its hash. Is that correct? In order to spend a coin, however, the ring needs to be revealed. How is the race condition resolved where those strangers could see there's a pending transaction for a coin they could spend. Can't those strangers just see the transaction and pay a huge mining fee to jump the queue and spend the coin first?

View on HN

> I take it that a person just finds a few random strangers' public keys with previous history.

The ring signatures are used when spending an output. For minting an output you essentially just spend to a single public key.

When spending an output, you pick 10 other outputs (at random from an age-based distribution so the age of a ring-member does not say much) and you produce a ring-signature saying "I have the key to one of these 11 outputs". They combine this with Pedersen commitments to ensure that you are not spending more than you are minting, without ever revealing the total amount of the transaction.

In older versions of Monero, you would pick a few (rings were smaller then) outputs of the same amount, and the amounts were hidden.

There's no signing power. A ring signature is just a signature made with a set of public keys for one of which you know the corresponding private key.

Edit: nevermind https://www.getmonero.org/resources/moneropedia/ringsignatur... cleared it up.

Zero-knowledge proofs/cryptographic accumulators are used to verify each coin is spent at most once. Any of 11 coins could have been spent, each owned by a different single key.

For some reason, I thought Monero was basically ZCash plus using ring signatures to make traffic analysis much more difficult even if the zk proof system were broken. I was completely mistaken.

Edit 2: Sorry droffel, I wasn't fast enough editing away my old understanding of how it worked and asking what I was missing. Thanks for the explanation.

The piece you are missing is called the Key Image. The key image can be thought of as a fingerprint/hash (one way function) of the true spender, and is always produced when the true spender signs the transaction. Signing the transaction with any of the decoy keys will not produce a valid key image, and therefore they are not able to spend the funds (or see their amount). This key image is also used to verify that transactions aren't being spent twice - despite not knowing which input in a ring is actually being spent, a transaction with a key image that has never been used before guarantees that it hasn't been spent in the past.

Reply on news.ycombinator.com