Curve used in Monero - A Subgroup of Ed25519? I am a student researcher at IIT Bombay (India). I have been recently understanding the cryptography behind Monero as well as its implementation.

The elliptic curve used in the CryptoNote protocol is Ed25519 (of order 8q, where q is a prime). This post described the possibility of a small subgroup (order q) confinement attack on CryptoNote based cryptocurrencies. To this end, the field elements in the implementation of Monero seem to be multiplied by 8 to ensure they lie in the smaller subgroup. At this point, I am a bit confused about the exact curve underlying Monero, is it the whole of Ed25519 or the subgroup of Ed25519?

On the other hand, the Ristretto255 [1, 2] curve (built on Curve25519) has the same order as that of the curve used in the CryptoNote white paper [3]. My question is the following: Can we have a mapping from Ed25519 used in Monero to the Ristretto255 group? Will the relationship between public and/or private keys be preserved? Basically, if Monero has to be implemented using Ristretto255 in future for better performance, what would be the way to convert a Ed25519 curve point to a Ristretto curve point?

Apologies if I am missing anything trivial since I am beginner.

References:

https://ristretto.group/details/index.html
https://tools.ietf.org/pdf/draft-hdevalence-cfrg-ristretto-01.pdf
https://cryptonote.org/whitepaper.pdf

Building on Knaccc's answer.

Curve25519

The first step to build an Elliptic curve library is to define a field of prime characteristic. In this case, the field is 2^255 - 19, I denote this with K. In most eprints it is denoted as F_p.

We then define a curve over this field of prime characteristics. The curve that we define in this case is a Montgomery curve called Curve25519. Where the points on the curve are in K. Not every point is on the Montgomery curve, just like regular curves. It is only the set of points whose x and y value satisfy the curve equation. The set of points which are on the curve is defined as M(K). These points form a Group.

Comparing Curve25519 and Ed25519

First, they are both defined over the same prime field K. But Ed25519 has a different curve equation. We know that there is a Group of points which are on the Montgomery curve denoted M(K). So the question is whether, the Group of points on Ed25519 are the same points?

Lets denote the group of points on Ed25519 as E(K). There is a relationship between Curve25519 and Ed25519, it's called a birational equivalence: https://crypto.stackexchange.com/questions/43013/what-does-birational-equivalence-mean-in-a-cryptographic-context

The link above explains it very well, in short, there is a way to transform Curve25519 to look like Ed25519 except for a few points. These are called the exceptional points.

This means that M(K) and E(K) have roughly the same amount of points. The exceptional point, only comes up in the affine mapping, so can be avoided if we use projective.

In short, we can think of there being a mapping from M(K) to E(K). We are actually interested in E(K), but I mentioned Curve25519 first because Ed25519 came from it, in the relationship mentioned above.

Order of E(K)

The next question is "How many points are in the Group E(K)?"

There is paper by Craig Costello which says that the order must be even for both Edwards and Montgomery Curves.* In our case, the order is 8q. Where q is prime.

By lagranges theorem, E(K) can be decomposed into smaller groups which are multiples of its order. One group has has q points E_1(K) and the other group has 8 points E_2(K). This has been slightly simplified, see the link that knaccc posted above.

We are now looking at three groups E(K), E_1(K) and E_2(K).

Notice that the points in E_1(K) and E_2(K) are in E(K) since E_1(K) and E_2(K) are just decompositions of EK(). This means that E_1(K) and E_2(K) are subsets of E(K). We can go further and show that they are both subgroups.

Small subgroup

The points in E_2(K) have order 8. This means that if I take any point in E_2(K) and add it to itself 8 times, then I will arrive at a special point called the identity point. You can think of it as the zero point.

For example; if P \in E_2(K) then P + P + P + P + P + P + P + P = 0 . Instead of manually writing out the additions I could have equivalently written 8P = 0. This is known as scalar multiplication. In the case of 8P , 8 is the scalar.

The points in E_1(K) have order q. This means that in order to arrive at 0. You need to add the point to itself q times. ie if P \in E_1(K) then qP = 0.

The number 8 is small and all points in E_2(K) have an order of 8. We call this subgroup the small-order subgroup.

Contrasting, q is a prime and is large and all points in E_1(K) have an order of q. We call the subgroup E_1(K) the prime order subgroup.

E_1(K) and E_2(K)

So what's the problem? The problem is a mixture of two things:

We cannot force the user to use either E_1(K) or E_2(K). We have to assume that they have taken points from E(K).
You can mix points in E_1(K) and E_2(K) together.

Constructing the attack

Context: You are only allowed to use a point once. Using the point twice is analogous to double spending.

Goal: The attacker will attempt to use a point twice.

Pick a point in E_1(K). Lets call it P.
Pick 2 points in E_2(K). lets call them R_1 and R_2.
Compute T_1 = P + R_1 and compute T_2 = P + R_2.

The attacker tells Alice "T_1 is his point, you can use it to check on the blockchain when I make a payment."

The attacker tells Bob "T_2 is my point, you can use it to check on the blockchain when I make a payment".

These two points look different. But when we multiply it by a number that is a multiple of 8. We see that R_1 and R_2 disappear and the points become equivalent.

8 * T_1 = 8 (P + R_1) = 8 * P + 8 * R_1 = 8P + 0 = 8P.

As knaccc said above, whenever the scalar is a multiple of 8, the part that comes from E_2(K) disappears. So it looks like we have different points, but when multiplied by a multiple of 8, we can make the point be equivalent. This means that the attacker does not need to know the private key to T_1 or T_2. He just needs to sign with the private key for P.

This has lead to attacks as seen in this link : How does the recent patched key image exploit work in practice?

If I have not explained it well so far, essentially E_2(K) is bad and E_1(K) good!

Getting rid of E_2(K)

The way that Monero uses is called a subgroup check, and we essentially check if T_1 is in the prime subgroup, in our case this is E_1(K). To check if a point is in a specific subgroup, you multiply that point by the subgroup order and check if you get the identity (zero) point.

Let's take T_1 again and multiply it by the order of the prime subgroup.

q * T_1 = q (P + R_1) = q * P + q * R_1 = 0 + q*R_1 = qR_1.

If our point T_1 was in E_1(K), then it would have produced the identity. Since we did not arrive at the identity point, we know that this point has components in E_2(K).

This check is great and does what we want but it is also expensive to multiply by that large prime q. We must do this to every point we receive before running any verification procedure.

This check guarantees that a point is always in E_1(K). You can think of it as mapping E(K) -> E_1(K), where the order of E_1(K) is q.

What if we could build a group of order q from E(K)? This would also solve our problem. This is essentially what Ristretto does. You can think of it as E(K) -> 2E(K)/E[4] . Notice that it does not map to E_1(K). E_1(K) and 2E(K)/E[4] are groups of prime order, but they do not contain the same points. E_1(K) contains points which are in the prime order subgroup of E(K) while 2E(K)/E[4] contains points which form a prime order subgroup from E(K).

Ristretto

Ristretto is an extension on Decaf: https://www.shiftleft.org/papers/decaf/decaf.pdf

Above we alluded to the relationship between Curve25519 and Ed25519. There is another type of relationship that curves can have which we call an isogeny. In the Decaf paper, it cites a paper which shows that there is a family of curves whom are all isogenous to each other.

Furthermore, when we transform one curve to another curve, it can pick up a factor. For example, given two curves E' and E'' which are 2-isogenous, we have functions which maps points between E' and E'' and each map will double the corresponding point on the other curve. Here is a link to a test case for a 2-isogeny: https://github.com/cloudflare/circl/blob/master/ecc/goldilocks/isogeny_test.go#L21

The test in the link maps a point from E' to E'', then immediately maps the point back to E' . This means that the resulting point on E' will be 4 times the original point.

