LibraryPrivacy2016Design paperCorpus record
Ring Confidential Transactions
Monero. Shen Noether.
The research note Monero used to hide amounts, not just the signer. It extends ring signatures so a spender can prove a balance inside a ring without publishing the values.
Ring Confidential Transactions hide the amount inside a Monero-style ring, and still let the network check that inputs cover outputs and that a coin is spent only once.
- Evidence
- Primary paper
- Re-measured
- No
- Assumptions
- 4
- Records linked
- 6
Code
Source, repository, and what is actually hosted
- IACR ePrint 2015/1098https://eprint.iacr.org/2015/1098.pdf
- The source URL is not a GitHub repository. No code remote is invented.
- Full text is not mirrored. Public availability is not a licence to copy the file onto this site.
- Add to a reading list
01 Claim ledger
What the paper is allowed to say
Each row is a sentence already in the study. The status is the same on every row: a model claim, not a live measurement.
Claim 01 · Paper model
CryptoNote left the amount on the table
A ring only hides the signer if every member has the same visible denomination. The amount is then a fingerprint. This paper's job is to close that hole without giving up the ring.
Claim 02 · Paper model
Amounts become commitments
Each output commits to a value. The chain sees the commitment, not the number. A verifier can still check a linear relation among commitments.
Claim 03 · Paper model
The balance is a proof, not a sum you can read
A range proof shows each output is a non-negative amount in a bounded range, so a sender cannot hide a negative output that mints value. The sum of inputs and outputs is checked on the commitments.
Claim 04 · Paper model
The ring still does the linking
Confidential amounts do not by themselves hide which input was real. The ring signature, now over commitments rather than plain amounts, still does that work.
Claim 05 · Paper model
Range proofs dominate the size
The paper's cost is mostly the proof that amounts are well formed. Later Bulletproofs and similar schemes exist because that cost was the practical limit. They are not this paper.
02 Three cuts
Observation, model, falsifier
A desk does not stop at the summary. Each claim is cut three ways, using only this study's own assumptions and checks. Nothing here is a new figure.
01 CryptoNote left the amount on the table
Observation
What the study says
A ring only hides the signer if every member has the same visible denomination. The amount is then a fingerprint. This paper's job is to close that hole without giving up the ring.
Model
What has to hold
Rings are large enough, and decoy selection is not itself a fingerprint.
Falsifier
What would retire it
Can a public fee, a unique denomination, or a timing pattern undo the hidden amount?
02 Amounts become commitments
Observation
What the study says
Each output commits to a value. The chain sees the commitment, not the number. A verifier can still check a linear relation among commitments.
Model
What has to hold
The commitment scheme is binding and hiding under the stated assumptions.
Falsifier
What would retire it
What stops a negative output from creating value?
03 The balance is a proof, not a sum you can read
Observation
What the study says
A range proof shows each output is a non-negative amount in a bounded range, so a sender cannot hide a negative output that mints value. The sum of inputs and outputs is checked on the commitments.
Model
What has to hold
Range proofs are sound. A broken range proof is an inflation bug, not a privacy bug.
Falsifier
What would retire it
What stops a negative output from creating value?
04 The ring still does the linking
Observation
What the study says
Confidential amounts do not by themselves hide which input was real. The ring signature, now over commitments rather than plain amounts, still does that work.
Model
What has to hold
Fees and other public fields cannot be used to reconstruct the hidden amounts.
Falsifier
What would retire it
Which range proof is verified, and what is its size on the wire?
05 Range proofs dominate the size
Observation
What the study says
The paper's cost is mostly the proof that amounts are well formed. Later Bulletproofs and similar schemes exist because that cost was the practical limit. They are not this paper.
Model
What has to hold
Range proofs are sound. A broken range proof is an inflation bug, not a privacy bug.
Falsifier
What would retire it
Which range proof is verified, and what is its size on the wire?
03 Sequence
One action, as an operating tape
- 01The sender opens their own outputs, which are commitments plus the secrets only they know.
- 02They select decoy outputs from the chain. Those decoys are also commitments. The sender does not know the decoys' amounts, and does not need to.
- 03They build new output commitments for the recipient and for any change.
- 04A range proof is attached so every new amount is in range, and the ring signature shows one input set balances the outputs.
- 05The network verifies the proofs and records a key image. It never writes the amount into a public column.
