<p>For the math lovers, I will provide the mathematical intuition behind one-time public keys.</p>

<p>The assumption behind this technique is the hardness of discrete logarithm problem for groups like $Z_p^*$, Elliptic curve group. </p>

<p>Monero is using Elliptic Curve group as the underlying group. For simplicity, I will explain the concept with $Z_p^*$ but similar analogy and correctness will hold for any group where solving discrete logarithm is hard. </p>

<p>Consider the following</p>

<p>Let $Z_p^*$ be a group with multiplication modulo $p$ where $p$ is a prime and let $g$ be the generator of the group. </p>

<p>let $x$ be the secret key where $x$ is chosen uniformly randomly ${1,2,...,p-1}$ and the corresponding public key would be $ y = g^x$ modulo $p$.</p>

<p>Now using the key pair $(y,x)$ and any random string s we can generate one-time payable public key $(p',x')$ in the following way</p>

<pre><code>        \begin{equation}
            x' = x + Hash(s)
        \end{equation}
        \begin{equation}
            y' = g^xg^{Hash(s)} \ \text{mod}\ p
        \end{equation}
</code></pre>

<p>Here the assumption is that Hash(s) will give us a string of length equal to the length of $p$. </p>

<p>Observe that only the user having secret key $x$ will generate $x'$ to spend from currency sent to the one time public key $y'$ under the assumption of the hardness of discrete logarithm problem on $Z_p$. And to an external observer, $y$ and $y'$ are statistically uncorrelated.</p>

CC BY-SA 3.0
2018-01-09T19:53:59.293Z
whereas the explanation seems to be quite nice, I wonder if this is an answer to the post below? Isn't the OP asking on privacy, whereas your answer goes more into "statistical unbreakability" of the ECDSA algo?
pebwindkraft
CC BY-SA 3.0
2018-01-10T05:24:18.420Z
Through the answer, I wanted to show that the newly generated public key pk' is totally uncorrelated with the permanent public key pk, hence it provides privacy of the receiver. The maths for the privacy of the sender is little more involved. If anybody is interested have a look at  (https://people.csail.mit.edu/rivest/pubs/RST01.pdf) and (https://eprint.iacr.org/2006/389.pdf)
sourav
CC BY-SA 3.0
2018-01-09T15:41:36.377Z
2018-01-09T15:41:36.377Z
sourav
<p>Short answer: yes, it will be anonymous</p>

<p>Long answer:</p>

<p>The following applies to all Cryptonote based coins, unless stated otherwise:</p>

<p>On the blockchain, all addresses are one time addresses. In Bitcoin, you are exhorted to not reuse addresses, but Monero enforces this. Every new transaction causes a new one time address to be generated, in such a way that the recipient can derive the private keys to that new one time address (and thus spend those funds).</p>

<p>Moreover, Monero uses ring signatures to obscure which outputs are being spent. Those ring signatures are made with 1 private key (the one you're spending) and an arbitrary of public keys, those of outputs that you cannot spend. The transaction you send will appear to spend one of that set. The trick is that you can generate signatures such that an observer (ie, someone finding the tx on the blockchain) can be assured that one of the outputs in that tx was spent with the corresponding private key, but cannot tell which one. On the blockchain, they only see the public keys of your spent output, and the N other public keys you picked from the blockchain.</p>

<p>So, to recap: an observer sees that an output among this set of outputs was spent, but does not know which one. And sees that it went to that new one time address, which has no link to the recipient's address (unless the observer has the recipient's view private key, nice trick to allow a third party read only access to your income).</p>

<p>Now, the devil's in the details. There are other ways inferences could be made, such as particular amounts being spent (ie, if you're sent a very specific amount of dust, it's the only output of that particular amount on the blockchain). The Cryptonote protocol splits amounts by denominations (ie, sending 153 monero will, create three outouts, 100 monero, 50 monero, and 3 monero, so it's a lot easier to hide). Monero is currently working on an adaptation of gmaxwell's Confidential transactions (<a href="https://lab.getmonero.org/pubs/MRL-0005.pdf">https://lab.getmonero.org/pubs/MRL-0005.pdf</a>), which can be used with ring signatures, so that this avenue will be fully blocked (this is Monero only, other Cryptonote coins do not have this).</p>

<p>So, yes, if you use Monero, your transactions will be private. Cryptonote is the state of the art in blockchain privacy, though Zerocash may top it once it is released, though Zerocash also has issues of its own, so this will be an interesting thing to see.</p>

<p>By the way, all the papers on <a href="https://lab.getmonero.org/">https://lab.getmonero.org/</a> are worth reading if you want to know more about the details.</p>

CC BY-SA 3.0
2016-06-04T19:51:12.877Z
Coming soon: http://area51.stackexchange.com/proposals/98617/monero
dontmindme
CC BY-SA 3.0
2016-07-24T06:16:05.143Z
private beta has now begun: http://monero.stackexchange.com/
Luke
CC BY-SA 3.0
2016-06-04T19:34:14.677Z
2016-06-04T19:34:14.677Z
user36303
<p>Lets say i have a monero address and want to send my coins to another address. Will that transaction be private? Can somebody find out that i sent those coins? Are there any altcoins that i can use to send funds from one address to another without anyone knowing that i did?                                                                                                                           </p>

<altcoin><privacy><monero>
Are Monero Transaction Anonymous?
Mark
# Are Monero Transaction Anonymous?

