DEV Community

Alexander
Alexander

Posted on

Monero Ring Signatures: Deep Dive for Researchers

#monero #privacy #cryptocurrency #security

Monero's Privacy Architecture: A Technical Deep-Dive

Research References

The following archives provide additional research context:

Open Source Tools:

The Problem

Bitcoin's privacy model is broken by design. Every transaction is permanently recorded on a public ledger with fully traceable inputs and outputs. Chain analysis firms like Chainalysis and Elliptic have built billion-dollar businesses on this transparency. Even with CoinJoin or mixing services, heuristic clustering — particularly the "common input ownership" heuristic — can de-anonymize the majority of transactions. The UTXO set is a surveillance database.

The core problems are three:

  1. Transaction graph linkability: inputs reveal prior outputs, creating a traceable spending history
  2. Address reuse and clustering: public addresses can be tied to real identities through off-chain data
  3. Amount transparency: anyone can see how much value moved where

Monero solves all three independently. Understanding how requires going layer by layer.

Ring Signatures

The foundational concept comes from Rivest, Shamir, and Tauman's 2001 paper "How to Leak a Secret." A ring signature lets a member of a group sign a message such that verifiers know the signer is someone in the group, but cannot determine who.

In Monero's implementation, when you spend an output, your wallet pulls in a set of other outputs from the blockchain as decoys. These are called mixins. The current default ring size is 16, meaning your real output is hidden among 15 decoys. The resulting signature proves you own one of those 16 outputs without revealing which one.

The scheme Monero uses is a variant called MLSAG (Multilayered Linkable Spontaneous Anonymous Group signatures), introduced in 2015. Linkability here is critical — it's what prevents double-spending. Each input generates a key image, a deterministic value derived from your private key and the specific output being spent:

key_image = x * Hp(P)

Where x is your private spend key, P is the public key of the output, and Hp is a hash-to-point function mapping onto the elliptic curve. If you try to spend the same output twice, the same key image appears twice, and nodes reject the second transaction. Crucially, the key image reveals nothing about which ring member you are.

In 2019, Monero upgraded to CLSAG (Compact Linkable Spontaneous Anonymous Group signatures). The improvement is mostly efficiency — CLSAG reduces signature size by about 25% and verification time by roughly 10x compared to MLSAG, without reducing security. For a 16-member ring, a CLSAG signature is around 11 KB versus MLSAG's ~13 KB.

One persistent critique of ring signatures is the 0-decoy problem. Early Monero transactions used rings of size 1 — essentially no privacy at all. Those old outputs still exist on-chain and can act as "poisoned" decoys when randomly selected, since their true ownership is often determinable. Research from 2017 (Möser et al.) showed that a significant fraction of Monero transactions at the time were traceable due to this. Forced minimum ring sizes and Dandelion++ (more on that below) have substantially improved this.

Stealth Addresses

Address-based linkability is the second attack surface. If you post a Bitcoin address publicly, anyone can watch it. Even if you generate a new address per transaction, metadata and timing can link them.

Monero's stealth address system uses a one-time address per transaction, derived by the sender, not the receiver. Here's the mechanism:

Each Monero wallet has two keypairs: a view key (a, A) and a spend key (b, B), where A = aG and B = bG on the ed25519 curve.

When sending, the sender:

  1. Generates a random scalar r
  2. Computes a shared secret: s = Hs(rA) = Hs(aR) — this works because rA = r(aG) = a(rG) = aR
  3. Constructs the one-time public key: P = Hs(rA)G + B
  4. Publishes R = rG in the transaction

The recipient scans the blockchain, computes Hs(aR) for

Top comments (0)