Decaf does not work outright for Ed25519, but it does for Curve25519, however since Curve25519 and Ed25519 are birationally equivalent. The formulas can be modified to map to Ed25519 through Curve25519. This is what Ristretto does along with  few other modifications: https://ristretto.group/details/isogenies.html#from-montgomery-to-edwards-via-isomorphism

So far, we have a family of curves, one of which is a Montgomery curve in our case Curve25519 and we have Ed25519 which can be mapped to, by any one of the family of curves through Curve25519. The only important curve in the family of curves worth mentioning is the Jacobi quartic curve. The Jacob curve is 2-isogenous to the Curve25519.

Encoding the point

Let's say I have a point P in E(K). Recap that E(K) is the group of points on the Ed25519 curve. First we use our birational map the point to Curve25519. So the point is now a point in M(K).

From the decaf paper, we know that there is a 2-isogeny from the Montgomery Curve to the Jacobi quartic. We apply this isogeny and our point is mapped to a point on the Jacobi quartic, but since it is a 2-isogeny it also picks up a factor of 2. If P was in the small-order subgroup E_2(K) then when we map it to the Jacobi quartic we would only need to double the corresponding Jacobi point twice in order to get the identity element.

What is the importance?

Instead of checking if our point is in the correct subgroup, our strategy will be to now group all points which differ by a point of order 4 and force an algorithm to output a specific point. All of the points which differ by a point of order 4 are exactly all of the points which were equivalent when we multiplied by a scalar which was a multiple of 8 in E_1(K).

To see this, let P \in E_1(K) and let R_1, R_2 \in E_2(K)

Compute T_1 = P + R_1 . When T is mapped to the Jacobi quartic, it picks up a factor of 2.

2 * T_1 = 2 * P + 2* R_1
2 * T_2 = 2 * P + 2* R_2

Notice that because R_1 was doubled, it is now an order of 4 away from the identity point. So T_1 and T_2 differ by a point of order 4, when we apply the isogeny to map it to the Jacobi quartic. Notice also that P + 0 also differs by a point of order 4 and is also in this group of point which differ by a point of order 4.

Why is this important?

The Jacobi quartic has a really succinct representation for all of it's points which differ by a point of order 2. But for this explanation, lets pretend it is by an order of 4, the logic still follows through. :https://ristretto.group/details/isogeny_encoding.html#encoding-mathcal-j--mathcal-j2

As the link mentions, it is possible to consistently pick one of the points in the set of points which differ by an order of 2(again lets pretend it says 4), by enforcing two sign checks. These two can be easily programmed into an algorithm.

Another example of a sign check, is when you are sending a point to another user. You take the Y co-ordinate and use a bit to denote the sign of the X co-ordinate. In this case, you are distinguishing between the negative and positive-ness if the X co-ordinate. This check is usually done on the Edwards curve Ed25519.

Contrasting, this check is computed on the Jacobi quartic curve, which is not the curve that we are doing arithmetic on. It is Ed25519. Fortunately, the encoding can be transported to Ed25519 https://ristretto.group/details/isogeny_encoding.html#transporting-an-encoding-along-an-isogeny

So we make our sign choices in the Jacobi quartic, then we transport these sign choices to the correct curve.

Summary

When you compress a point, you use a 2-isogeny to transport the point to the Jacobi quartic, picking up a factor of 2, you then make two sign choices which picks a specific point. When you decompress a point you check that these two checks are satisfied on the Jacobi quartic curve, which means that this point is the specific point out of all of the points which differ by a point of order 4. Then you transport the point to the Ed25519 curve.

Important Details

In the above sentence, I said specific point , I did not say a point that is in E_1(K). The point that we pick as a representative can be in E_2(K) , we just need to consistently pick the same point, which our sign check allows.

_Question: So If we can pick a point in E_2(K) , how does Ristretto solve the prime group problem?_

Ristretto does not force a point to be in E_1(K). It builds a prime order group from E(K). And it does this by always picking the same point out of the possible 8 equivalent points. This new Ristretto group will have prime order, because it is always picking 1 out of the 8 possible points.

Does this really solve the problem?

We can formulate the problem another way. Each Point in E(K) had 8 different equivalent points. No matter which one of these 8 equivalent points you give the Ristretto algorithm, it will give you exactly the same one. The other 7 points are no longer representable.
Caveat

There is are two security caveats. We are assuming that all points are passed through the Ristretto ENCODING algorithm.

If the points are modified at a later point, after going through the encoding algorithm. Then it is possible to simply change the representative point that was chosen.

This is why you must only add Ristretto points with Ristretto points. Ie only the representatives of the set of points should be used. You should never mix a RistrettoPoint with an EdwardsPoint, because the EdwardsPoint you are mixing with, may not be the representative for the set of possible points. This is mentioned in the IETF you linked, at the end I think.

Thing I have omitted or lied about

The Jacobi quartic actually has a succinct representation for points which differ by an order of 2, and Ristretto applies an extra step to transform the points which differ by an order of 4 to points which differ by an order of 2. This is explained in the torquing section, but is not important to understand most of Ristretto.

Hope that helps. If any mistakes are found, please feel free to correct them.


Connecting Monero Light Wallet on Tails with Remote Node I have downloaded Monero Command Line Interface on Tails and I tried connecting it to a remote node with this command as described here: https://github.com/monero-project/monero

Command:

sudo iptables -I OUTPUT 2 -p tcp -d 127.0.0.1 -m tcp --dport 18081 -j ACCEPT

It succeded!

But when I ran this command, I got this error!

DNS_PUBLIC=tcp TORSOCKS_ALLOW_INBOUND=1 torsocks ./monerod --p2p-bind-ip 127.0.0.1 --no-igd --rpc-bind-ip 85.194.238.131 --rpc-port-ip 18081 --confirm-external-bind

It shows that it failed to bind the server 85.194.238.131:18081

I spent hours trying connecting it to remote node but failed to do so.
Please explain me how should I connect my walla et to remote node.

Many remote node servers use the port 18089 as explained on Connecting to the remote node from the wallet, so you should try using that port.


Will command line daemon/wallet still be available after the release of the official GUI? Will the Monero command line daemon/wallet programs still be available after the release of the official GUI?

Will Monerod will be blended in similarly to how bitcoin core node/wallet is?

Will command line still be available after the release of the official GUI?

Yes, it will. As far as I know, there will be support for both in the future. Thus, you will have monero-wallet-cli, which is the command line wallet, and monero-wallet-gui, which will be the GUI wallet.

  Will Monerod will be blended in similarly of what bitcoin core node/wallet is?

In the future, yes, see the feature request opened here. For now, however, monero-wallet-gui will be a separate binary that has to run alongside monerod. However, the GUI has a progress bar that shows the syncing status of monerod. Thus, new users would only have to open monerod and let it sync. They can monitor the progress in monero-wallet-gui.

Note that monero-wallet-gui might not be the official naming, but I used it in this answer for convenience.


Mining on Mecer Xtreme S01 PC-On-Stick? The Mecer Xtreme S01 PC-On-Stick comes with an Intel Bay Trail Quad Core Z3735F CPU. Is it possible to mine Monero on this device?

Yes, since Z3735F has x86_64 instruction set.

But there is no AES so you will get a very small hash rate, and considering its design, it will probably overheat, so most probably not worth it.


What is the walletname.unportable file? I have 4 wallet files:
walletname.address.txt file
walletname.keys file
walletname

What is this type of file?

  walletname.unportable

Thanks :)

This file is a copy of the cache file (walletname) as it was when the cache file format changed to use a more portable data storing library. It was kept as a safeguard in case the new format proved buggy, so it can now be discarded.