(Asked by: username_0 on 2016-06-04)

Lets say i have a monero address and want to send my coins to another address. Will that transaction be private? Can somebody find out that i sent those coins? Are there any altcoins that i can use to send funds from one address to another without anyone knowing that i did?

**Tags:** altcoin, privacy, monero


---

## 2 answers

### Answer by username_3 on 2016-06-04. Score: 20 | Accepted answer

Short answer: yes, it will be anonymous

Long answer:

The following applies to all Cryptonote based coins, unless stated otherwise:

On the blockchain, all addresses are one time addresses. In Bitcoin, you are exhorted to not reuse addresses, but Monero enforces this. Every new transaction causes a new one time address to be generated, in such a way that the recipient can derive the private keys to that new one time address (and thus spend those funds).

Moreover, Monero uses ring signatures to obscure which outputs are being spent. Those ring signatures are made with 1 private key (the one you're spending) and an arbitrary of public keys, those of outputs that you cannot spend. The transaction you send will appear to spend one of that set. The trick is that you can generate signatures such that an observer (ie, someone finding the tx on the blockchain) can be assured that one of the outputs in that tx was spent with the corresponding private key, but cannot tell which one. On the blockchain, they only see the public keys of your spent output, and the N other public keys you picked from the blockchain.

So, to recap: an observer sees that an output among this set of outputs was spent, but does not know which one. And sees that it went to that new one time address, which has no link to the recipient's address (unless the observer has the recipient's view private key, nice trick to allow a third party read only access to your income).

Now, the devil's in the details. There are other ways inferences could be made, such as particular amounts being spent (ie, if you're sent a very specific amount of dust, it's the only output of that particular amount on the blockchain). The Cryptonote protocol splits amounts by denominations (ie, sending 153 monero will, create three outouts, 100 monero, 50 monero, and 3 monero, so it's a lot easier to hide). Monero is currently working on an adaptation of gmaxwell's Confidential transactions (<https://lab.getmonero.org/pubs/MRL-0005.pdf>), which can be used with ring signatures, so that this avenue will be fully blocked (this is Monero only, other Cryptonote coins do not have this).

So, yes, if you use Monero, your transactions will be private. Cryptonote is the state of the art in blockchain privacy, though Zerocash may top it once it is released, though Zerocash also has issues of its own, so this will be an interesting thing to see.

By the way, all the papers on <https://lab.getmonero.org/> are worth reading if you want to know more about the details.

> **Comments:**
> **username_4**: Coming soon: http://area51.stackexchange.com/proposals/98617/monero  
> **username_5**: private beta has now begun: http://monero.stackexchange.com/  

---

### Answer by username_1 on 2018-01-09. Score: 0

For the math lovers, I will provide the mathematical intuition behind one-time public keys.

The assumption behind this technique is the hardness of discrete logarithm problem for groups like $Z\_p^\*$, Elliptic curve group.

Monero is using Elliptic Curve group as the underlying group. For simplicity, I will explain the concept with $Z\_p^\*$ but similar analogy and correctness will hold for any group where solving discrete logarithm is hard.

Consider the following

Let $Z\_p^\*$ be a group with multiplication modulo $p$ where $p$ is a prime and let $g$ be the generator of the group.

let $x$ be the secret key where $x$ is chosen uniformly randomly ${1,2,...,p-1}$ and the corresponding public key would be $ y = g^x$ modulo $p$.

Now using the key pair $(y,x)$ and any random string s we can generate one-time payable public key $(p',x')$ in the following way

```
        \begin{equation}
            x' = x + Hash(s)
        \end{equation}
        \begin{equation}
            y' = g^xg^{Hash(s)} \ \text{mod}\ p
        \end{equation}

```

Here the assumption is that Hash(s) will give us a string of length equal to the length of $p$.

Observe that only the user having secret key $x$ will generate $x'$ to spend from currency sent to the one time public key $y'$ under the assumption of the hardness of discrete logarithm problem on $Z\_p$. And to an external observer, $y$ and $y'$ are statistically uncorrelated.

> **Comments:**
> **username_2**: whereas the explanation seems to be quite nice, I wonder if this is an answer to the post below? Isn't the OP asking on privacy, whereas your answer goes more into "statistical unbreakability" of the ECDSA algo?  
> **username_1**: Through the answer, I wanted to show that the newly generated public key pk' is totally uncorrelated with the permanent public key pk, hence it provides privacy of the receiver. The maths for the privacy of the sender is little more involved. If anybody is interested have a look at  (https://people.csail.mit.edu/rivest/pubs/RST01.pdf) and (https://eprint.iacr.org/2006/389.pdf)  

---

