CryptoNote v 2.0

01 Claim ledger

What the paper is allowed to say

Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.

1. Claim 01 · Paper model

   The ledger is the leak

   Bitcoin publishes amounts between addresses people reuse. Learn one address and you can walk the graph. CryptoNote treats that public graph as the defect, not as a feature to be patched later with a mixer.

2. Claim 02 · Paper model

   A fresh destination every time

   The recipient publishes a long-lived pair. The sender derives a one-time public key for this payment only. The chain never has to show the recipient's public address.

3. Claim 03 · Paper model

   The spend is a ring

   To spend, the owner signs together with other outputs of the same denomination. The signature is valid for the set. It does not say which member moved.

4. Claim 04 · Paper model

   Double-spends still fail

   Each real output has a key image. The network rejects a second use of that image. Privacy of the signer is not the same thing as permission to spend twice.

5. Claim 05 · Paper model

   Amounts are not hidden

   Denominations are visible, which is why decoys have to match. Hiding the amount is Ring Confidential Transactions, a later paper. Do not cite this one for that.

02 Three cuts

Observation, model, falsifier

A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.

1. 01 The ledger is the leak

   Observation

   What the study says

   Bitcoin publishes amounts between addresses people reuse. Learn one address and you can walk the graph. CryptoNote treats that public graph as the defect, not as a feature to be patched later with a mixer.

   Model

   What has to hold

   Users receive payments to one-time keys. Publishing a reused address on a website undoes unlinkability for those receipts.

   Falsifier

   What would retire it

   Are amounts still public, and if not, which later paper hides them?

2. 02 A fresh destination every time

   Observation

   What the study says

   The recipient publishes a long-lived pair. The sender derives a one-time public key for this payment only. The chain never has to show the recipient's public address.

   Model

   What has to hold

   Users receive payments to one-time keys. Publishing a reused address on a website undoes unlinkability for those receipts.

   Falsifier

   What would retire it

   Are amounts still public, and if not, which later paper hides them?

3. 03 The spend is a ring

   Observation

   What the study says

   To spend, the owner signs together with other outputs of the same denomination. The signature is valid for the set. It does not say which member moved.

   Model

   What has to hold

   There are enough genuine outputs of the same denomination to fill a ring. An empty bucket has no privacy.

   Falsifier

   What would retire it

   Are amounts still public, and if not, which later paper hides them?

4. 04 Double-spends still fail

   Observation

   What the study says

   Each real output has a key image. The network rejects a second use of that image. Privacy of the signer is not the same thing as permission to spend twice.

   Model

   What has to hold

   The ring signature scheme is sound, and the key image is bound to the real output so a double-spend is detectable.

   Falsifier

   What would retire it

   What is the double-spend token, and is it stored forever?

5. 05 Amounts are not hidden

   Observation

   What the study says

   Denominations are visible, which is why decoys have to match. Hiding the amount is Ring Confidential Transactions, a later paper. Do not cite this one for that.

   Model

   What has to hold

   Decoy selection is not so naive that the real input is obvious from timing or from how the decoys were chosen. The paper does not settle that implementation question.

   Falsifier

   What would retire it

   Are amounts still public, and if not, which later paper hides them?

03 Sequence

One action, as an operating tape

1. 01The recipient holds a spend key and a view key, and publishes the matching public keys.
2. 02The sender derives a one-time destination and includes a small piece of data so the recipient can recognise the output.
3. 03The recipient scans new outputs with the view key. The sender does not learn when the coin is later spent.
4. 04On the spend, the sender picks decoys of the same denomination and produces a ring signature over the set.
5. 05The network checks the signature and that the key image is new. It records the key image, not the identity of the signer.

04 Load-bearing

The argument, and where a pitch drops it

1. Unlinkability and untraceability are different jobs

   The cut

   Unlinkability means an observer cannot tell that two payments went to the same person. Untraceability means an observer cannot tell which input in a set was the real one. The paper specifies both, with different tools. A product that does only one of them has not implemented this design.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   It does not hide amounts. Monero's later RingCT work is a different paper.

2. A mixer is an admission that the format is public

   The cut

   A mixer takes already-published coins and tries to scramble them in a side room. CryptoNote puts the ambiguity in the signature itself, so there is no operator holding the pool. That is why the paper is hostile to optional privacy. Optional privacy marks the people who used it.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   The paper does not establish the privacy of any later coin. Ring size, decoy selection and implementation bugs decide that.

3. Denominations are a privacy tax

   The cut

   If amounts differ, a ring of mixed amounts is useless, because the amount gives the real input away. The paper therefore works in denominations. That choice leaks the amount and forces the chain to keep enough decoys in each bucket. Later confidential amounts exist because this leak was real.

   Why it carries weight

   If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.

   Where it is dropped

   It does not hide amounts. Monero's later RingCT work is a different paper.

05 Register

What has to be true

• Model · Not re-measured

  There are enough genuine outputs of the same denomination to fill a ring. An empty bucket has no privacy.

• Cryptography · Not re-measured

  Users receive payments to one-time keys. Publishing a reused address on a website undoes unlinkability for those receipts.

• Cryptography · Not re-measured

  The ring signature scheme is sound, and the key image is bound to the real output so a double-spend is detectable.

• Model · Not re-measured

  Decoy selection is not so naive that the real input is obvious from timing or from how the decoys were chosen. The paper does not settle that implementation question.

06 Divergence

What happened after the paper

Monero adopted the construction and then replaced pieces of it. Amounts moved into Ring Confidential Transactions. Ring size stopped being a small user choice and became a protocol parameter. The original ring signature was replaced. A 2013 reading does not describe today's Monero chain, and a third-party review in the historic library is not this text.

A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.

07 Pre-mortem

What to check before you use the idea

1. Kill test 1Are amounts still public, and if not, which later paper hides them?
2. Kill test 2Who chooses the decoys, and what is the fixed ring size?
3. Kill test 3Is there a view key, and which party is expected to hold it?
4. Kill test 4What is the double-spend token, and is it stored forever?
5. 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.

08 Anatomy

The paper, in the order a builder needs

09 Lexicon

Terms, opened into the record

One-time key

A destination derived for a single payment, so the recipient's long-lived address does not appear on the ledger.

Ring signature

A signature that proves one member of a named set signed, without revealing which member.

Key image

A unique marker of an output, published on spend, that blocks a second spend without naming the output.

Unlinkability

The property that two incoming payments cannot be tied to the same recipient from the ledger alone.

10 Repository

Every linked record on this page

Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.

11 Related

The next papers, as theses

• Zerocoin · 2013

  Zerocoin: Anonymous Distributed E-Cash from Bitcoin

  A 2013 proposal to add an anonymity layer on top of Bitcoin by burning a coin into a commitment and later redeeming a different coin with a zero-knowledge proof of membership.

• Zerocash · 2014

  Zerocash: Decentralized Anonymous Payments from Bitcoin

  The 2014 paper that showed how a payment ledger can hide sender, receiver and amount, while still letting the network check that coins were not created or double-spent. Zcash is an implementation of this line of work, not a co-author of the paper.

• Monero · 2016

  Ring Confidential Transactions

  The research note Monero used to hide amounts, not just the signer. It extends ring signatures so a spender can prove a balance inside a ring without publishing the values.