For reference, the old format was boost serialization, and the new format is portable boost serialization, which is not yet merged in boost to my knowledge.


monerod v0.12.0.0 can't synchronize I'm on Version 0.12.0.0

2018-05-10 08:03:53.066 [P2P6]  INFO    global  src/cryptonote_core/blockchain.cpp:1464 ###### REORGANIZE on height: 1568536 of 1568547 with cum_difficulty 14490123635886036
 alternative blockchain size: 13 with cum_difficulty 14490179675843288
2018-05-10 08:04:38.570 [P2P6]  ERROR   blockchain      src/cryptonote_core/blockchain.cpp:886  Failed to switch to alternative blockchain

These were likely bugs which are fixed on the current release-0.12 branch.
There should be a new 0.12.1.0 release in the next few days to a week, which will include these fixes.

See these:

https://github.com/monero-project/monero/pull/3719
https://github.com/monero-project/monero/pull/3776
https://github.com/monero-project/monero/pull/3788


Are there any extant implementations of the groestl that Monero PoW uses that utilize AesNi instructions and byte-slicing? I've been trying to put together a byte-sliced groestl (small) that use AesNi.  I've seen plenty of groestl (large) implementations that do this, and have been using them for inspiration, but when you're only dealing with 64 instead of 128 bytes in the p and q rounds, the transpositions, byte offsets, and finite-field arithmetic is a little trickier.  I was wondering if anyone knows of a github that has such a thing that I can use for reference.

Thanks in advance!

The powhasher miner uses aesni-accelerated groestl from the groestl-aesni crate, implemented with llvm intrinsics. Small groestl actually parallelizes better than large groestl: the trick is to do the P rounds and Q rounds in tandem. (I am the author of both projects.)


Estimated mining profits are overestimated I mine with 1KH/s for moneropool.com. The estimated mining profit should be about 0.12 XMR/day, but I'm getting much lower profits, only about 0.04 XMR/day.

The site says that on average every 40 minutes a block is found, but I often see that the last found block was 3 or 4 hours ago.

So, whats wrong here?

On the "Pool blocks" page, you can see in the last column the luck indicator, which is essentially the number of hashes produced by the pool to mine that block vs. the difficulty of the block.

They seem to just have gone through an unlucky sequence with fewer blocks found than expected.

A few notes on this:

there will always be an element of luck in finding the next block, but over time the frequency of blocks should be close to the estimated value
for example, at 2 MH/s vs network hashrate of 50 MH/s, they would find a block every 50 minutes on average, with a ca. 2% probability to find no block for 4h or more, and 15% for 2h
the longer you mine, the closer you should get to your 0.12 a day
the "faster" the pool, the quicker you will get close to your average thanks to the pool "smoothing" of large random events - but the pool you mention looks reasonably large at the moment so shouldn't be a problem
it can never be completely ruled out that the pool is cheating: they may have changed the code of the pool to skip blocks from time to time (I'm not saying it's the case here), they could also change the luck indicator; you can (and should) look at block history and compare the average frequency over time vs their speed to get a feeling of their honesty.


How to use the --extra-messages-file option? monerod has an option to include an extra message in a coinbase transaction with --extra-messages-file.

What format should the text in the file be? Hex, Decimal, or some other format?
Once the transaction is mined, how do you parse the data out of the extra field and decode the message back to plain text?

This option is available for the in-built miner. Reviewing how it's used:

Its expected format is one base64 string per line.
When the miner requests a block template to mine, it adds the current index line from the file as the extra_nonce field in the block template - this gets placed in the tx extra field.
When the miner finds a block, it increments the index counter so the next block template includes the next line from the file in the next extra_nonce.

So,

  What format should the text in the file be? Hex, Decimal, or some other format?

Data is expected to be base64 encoded.

  Once the transaction is mined, how do you parse the data out of the extra field and decode the message back to plain text?

You have to parse the tx's extra field. The format of this is a binary blob of tagged data. To read, you need to loop over it reading the tags and data like:

Start at index 0 of the data
Read the 1 byte tag
If the tag is 0x00 (padding), continue to next byte and read (step 2)
If the tag is 0x01 (pub key), skip over the next 32 bytes (the size of a pub key) and read next byte (step 2)
If the tag is 0x02 (extra)

The next byte tells you the size of the data
Read size of bytes (this gets you your extra data)

If any other tag found, read the next byte (size) then skip size bytes and goto step 2.

Keep looping until you have either found the tag/data you are looking for or read the whole field.


How can I delete the last X blocks from my local copy of the blockchain and retrieve them again from the network? I think my blockchain has an error sometime within the last day. How can I wipe out a bunch of blocks and get them from the network again?

monero-blockchain-import --pop-blocks n

Where n is the number of blocks you want to remove from the end of the blockchain.


Moving LMDB from Laptop to SBC? I have a synced Database on my Laptop running W10, but I want run monerod on my Odroid C1 running debian linux. Is it possible to move the database from the Laptop to the SBC

It might work. Edit: As per hyc's comment, it will work fine.

You can safely try as it would properly trigger an error.

Here is a detailled answer.


getmonero.org have some kind of language system? I have someone willing to work on getmonero.org to translate into portuguese, was wondering if getmonero.org have some language system already build or how he should address the translation

I'm not entirely sure how the translations are being handled, but I recommend going to the official Monero forum and maybe posting it in the 'Ideas' section and seeing what the response is.

That being said, I have read once or twice about someone wanting to redesign the website. So if that is the case then it may be better to wait.

Or if you want a more immediate answer you can try the #monero or #monero-dev channel on Freenode.


cpuminer-multi error when mining cryptonight on Linux I have just set up cpuminer-multi on my Raspberry Pi B+, my aim is to mine a cryptonight coin called Bytecoin. Instead of connecting the mining Pi to the pool, I will be connecting the mining Pi to a proxy which is connected to the pool, so that I can mine with more than one Pi.

I did this by doing the following...

# update raspbian
sudo apt-get update -y

# install the following dependent modules
sudo apt-get install autoconf libcurl4-openssl-dev libjansson-dev openssl libssl-dev gcc gawk

# clone this miner repo
git clone https://github.com/lucasjones/cpuminer-multi.git

# navigate to the directory and compile
cd cpuminer-multi
./autogen.sh
./configure
make

But When I enter the following code to start the miner...

 ./minerd -a cryptonight -o pool.bytecoin.party:3333 -u (My Bytecoin Address Was Here) -t 1

I get the following error...

[2018-01-08 21:40:07] Using JSON-RPC 2.0
[2018-01-08 21:40:07] CPU Supports AES-NI: NO
[2018-01-08 21:40:07] 1 miner threads started, using 'cryptonight' algorithm.
[2018-01-08 21:40:07] HTTP request failed: Empty reply from server
[2018-01-08 21:40:07] getwork failed, retry after 10 seconds

I have even tried setting up a proxy on another Raspberry Pi that connects to the pool, but when I try to connect the mining Raspberry Pi to the proxy Raspberry Pi, I get the same error.

I tried to see if the miner will mine any other cryptocurrencies, so I initiated scrypt mining to my Litecoin pool and that worked well.

I am unsure about how to fix this, any help or suggestions will be much appreciated,

Thanks!

Sid

Your pool uses the stratum protocol instead of the older getwork protocol that cpuminer-multi defaults to. Use -o stratum+tcp://pool.bytecoin.party:3333.

I'd also recommend switching to xmrig since cpuminer-multi has been dead for a while.


SIGAINT and Monero Tor node What is SIGAINT and why are they running a Monero node on Tor?

Has SIGAINT made a statement explaining their rationale?

What is SIGAINT

From their website:

  What is SIGAINT? SIGAINT is a darknet email service that allows you to send and receive email without revealing your location or identity. We provide this service to help journalists and activists combat the dragnet surveillance that exists on the Internet today. Even if you aren't in conflict with the state or anyone in particular you as a human being deserve privacy.

In addition, there is this Wikipedia entry.

  and why are they running a Monero node on Tor?

From their announcement:

  It enables a Tor user to easily transact in Monero using a thin-client while securely maintaining the keys to their wallet on their computer all while not even exiting Tor!