04 Load-bearing
The argument, and where a pitch drops it
Hiding the amount changes the decoy math
The cut
Once amounts are hidden, decoys no longer have to share a denomination. That is the point. It also means a bad commitment scheme, or a range proof that does not bind, can be used to print money inside a proof nobody can inspect by eye.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Later Monero changes, including proof systems after this note, are not described here.
What a node is allowed to know
The cut
A node must learn that the transaction is solvent and that the key image is fresh. It must not learn the amount or which ring member was real. Any feature that asks the node to know more, including a public fee that is not accounted for, has to be fitted into that list on purpose.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
This is not a Monero 'project white paper' in the ICO sense. It is the amount-privacy note the project adopted.
Confidential is not shielded in the Zerocash sense
The cut
RingCT still publishes a ring. The anonymity set is the ring, not the entire history of commitments. Someone comparing this paper to Zerocash should say that out loud. The set is smaller, the setup assumptions are different, and the transaction is larger for a different reason.
Why it carries weight
If this cut is skipped, the paper's name is being used without the mechanism that makes the name mean anything.
Where it is dropped
Ring size and decoy selection still dominate practical privacy, and the paper does not pick a production policy.
05 Register
What has to be true
Model · Not re-measured
The commitment scheme is binding and hiding under the stated assumptions.
Cryptography · Not re-measured
Range proofs are sound. A broken range proof is an inflation bug, not a privacy bug.
Model · Not re-measured
Rings are large enough, and decoy selection is not itself a fingerprint.
Model · Not re-measured
Fees and other public fields cannot be used to reconstruct the hidden amounts.
06 Divergence
What happened after the paper
Monero deployed RingCT and later replaced the range proofs to shrink transactions. Ring size became mandatory. Those parameter changes are subsequent decisions. This paper is the argument that amounts can sit inside the ring at all.
A later client, parameter set, or reward formula is a different object. Cite this paper for the mechanism. Cite a primary release for the network. This desk has not re-run the proof.
07 Pre-mortem
What to check before you use the idea
- 0 of 4 marked on this browser. A mark is a reading note, not a pass, a rating, or a recommendation.
08 Anatomy
The paper, in the order a builder needs
The problem it names
CryptoNote-style rings hide which output was spent. They do not hide the amount. If denominations are visible, or if amounts are unique, the ring is easier to peel apart. The paper treats amount privacy as part of the signature, not as encryption bolted on beside it.
What the design proposes
- Commitments hide values. The signature proves the commitments in a ring are well formed.
- A range proof keeps a hidden amount from being negative or overflowing.
- The network still sees enough to reject a double-spend and to check that inputs cover outputs plus the fee.
How the mechanism is specified
- Confidential transactions (the Greg Maxwell construction on Bitcoin) are combined with a ring so the real input is not identified.
- The verifier checks a single statement: some input in the ring opens consistently, and value is conserved.
- Fees can remain public so the inclusion market still works.
What this page does not treat as proven
- This is not a Monero 'project white paper' in the ICO sense. It is the amount-privacy note the project adopted.
- Later Monero changes, including proof systems after this note, are not described here.
- Ring size and decoy selection still dominate practical privacy, and the paper does not pick a production policy.
Why the desk still reads it
A payments venture that publishes amounts 'for analytics' does not have this design. If the amount must be visible to a named party, that view should be a key or a reporting channel, not a return to a fully public ledger by default.
09 Lexicon
Terms, opened into the record
- Confidential transaction
- A transaction whose amounts are commitments. Solvency is checked without revealing the numbers.
- Range proof
- A proof that a committed number lies between zero and a maximum, so it cannot be negative or unbounded.
- RingCT
- The combination of a ring signature with confidential amounts, so both the signer and the values stay off the public columns.
- Binding
- The property that a commitment cannot be opened to two different amounts. Without it, the proof of balance is theatre.
10 Repository
Every linked record on this page
Underlined words open a page that already exists: a concept, a protocol profile, a failure record, or another paper. If a word is not underlined, this desk does not have a record for it.
This is Blockchain Lab's reading of a public design paper. It is not the paper, not a copy of it, and not an offer of tokens, equity, custody or a partnership. Later network behaviour can diverge from the text. Nothing here is investment, legal or technical advice.
Research status: Design paper. Last reviewed: 1 October 2026. This is a reading of a public paper, not investment, legal or security advice.