DEV Community

Alexander
Alexander

Posted on

Monero Ring Signatures: Deep Dive for Researchers

#monero #privacy #cryptocurrency #security

monero-privacy-research

A collection of tools, notes, and experiments for analyzing Monero's privacy architecture. This repo exists because most documentation either oversimplifies the cryptography or buries it in academic papers. The goal is something in between: precise enough to be useful, practical enough to actually run.

Monero achieves unlinkability and untraceability through three interlocking mechanisms. Understanding any one of them in isolation misses how they interact in practice.

Ring signatures obscure the true signer by bundling the real input with a set of decoys pulled from the blockchain. As of Monero's current consensus rules, every transaction uses a ring size of 16. The actual spend is cryptographically indistinguishable from the 15 decoys. The construction uses a Linkable Spontaneous Anonymous Group (LSAG) signature scheme, which allows the network to detect double-spends via key images without revealing which ring member actually signed. Each key image is derived as I = x * H_p(P), where x is the private spend key and H_p hashes a public key to a curve point. Crucially, key images are deterministic — spend the same output twice and the duplicate image is immediately detectable.

Compare this to Bitcoin. On a transparent chain, input ownership is explicit. You can trace funds through any block explorer in seconds. On Monero, even chain analysts working with full node data cannot deterministically identify the real spend without external information. Research has shown heuristic attacks — particularly the "0-decoy" and "chain-reaction" analyses from Möser et al. (2018) — can reduce the effective anonymity set, but these largely affect older transactions pre-ringsize-upgrade.

Stealth addresses handle the recipient side. Rather than publishing a static address that links all incoming payments, Monero uses a dual-key system: a public spend key and a public view key. Senders compute a one-time address for each transaction using a shared secret derived via ECDH. The recipient scans the blockchain using their view key to identify outputs belonging to them. Nobody watching the chain can link two payments to the same recipient without the view key.

# Simplified stealth address derivation (illustrative, not production code)
import hashlib
from monero.ed25519 import point_mul, base_point

def derive_one_time_address(r, A, B):
    # r = random scalar, A = recipient public view key, B = recipient public spend key
    rA = point_mul(r, A)
    shared_secret = hashlib.sha3_256(rA.encode()).digest()
    return point_mul(shared_secret, base_point) + B
Enter fullscreen mode Exit fullscreen mode

RingCT (Ring Confidential Transactions, deployed in 2017) hides transaction amounts using Pedersen commitments. Every output commits to its value as C = aG + bH, where a is a blinding factor and b is the actual amount. Verifiers can confirm that inputs equal outputs plus fees without learning any specific value. Bulletproofs (upgraded to Bulletproofs+ in 2022) replaced the original range proofs, cutting proof size by roughly 96 bytes per output and significantly reducing transaction fees.

Tools in this repo

ring_analysis.py — pulls transaction data via the daemon RPC and computes effective anonymity set estimates accounting for known spent outputs.

stealth_scanner.py — demonstrates the view key scanning process against a local stagenet node. Requires monero-python and a synced node at 127.0.0.1:38081.

ringct_verify.py — walks through Pedersen commitment verification for a given transaction hash.

To get started, clone the repo and point it at a local node:

git clone https://github.com/yourhandle/monero-privacy-research
pip install -r requirements.txt
python ring_analysis.py --tx-hash <txid> --rpc-host 127.0.0.1:18081
Enter fullscreen mode Exit fullscreen mode

Running against mainnet requires a fully synced node (~170GB as of 2024). Stagenet is recommended for experimentation. All scripts are read-only — nothing here broadcasts transactions.

Contributions welcome, particularly around traceability heuristics and Triptych signature analysis.

Research References

The following archives provide additional research context:

Open Source Tools:

Top comments (0)