  Has SIGAINT made a statement explaining their rationale?

Yes, they have:

  Why Monero?

  The SIGAINT operators firmly believe that Monero is the next logical step in Darknet commerce. It solves most of the privacy problems that plague cryptocurrency systems such as Bitcoin. (Youtube video explaining how Monero works.)

There is one, additional, interesting bit from their announcement, namely:

  What about cryptocurrency X/Y/Z? I heard they can mix/join/ninja vanish.

  Bitcoin mixers (even coinjoin) are not enough to maintain transaction unlinkability. Not to mention the Bitcoin blockchain data is currently being mined and sold to law enforcement.

  Dash's supernodes could collude to reveal who you are.

  Zcash is operated by an LLC in the USA. Besides the obvious political problems, Zcash doesn't mix by default it is opt-in. Also, it may be possible for the maintainers to secretly inflate the currency by hiding inflation into zk-SNARK "pours".


How to sweep the contents of a specific output? I noticed that the sweep_all command warns when it is about to merge outputs from the same transaction, which I appreciate, as that would kind of break the point of ring signatures and make my transactions traceable, after all. But then it provides no alternative... I'm trying to spend by amount, in the hopes that the wallet will always pick the largest output, but that's not a fail-proof solution, as the wallet could very well merge smaller ones instead.

Are there any plans to implement something like sweep_output command, or a transfer command where you can pick the outputs, or in the worst case, something like raw transactions in Bitcoin?

PS: That actually raises another question. I bought some Monero and the exchange credited me, in the same transaction, two different outputs, both with hidden amounts. What's the point? I understand this was necessary before RingCT, but now that the amounts are hidden, why would the exchange wallet create more than one output for me?

Thanks!

The TX would only link those 2 outputs together if they come from same TX. If they come from different TX-es, no problem - that's where ring signature has you covered as it will be ambiguous from which TXes are the outputs getting spent.

Even if in 1 TX the ring is "broken", just make another TX after it and already the trail is fuzzed. 2nd output is usually the change so it shouldn't belong to your wallet anyway. I think that even when you send to yourself there will be 2 outputs (2nd one of 0 value, but can tell which one it is)


Security model for new auto update feature in GUI v0.16.0.2 'Nitrogen Nebula' What steps are taken to verify the binaries via the new GUI auto update feature? How does it compare to downloading the them and manually verifying the hash as GPG key as was required for previous versions?

The security features were listed in the initial announcement post of the auto-updater:

We added the following security features:

3 out of 4 DNS server must indicate a new update is available.
The hash of the downloaded binary must be the same as here: > https://web.getmonero.org/downloads/hashes.txt
hashes.txt must be signed by a maintainer.
An extra valid signature by a second maintainer is also required.
The GPG keys of the maintainers are hardcoded and can’t be changed by an attacker.

Only if all those points are successful the GUI will download the new update.
This means in the future once a user has downloaded the GUI safely they can always update in app and don’t have to worry about hashes and GPG signatures.
Note that the points above only apply the the update tool inside the GUI and those who manually download still have to verify hashes and signatures.

Source: https://www.reddit.com/r/Monero/comments/h139vq/new_gui_updater_in_v016/

How does it compare to downloading the them and manually verifying the hash as GPG key as was required for previous versions?

Verifying the hashes manually essentially entails the following:

Import and verify GPG key (fingerprint) of the maintainer that signs the hashes (binaryFate currently).
Check whether an update is available.
Download and save the hashes.txt file.
Verify the hashes.txt file against the GPG key of the maintainer.
Check whether SHA256 hash matches the hash displayed in the hashes.txt file.

Basically the only difference is that, for the auto-updater, a second signature from another maintainer is required.


How do I create a subaddress with the cli wallet? With Lithium Luna v0.12 sub-addresses were added.

How do I create and manage sub-addresses that I can use to enhance my privacy?

The new cli command is called address.

address [ new <label text with white spaces allowed> | all | <index_min>
[<index_max>] | label <index> <label text with white spaces allowed>]

To create a new sub-address for the current account use address new.
You can view all addresses with the address all command.

Each sub-address will get an index starting with 1 since the primary account address is at index 0.

You can also add a label to each sub-address as optional parameter or later with the label option.

Edit:
If you want to see balance on the sub-addresses you can use the command "balance detail" on the cli.


Does Monero have zero-conf? Is there such a thing as zero-conf in Monero and if yes, then how does it work?
Is it supported by the Monero client?

You're probably referring to the concept where a vendor will accept payment, even when the payment has not been included in a block.  Sure, that works the same way in Monero that it does in Bitcoin.  The transaction in question will be visible in the mempool.  When the vendor sees the transaction in the mempool, he may decide to release goods to the customer.


Cryptonight mining on Raspberry Pi Recently I found out about cryptonight algorithms, Bytecoin in specific. I have about 20 Raspberry Pi’s here and I would like to know if cryptonight mining is possible on ARM processors.

I am also planning to join a pool, so the mining software needs to be compatible with pools.

Thanks!

Sid

You'll get about ~10H/s in my experience.

I use https://github.com/tpruvot/cpuminer-multi

(You may need to switch to the ARM fork on the repo).
You should be able to compile it once then scp it to your devices.

Here's another thread that may be helpful:
Could I use a Raspberry Pi to mine Monero?

Also with this number of devices, you may want to add proxy:
https://github.com/xmrig/xmrig-proxy

Simplifies your management greatly.


Help I forgot to enter a payment ID help Iam using monero gui, but I don t have a payment id. What can I do ? Please help me ? They have send my the monero but I have forgetten to enter a paymend ID. My monero know lost ?

Are you using wallet/exchange service from a company like poloniex?
If so, you need to contact them about your transaction

As I know...
If you use your own wallet, you don't need to worry about payment id.


What is the difference between Monero (XMR) and Verge (XVG)? I would like to have a comparison between the privacy features of Monero vs Verge. I have heard some people say that these are privacy-oriented coins, and I would like to learn more.

