DEV Community

Alexander
Alexander

Posted on

Monero Ring Signatures: Deep Dive for Researchers

#monero #privacy #cryptocurrency #security

Monero Privacy Mechanisms: A Technical Deep-Dive

Overview

Monero (XMR) is a cryptocurrency built around a core principle: transactions should be private by default, not optional. Unlike Bitcoin, where every transaction is permanently visible on a public ledger, Monero uses several cryptographic techniques working together to obscure who sent what to whom.

Think of Bitcoin like a glass envelope — you can see the sender, recipient, and amount. Monero is more like a sealed, shredded, and re-assembled letter where even the postal service can't tell who's writing to whom.

The three pillars of Monero's privacy are:

  • Ring Signatures — hides who sent a transaction
  • Stealth Addresses — hides who received a transaction
  • RingCT (Ring Confidential Transactions) — hides how much was sent

Ring Signatures

The Basic Idea

A ring signature lets one member of a group sign a message on behalf of the group, without revealing which member actually signed it. The verifier knows the signature came from someone in the group, but can't determine who.

Analogy: imagine five people each put their hand on a buzzer. You hear the buzzer go off, but you can't tell whose hand pressed it.

How Monero Uses Them

When you send Monero, your transaction is mixed with "decoy" outputs pulled from the blockchain — these are called mixins. Together, they form the ring. As of 2024, Monero requires a ring size of 16 (one real output, 15 decoys).

Ring = { output_1, output_2, ..., output_16 }
^
one of these is real

Each ring member is a past transaction output (a UTXO). An outside observer sees a valid signature from the ring but cannot determine which input is the actual one being spent.

Key Images

Ring signatures alone have a problem: what stops someone from spending the same output twice in two different rings? Enter the key image.

Every input generates a deterministic key image derived from the private key of the real signer:

key_image = x * Hp(P)

Where:

  • x is the private spend key
  • P is the one-time public key of the output
  • Hp is a hash-to-point function

Key images are published on-chain. Nodes check that no key image appears twice, preventing double spends — without revealing which output was spent.

Limitations

Ring signatures are probabilistic, not absolute. With a ring size of 16, you have at most a 1-in-16 chance of guessing the real signer, but statistical analysis across multiple transactions can narrow it down. Researchers have shown that with chain analysis and timing correlation, some outputs can be identified as the real input with higher confidence. This is why mixin size has grown over time (from 4 to 7 to 11 to 16).

Stealth Addresses

The Basic Idea

A stealth address is a one-time address generated for every incoming transaction. Even if you publicly share your Monero address, each payment you receive lands at a unique, unlinkable address on the blockchain.

Analogy: you publish a P.O. box number, but every piece of mail you receive is delivered to a different randomly-assigned locker. Only you have the master key that opens all of them.

How It Works

Monero addresses encode two public keys: a view key and a spend key.

Public Address = (A, B)
A = a*G (view key, where 'a' is private view key)
B = b*G (spend key, where 'b' is private spend key)

When a sender wants to pay you:

  1. They generate a random scalar r
  2. Compute a shared secret: S = r * A (using your public view key)
  3. Derive a one-time public key: P = Hs(S) * G + B
  4. Publish the ephemeral key R = r * G in the transaction

Transaction output:
R = r*G (published on-chain, sender's ephemeral pubkey)
P = Hs(r*A)*G + B (the stealth address)

To find your incoming transactions, you

Research References

The following archives provide additional research context:

Open Source Tools:

Top comments (0)