Despite both being advertised as privacy-focused cryptocurrencies, they are very different.
Summary
Monero uses ring signatures, RingCT, and stealth addresses to hide information on the blockchain. For every transaction, there is no way for an outside observer to determine the sending address, the amount sent, or the receiving address. Optional transparency can be provided off-chain by giving the desired person(s) the view key. Monero can be used with Tor or I2P manually, and Kovri is being worked on to provide native anonymous routing functionality.
Verge began under the original name DogecoinDark. It uses the same exact technology as Bitcoin and Dogecoin on the blockchain. For every single transaction, the sending address, amount, and receiving address are all visible. Verge users can optionally use Tor to send transactions.
It is disputed whether DogecoinDark began as a fork of Dogecoin or of NovaCoin/Peercoin.
Impact
Let's walk through a few use-case situations to compare how these coins protect the privacy and security of users.
Situation 1: Bob buys cryptocurrency on an exchange. Suppose this exchange complies with all local legal regulations and collects significant information about its users, including their address, IP address, name, and social security number.
With Monero, you can send coins off the exchange. The exchange knows what address you send the funds to, but it does not know how much money is in the address, and it does not know where the money will be spent in the future. Once it leaves their possession, the exchange doesn't know anything about it.
With Verge, the exchange knows what wallet you withdraw the money to, and it knows the balance of the account. It knows every other transaction involving this address in the past and in the future. It can track the funds sent throughout every address the funds touch forever.
Situation 2: Alice deposits cryptocurrency on an exchange. Suppose this exchange collects information as mentioned before.
With Monero, the exchange does not know what address the funds came from, and it does not know what this money was previously used for. It does not know the balance of this address.
With Verge, the exchange knows the address the money is coming from, the address's balance, and every transaction this address is associated with in the past and in the future. It can track the funds sent to the exchange throughout their past to learn exactly how they were transferred between different addresses.
Situation 3: Charlie buys coffee with cryptocurrency at a local shop.
With Monero, the shop owner does not know what address the funds came from, and it does not know what this money was previously used for. It does not know the balance of this address.
With Verge, the shop owner knows the balance of the address, and it knows how this money was previously used. The shop can audit the incoming funds to determine if they are "clean" or "tainted"; they can refuse payment of "tainted" funds or charge a higher rate. The shop owner can attempt to charge a wealthy customer more and threaten to steal their funds. It knows if this address is used in the future.
Situation 4: Dan receives payment from a stranger.
With Monero, Dan does not know the address of the stranger. The stranger knows Dan's address. Dan and the stranger do not know anything about their transaction history.
With Verge, Dan knows the address and balance of the stranger. The stranger knows the address and balance of Dan. They each know all transactions made with these accounts, including any possible transactions in the future.
A Note About IP Address Obfuscation
Tor and I2P can be used by pretty much any cryptocurrency, including Bitcoin and Monero. You do not need to use a separate coin to receive the benefits of routing traffic through Tor. These are separate things.
The IP address of a transaction is never stored on the blockchain. It is only leaked as metadata to nodes that you are connected to. For instance, suppose Alice runs a full node and sends a transaction. Suppose she is connected to 8 of 1000 nodes on the network. Only these 8 nodes receive her IP address, and they do not know for certain that they were the first to receive the transaction request. There is still a level of uncertainty.
Hiding an IP address is not nearly enough to have privacy. It must be combined with an obfuscated blockchain. If a user had to choose one over the other, they should prefer an obfuscated blockchain, since the blockchain information is shown to the entire network and stored forever.
A Note About the "Wraith Protocol"
Verge has been advertising the including of the "wraith protocol" in their coin for some time now. The "wraith protocol" is a rebrand of stealth addresses used in Monero and other CryptoNote coins. It has not yet been implemented.
Monero and other CryptoNote coins have had mandatory stealth addresses for their entire histories. Verge plans to make this feature optional, and NOT include other features such as ring signatures or confidential transactions.
This feature only really works if everyone uses it. It offers little to no protection if only a small fraction of people actually use it. The majority of the blockchain will still be completely transparent, which means there will be little or no privacy protection for those using the "wraith protocol."


Synchronizing and p2pstate.bin, GUI wallet Hello I have 2 questions after recently downloading the monero blockchain to a whonix instance. I am using the GUI wallet.

When I log into the wallet I get "Daemon is synchronized" but the block height shown is not the true block height, it is behind a few dozen blocks and I wait but it will not continue to sync. I end up having to close down the wallet/node and reopen it a few times to get it to realize it is behind. Is there a way doing this can be avoided? I do not know what the problem is.

When churning funds these days is p2pstate.bin still a vulnerability? I used to delete it between churns and IPs, but I also read somewhere that this is not an issue any more but there was no explanation.

Thank you

If you are fully synchronized but your block height is not the same as other people, you are not fully synchronized or are connected to bad peers. Check against know block explorers (e.g. xmrchain.net) or remote node operators (like xmr.to).

As repeatedly pointed out, churning in most cases is actually harmful to your privacy. The only exception I'm aware of is churning specific outputs you know you need to disassociate from each other. As for p2pstate.bin, deleting it just means your daemon is going to have to look for peers again, t does not mean you are guaranteed to use new / different peers. I suggest you only delete it if your having sync problems.


What kind of pruning techniques does AEON use? AEON has a pruning branch. What kind of pruning is it? Is it just like Bitcoin pruning, or is there more to it?

These questions are answered by the pruning FAQ, which was posted by core-developer smooth, who is also a core-team member of Monero.

Pruning FAQ
Q: What is pruning?
A: Pruning refers to removing unnecessary information from the blockchain once it is no longer needed.
Q: What are the advantages?
A: Pruning reduces the amount of storage needed for the blockchain. If the blockchain is loaded into RAM (which is the case in the current implementation), then it also reduces RAM usage. Finally, it also reduces the rate that these resources are consumed over time as the blockchain grows. In the current implementation, each time one new block is accepted, one old block is pruned, on average freeing up a large portion of the resources needed for the new block.
Q: How does pruning affect functionality?
A: The only inherent functional limitation of AEON's pruning is the inability to restore (also known as rescan) a wallet which was used for spending transactions. All other functionality including sending and receiving coins, mining, updating a wallet after any period of inactivity, cold storage, mining, etc. remain fully supported. There is a current limitation that after extended period of disconnection (>28 days) a node may have trouble resynchronizing with the network, and would need to be reset. This is not inherent and should be addressed later.
Q: Does pruning reduce the effectiveness of ring signatures for transaction privacy?
A: No, ring signatures and privacy are unaffected.
Q: How is pruning enabled and disabled?
A: Using the --pruning option on the daemon command line. With this option the daemon will prune the blockchain and will also switch from using the blockchain.bin file for storage to blockchain-pruned.bin. To switch an existing node into pruned mode, copy blockchain.bin to blockchain-pruned.bin before starting the daemon with --pruning. To switch pruning off, remove the --pruning option. Do not, however, copy blockchain-pruned.bin to blockchain.bin. This will not work. You will need to have an unpruned blockchain.bin file or resync unpruned from the network.
Q: How does AEON's pruning compare with Boolberry's pruning?
A: AEON prunes slightly more information from the blockchain, so the required storage is slightly smaller (given equivalent usage), though the difference is likely not particularly significant. BBR prunes the blockchain on the entire network while AEON prunes on each node individually (and only if pruning is enabled). This means that new nodes can come online faster with BBR, but those new nodes are unable to independently verify the entire blockchain. It is possible to download an unpruned BBR blockchain from a web site to independently verify it, but in that case the amount of data downloaded would be the same as AEON. It also means that every BBR node is able to serve the chain to new users but in AEON this function falls to nodes that are unpruned, also known as "archive nodes" (or alternately via a trusted bootstrap file).
Q: How does AEON's pruning compare with Bitcoin's pruning?
A: In Bitcoin 0.11, the same model of pruning is implemented as in AEON. That is, nodes prune blocks locally, after syncing from an unpruned chain and verifying the chain independently. Like AEON, Bitcoin pruned nodes can't rescan or reindex wallets. Bitcoin 0.11 does not support wallets on pruned nodes at all, so it currently has more limitations that AEON. Old Bitcoin blocks must be retrieved from unpruned archive nodes, as with AEON.
Q: What other coins implement pruning?
A: Other than Boolberry, Bitcoin, and possibly some coins which have inherited their implementation by being Bitcoin forks, no other coins implement pruning at this time.
Q: What's this about "archive nodes"? How can I run one?
A: When nodes connect to the network, they retrieve blocks from other nodes. If only blocks within the most recent 10 000 (approx.  28 days) are needed for syncing, even pruned nodes can provide them. However, in the case of nodes which are brand new (syncing from the genesis block) or which have been offline for >28 days, pruned nodes will be unable to supply the older blocks. Instead this task falls to unpruned nodes, also known as archive nodes. For the time being the project-run seed nodes will always run in unpruned mode, and others with sufficient RAM and storage space who wish to support the network are also encouraged to do so. To run an archive node, simply start the daemon in the normal manner, without the --pruning option.
Q: What are the numbers? How much does pruning reduce the amount of memory and storage needed?
A: The exact numbers will vary according to OS, compiler, etc. and also depend on the usage of the blockchain in the future. One early report from BoscoMurray stated, "RAM usage down from 4.8GB to 2.4GB and blockchain file size down from 3.2GB to 1.7GB"
Q: That doesn't seem like a big reduction. Why is the benefit not greater?
A: To explain why the reduction is not larger and understand what this means for the future, let's first review some basics of how a blockchain works.
Every time a coin is spent, a digital signature accompanies the transaction in order to show that the owner of that coin authorized spending it. Once this signature is checked, it is no longer needed. This is the largest portion of what is being pruned. In the cryptonote signature scheme (used by AEON), ring signatures used for anonymity, which means while a signature shows the coin owner authorized the transaction, unlike conventional signatures, it does not identify the specific coins being spent, and therefore does not allow tracing and analyzing the blockchain. As a side effect of this functionality, these signatures are much larger than ordinary digital signatures (a fact sometimes described as "cryptonote bloat"). Thus in AEON, pruning offers great benefit and eliminates the "cryptonote bloat".
So why is the savings not larger? Because in the early history of AEON, there was a very large number of very large transactions and many of those transactions did not using ring signatures. This happened for several reasons, including a major flaw in the early versions of cryptonote mining pool software. Thus, while the chain is relatively large, a relatively small amount of storage is saved by pruning the early transactions.
The newer transactions are a different story. The pool software flaw was fixed long ago, and most transactions now do use ring signatures. So the savings from pruning going forward should be much higher (perhaps 75-80%). Of course, since ring signatures are now being routinely used, it means that that actual anonymity of the coin in practice is greatly improved, and with pruning there is no long term storage cost (i.e. no "cryptonote bloat") for most nodes (other than archive nodes). We get the best of both worlds!
Q: What about a database or disk-based block storage? Doesn't that also reduce memory usage?
A: Storing the blockchain out-of-memory in a database or in cache files reduces memory usage but does not reduce storage usage nor reduce the rate of growth of storage usage over time. In AEON, the plan is to later support out-of-memory storage of the blockchain along with pruning, so memory usage will be further reduced, and storage usage will remain low and grow very slowly over time.


btcrecover for monero? Recently I forgot my password to dogecoin wallet and brute force it with btcrecover (github.com/gurnec/btcrecover), which support bitcoin and many altcoins. Although only around 20 words give me something like 6 mln combinations, I found my password in about half an hour.

Is there something similar exist, planned, or possible for monero to brute force password or seed, in case I forgot some words or correct sequence?

BtcRecover is for cases where you already know most of your password or seed. If you don't remember nothing of your password or seed, this program is useless. Even all the supercomputers in the world couldn't brute force a Monero seed or correctly created password.


Is having P2Pool 'baked' into the Monero network possible? people have talked about p2pool mining and some mentioned 'baking' it into the protocol. is this possible and would this be desirable for monero?

The one problem with a p2pool baked into the core code is that the payouts would have to be distributed to everyone participating in the p2pool (which would presumably be everyone), and each of these payments would be infinitesimally small. Or, you would have to have a payment threshold to reduce the amount of crazy small outputs from being created, and this threshold would be so much that a participant wouldn't get paid for a long time - probably the same amount of time that natural mining variance would permit the user to find a block.

Ultimately, satoshi was a smart guy and the block reward distribution via random lottery works within the confines of a tokenized ledger consensus currency network.

But thats not to say that it could be built. It just has a lot of interesting dynamics to be worked out.


Does fluffy pony really own and run MoneroDice website? Reading the faq on monerodice. It says fluffypony owns and runs that website. How can one verify this claim?

He responded to many topics regarding MoneroDice from his Reddit account and he's a moderator of the monerodice subreddit.

His GitHub account also confirms he's running the site.


How hard is it to find the originating IP of a monero transaction (pre Kovri)? I can only theorize about how you would attempt to trace someone's IP. I want to know the opinions of people more knowledgable about the subject.

It's the same as in Bitcoin. You have to connect to a large amount of nodes, and see which node you first heat about that tx first. Then this node is either the originator, or "closer" to the originator than the ohter nodes you're connected to. "closer" here means closer in relay time, wihch depends on internet connection speeds, etc.


If I compile monerod from source, do I also have to compile the GUI to use the GUI? I monerod running on headless node in my home.  Let's say I want to use the GUI wallet as a light wallet on a different computer in my home, and I'll just use the node's daemon/blockchain.  Is the process just as easy as downloading a pre-compiled binary?  Would I have to also build from source?

There are no pre-compiled GUI binaries released yet. When beta is released you will be able to download binaries but for now you need to build them yourself.


Is there a way to search the blockchain by mixin? Is there a tool that I can use to search the blockchain for transactions sorted by number of mixins?

For example if I wanted to find all transactions with exactly 10 mixins how would I do it?

You'll have to write some code for this.

There is a BlockchainDB::for_all_transactions function which can run a callback through all the transactions in the db. See the blockchain_dump.cpp file for an example. The callback can simply output the hash for all the transactions with a mixin of 10 (mixin being one less than the number of inputs in each vin array element). Note that those elements don't necessarily have to have the same size (ie, inputs can have different mixins).


How will Monero core developers get funded? How will Monero core developers get funded and is there a way to donate to core developers for developing Monero, and what are the future plans for funding for Monero core developers?

There is a lot of interesting info on the monero site. Specific to your question is this page.


At what date will the initial 18.4 million coins have all been mined? Is it possible to calculate the exact time and date the initial 18.4 million coins have all been mined?

And assuming that the total amount itself isn't altered, what if anything could cause this date to change?

The emission was set and determinable from day 0 and will never be changed.

The initial 18.446 million coins will be mined by May 26, 2024 (by comparison Bitcoin will be over 93% mined at the time). The precise hour and the minutes cannot be inferred because of the variance in the time to mine Monero.


How would sharding work in Monero to help with scaling? I heard some monero developers talk about sharding to help manage the size of the blockchain. Sharding is where every node only hold a small pieces of the blockchain to help deal with blockchain size growth and they all work together to validate transactions/blocks. How would something like this work in monero? Is it possible to work properly?

Currently it's still an open question but I believe it's the inevitable path if Monero adoption increases. The optimal way for a sharded distributed DB to operate is to have encoded rules for mapping from a key to a shard node. E.g., to look up a key image, use the first byte of the key as a map to one of 256 possible branches of shared containing the record. Some distributed systems use a central directory to redirect lookups to their respective nodes - these scale poorly since the central directory becomes a bottleneck itself.


Is there any advantage for a regular user to run a node? What do we gain by running a node and what does it accomplish for the Monero network?

By running a Monero node, you gain access to a fungible currency (albeit with large price volatility). It is like Bitcoin, but better (subjective, of course, there are pros and cons). You can send and receive monero privately (privacy/fungibiity are the twinned major changes from Bitcoin).

The network gains decentralization too: it becomes harder to perform segregation/partitioning attacks. If you mine, you make it harder to an attacker to 51% the network (and you also get block rewards, albeit infrequently).


How to install CryptoNote-Lite pool mining software on macOS? I want to pool mine Aeon with a CPU on macOS. How do install a CryptoNote-Lite miner? Preferably using open-source where I can compile myself (procedure needed).

I know it's been a while since you asked this, but in case anyone else is wondering, you can easily install xmrig on MacOS by following the build instructions on Github.

First you need to install Xcode from the App Store, and then you have to install Homebrew.

Once you have those dependencies, you need to run the commands given on the xmrig OS X Build instructions page (from a Terminal window):

brew install cmake libuv
git clone https://github.com/xmrig/xmrig.git
cd xmrig
mkdir build
cd build
cmake ..
make

Once the compile process finishes successfully, there will be a binary executable in the build directory named xmrig.  You can verify that it is there by running this command in the build directory:

ls -lah | grep xmrig

Run xmrig in OS X the same way you would in Linux.  From the build directory, run the following command (I've included my preferred pool... feel free to replace it with whatever you use):

./xmrig -a cryptonight-lite -o "mine.aeon-pool.com:3333" - u YOUR_WALLET_ADDRESS -p x

You can optionally specify a donation level. By default, xmrig donates 5% of your mining time to the developer, but you can set it as low as 1%, depending on your generosity preferences.

Note: If you have a good CPU (hashrates over 300 H/s), you might want to mine on port 5555 instead of 3333, since it will start you at a higher difficulty (better earnings). Check your pool's "Getting Started" page for more details about what port numbers and difficulties are available.


Blockchain syncing and transactions verification Recently I updated to version 0.10, but that wasn't an easy process. It took too long to go over my old blockchain and make it compatible with the new client, so I aborted that (iirc there was no progress report, and the whole thing was indistinguishable from frozen). Then I tried re-downloading the blockchain from scratch. That was taking days too, and progressively slowing down, so I aborted that too. Eventually I just got a brand new node running in a faster computer and transplanted its blockchain into mine, so now I have the updated version running fine.

I was told that the reason it was taking so long for my computer to verify the blockchain was that it had a spinning disc which had to be queried continuously to verify all the ring signatures on the blockchain. That agrees with my experience of syncing the new node in just a few hours, as opposed to days in my old machine.

In any case, my question is: wouldn't it be possible and/or desirable to at least partially do away with that verification process? I mean, isn't that the whole point of using a hashed linked list as our blockchain in the first place, to produce an immutable record of what was already verified in the past? Couldn't we make it so that new nodes only verify (at least at a first moment) that the blocks and hashes that they receive match what the network has told them is the chain with the greatest work invested into it, and perhaps they only have to verify, say, the last month's worth of ring signatures?

Unless you had --fast-block-sync 0 as a command-line flag, it should've already been skipping both POW checks and ring signature checks. With the transaction rates we've had in much of the coin's history, checking POW actually takes longer than signatures.

You might also try bumping --db-sync-mode arg (=fast:async:1000) to something higher (10000?), and possibly switching to "fastest". --db-sync-mode fastest:async:10000 Note that there have been some corruptions on fastest (can happen if sync is interrupted).


How to Generate monero wallet on server-side(node.js) or locally? Already looking around for a few days, but can't find solution.
Found this awesome repo: https://github.com/moneromooo-monero/monero-wallet-generator/blob/master/monero-wallet-generator.html.

But it's not suitable for me, I can't separate JS functions from HTML, I need only JS code to generate monero wallets.

Just maybe same functions as above but only using JS?
Thank you!

Alright, solved generating monero wallets problem like that (using Meteor.js):

Downloaded this AWESOME repo: https://github.com/mymonero/mymonero-core-js

Unpacked this repo to the node_modules folder.

On client startup entered this code:

const walletUtils = require('mymonero-core-js/monero_utils/monero_wallet_utils')
const wallet = walletUtils.NewlyCreatedWallet('english', 0)
console.log('## Wallet address:', wallet.keys.public_addr)
console.log('## Mnemonic seed:', wallet.mnemonicString)

So I connected mymonero-core-js lib, and used their function " NewlyCreatedWallet " to create new wallet + mnemonic phrase ( second parametr is network, where 0 is mainNet, 1 is testNet and 2 is STAGENET ).

Everything is working, now I can generate monero wallets !


How to build and run xmr-stak-amd on linux CPU: FX-6300
GPU: RX 470 4GB Asus Strix

I am having a hard time running xmr-stak-amd on my xubuntu machine.  I run cmake and then make in the folder, but it appears to be no way to run the miner itself?  Any help would be appreciated.  It feels as though I am missing something very obvious even though I've read several guides on the subject.  I'll answer any questions in order to clarify.

Please check if there is a folder called "bin" in the same folder that your compiled the miner. If there is, cd to it and see if the binary is there.


Can a CryptoNote coin be merge mined with a non-CryptoNote coin? If the CryptoNight algorithm was replaced with say, SHA-256, could it be merge mined with bitcoin, for example?

The prior merge mining question is about mining with other CryptoNote networks.

If the cryptonight algorithm was replaced with say, sha256, could it be merge mined with bitcoin, for example?

That would certainly be possible. The requirements for merged mining basically boil down to (i) having the same PoW algorithm and (ii) miners of both chains agreeing to merge mine.

More information about the specifics of merged mining can be found here.


Who Generates parameters G & H for Pedersen commitment in Monero? Who (which party) generates parameters G & H for Pedersen commitment in Monero? I mean for a confidential transaction in Monero, pedersen commitment is required which has parameters G & H which are group elements. I am not sure who generates it? Is trusted setup assumed?

G is a universally agreed-upon base point. Almost everyone that uses ed25519, including Monero, uses the same G.

H is an agreed-upon base point within Monero's implementation of the Pedersen commitment scheme. It is chosen arbitrarily such that it is impossible to know the discrete log with respect to G (i.e. there is some x such that xG == H, but x will never be known).

The security of Pedersen commitments relies on x being unknowable.

Bottom line: All Monero wallets and daemons use the same values of G and H.


monero-wallet-cli Wallet asks for password on Ubuntu but not Windows When running ./monero-wallet-cli it asks for a password on Ubuntu 16.04 LTS but not when running on Windows Pro 10 where a password is not asked for.

Why is this?

Because the MSYS console is buggy and reports that the console is not a TTY. leading Monero to think it must read from a file (and thus not prompt). Apparently it works on a non MSYS console.

See https://github.com/monero-project/monero/issues/3951 for details.


Are there any trade-offs to daughter chains? There has been some talk of Monero daughter chains to scale up and make payments faster or nearly(?) instantaneous.

Would these daughter chains be less secure in any way: do they trade less confirmations for faster transactions? Would they be more susceptible to a 51% attack? Or are they simply faster because of their limited size?

From my understanding, daughter chains are not as secure. They do not have the same mining strength that the normal blockchain has with its PoW system.

Daughter chains can be helpful for rapid/instant transactions, where I have good faith the network will not be hacked for someone to steal my $2.


Generating private keys So I've been playing around with a Rust Monero library and I wrote this piece of code.
fn main() {
    let msg = "inwardly jester boss puzzled medicate iris terminal problems epoxy atrium newt dummy aided bovine navy flying dozen lunar hiker enlist sovereign tucks velvet wonders aided";
    let s = curve25519_dalek::scalar::Scalar::hash_from_bytes::<sha2::Sha512>(msg.as_bytes());
    let private_key = monero::util::key::PrivateKey::from_scalar(s);
    let public_key = monero::util::key::PublicKey::from_private_key(&private_key);
    let kp = monero::util::key::KeyPair{view: private_key, spend: private_key};
    let address = monero::Address::from_keypair(monero::Network::Stagenet, &kp);
   println!("wallet: {}, priv key: {}", address, private_key);
}

I'm pretty sure I'm doing something wrong. Also how can one wallet have 2 private keys with 1 mnemonic. I don't understand that.

Also how can one wallet have 2 private keys with 1 mneomonic

Monero uses two key pairs, view and spend. So there is a private view key, a public view key, a private spend key and a public spend key. When restoring from a seed (which is a recovery key), the private view and spend keys are then derived from the recovery key.

let kp = monero::util::key::KeyPair{view: private_key, spend: private_key};

Your code is incorrect as it is trying to set both view and spend the private keys to the same value. They should be different.


As of August 2017, how much monero has been mined out of the total supply? As of today 2017-08, how much monero has been mined out of the total supply? Is there a website where you can check this?

Actually just https://moneroblocks.info/ shows "Emission" in top right corner, so looks like it is about 14.9M


How do I gracefully stop the monerod daemon process? I started monerod as a background daemon with the --detach flag.

Suppose I want to restart my computer, how do I gracefully stop the process?

Can I just kill it?

Thanks in advance.

Run monerod exit. You can also just kill the process but you might lose the last batch of blocks that way.


I have repaid XMR to OKEX trading platform for 3 months. I haven't arrived. Please help me I recharged the XMR from www.OKEX.com trading platform for three months, and it hasn't arrived. Please help me, I'm in a hurry.

Transaction ID:eb150abb70c82a0770c0fa184e31887272b820b5c0843e83189150427c68d513

2018-06-16 19:03:56

Below is a reply from OKEX's customer service staff:

Hello, I'm sorry to have kept you waiting for a long time. It's still an XMR official purse problem. We're actively solving your problem. We'll let you know immediately after the processing is completed that your coin will not be lost. Please rest assured.

Hello, I'm sorry to have kept you waiting for a long time. We're still solving your problem because of the official purse problem of XMR. We're communicating with the government to solve the problem. It's inconvenient for you. Please understand. We'll let you know the result as soon as possible.

I cannot see how anyone on StackExchange can help you. You sent XMR to an exchange and that exchange is not crediting your exchange account. Only the exchange can help (if it's not a scam at least). If they are legit, they would either credit your account or refund you the money.


Does anyone have test data that illustrates the CryptoNight 7 algorithm? With the new CryptoNight 7 algorithm Monero introduced back in April, does anyone have an example of a data blob and a nonce that successfully hashes the block?  I'm trying to figure out how to test their algorithm and I'd like some valid data to verify that the algorithm I'm using is correct.

This is basically a rehash of this quesiton -- Where can I find some test inputs and outputs for the CryptoNight (Monero PoW) hash algorithm?, except I'm looking for CryptoNight 7 instead of just CryptoNight.

One simple way is to call the daemon RPC's method getblock. From this you can get the result.blob (the data to be hashed) and from the result.block_header.hash, the expected hash result.


Can the expected reward from the block template differ from a actual one after mining? As we know, we can find a value expected_reward in a response of a request getblocktemplate to a monerod.

Following the documentation:

expected_reward - unsigned int; Coinbase reward expected to be received if block is successfully mined.

I have a couple of questions here:

Can be the expected_reward value of potentially new block can be
differ to a actual block reward after it was mined and confirmed?
How is a expected_reward value obtained? Did I understand correctly that the answer to this question is written here and here?

1) So long as you don't edit the block template returned (i.e. you don't add a load more data or change the transactions included), expected_reward is what you would receive if you mined a block based on that template.

If you added or removed transactions, the fees collected would obviously change. If you changed the overall size of the block (added more data to extra for example), the reward calculation could be affected (e.g. the penalty fee could kick-in).

2) The links you referenced are both outdated (2017). Please see this answer, which references newer information.


Setting up script to decode and check transactions I had 2 quick ques. I'm trying to use the monero PHP library to decrypt a transaction pulled from a block explorer so that I can avoid sending my private view key to 3rd parties.

(We'd add a box for the user to submit their own transaction IDs after paying, and store admins can load txids from their own RPC wallets every 2 days or so since our script won't be checking every new transaction. But this way we wouldn't have to set up an RPC client on public facing servers.) We'd only be pulling encrypted transactions from 3rd parties, and ideally (optionally) we'd like to have some way of knowing, in addition to the transaction being ours and the amount, being able to validate the transaction signature and being able to validate its inclusion in a block. Setting up additional lservers to run all these RPCs properly added a lot of project complexity; A third party at worst would only have the list of addresses we checked but wouldn't know whether we were able to decrypt it.

use MoneroIntegrations\MoneroPhp\Cryptonote;

use MoneroIntegrations\MoneroPhp\ed25519;

require_once('Cryptonote.php');

require_once('ed25519.php');

require_once('SHA3.php');

require_once('base58.php');

require_once('Varint.php');

$cn = new Cryptonote();

$tx = json_decode(file_get_contents('https://moneroblocks.info/api/get_transaction_data/insert txid here'), true);

$extra = implode(array_map(function($x){ return str_pad(dechex($x), 2, '0', STR_PAD_LEFT); }, $tx['transaction_data']['extra']));

$derived = $cn->gen_key_derivation($cn->txpub_from_extra($extra), 'insert private view key here');

if( $cn->derive_public_key($derived, 'transaction ioutput index', 'insert public spend key here') == $tx['transaction_data']['vout'][0]['target']['key']){

`$sec1 = $cn->derivation_to_scalar($derived, 'transaction ioutput index');`

`$sec2 = $cn->hash_to_scalar($sec1);`

`$ec = new ed25519();`

`echo bcsub($ec->decodeint(hex2bin($tx['transaction_data']['rct_signatures']['ecdhInfo'][0]['mask'])),  $ec->decodeint(hex2bin($sec1)));`

`echo bcsub($ec->decodeint(hex2bin($tx['transaction_data']['rct_signatures']['ecdhInfo'][0]['amount'])),  $ec->decodeint(hex2bin($sec2)));`

}

This sample code given a public spend key/private view key/transaction ID, checks whether any output belongs to us.

1- How are subaddresses handled? From this code so far my best guess is just looping through the public spend keys of all subaddresses but I assume that isn't correct.

2- How do I decode amounts? It seems like there's a few variations of it, I'd want to support both the 64 character long mask/amount as well as the 16 character long amount; most examples I've seen seem to be incomplete or missing portions of the code.

3- Is there a good way to sanity check the received transactions? (so we limit the 3rd party API to only possibly omitting transactions, but make sure they aren't able to send fake transactions). In Bitcoin both of these checks are easy to implement using the merkle hash system, and EC signatures likewise easy to validate.

4- Is there a proper anonymous light wallet API I could use to just query for the encrypted tx info from the network? similar to  the Electrum rpc API for Bitcoin.

To answer your specific questions:

The example code you posted is not handling subaddresses. It is not even correctly parsing tx_extra.
xor8(e, keccak("amount"||Hs(8aR||i)) where a is the private view key, R is the tx public key, i is the output index, Hs is hash to scalar and xor8 will XOR the first 8 bytes of each parameter.
I'm unsure what you would want to "sanity" check. If a transaction is on the blockchain, it is valid. Whether or not it's yours or pays the correct amount to you is a different matter.
https://github.com/mymonero

As @knaccc points out in his comment though, "It makes no sense to try and reimplement wallet functionality yourself". You really should just run the monero-wallet-rpc if you need to programmatically check/make transactions - that is precisely what it is built for, it is part of the official releases and therefore will always stay current and work.


Is "Two-phase Proof of Work" suitable for Monero? The "Two-phase Proof of Work" is an evolution of Bitcoin proposed by Emin Gün Sirer to mitigate the risk of very large pools getting too much control on Monero.

  A two-phase PoW consists of a block that has two separate
  cryptopuzzles in it. Under a two-phase PoW:

  The double hash of the header (SHA256(SHA256(header))) is smaller than a difficulty parameter X, and
  The header is signed with the coinbase transaction's private key, and the hash (SHA256(SIG(header, privkey))) of that signature is
  smaller than a second difficulty parameter Y.

  The first phase (i.e. point 1 above) is identical to the existing
  Bitcoin cryptopuzzle. Our solution retains that mechanism in its
  entirety. The existing mining rigs are all geared to solve the first
  puzzle, which they can do very efficiently. X is the value of the
  current variable known as "difficulty" in the Bitcoin software. So we
  change absolutely nothing that already exists.

  The twist here is that we introduce a second cryptopuzzle. In effect,
  phase 1 requires our miners to do the work that miners have always
  been doing. But then, when they think they have a viable solution, we
  now ask them to sign the block with the private key that controls the
  payment address, and see if the result, when hashed, is below a second
  difficulty parameter Y.

  This mechanism allows miners to use existing rigs, albeit with a lower
  difficulty value (X) than the difficulty value currently in effect.
  This would enable miners to produce a lot more potential solutions;
  that is, headers that pass phase 1, which we call half-solutions. For
  each such half-solution, miners use a second device, perhaps a CPU or
  a specialized card, to perform the second check until a full solution
  is found.

Is there any technical issue preventing the implementation of a similar mechanism while keeping privacy properties of Monero?

The question to ask isn't 'Can this be done?' but rather 'Is this something we can benefit from?'.

Since you did ask explicitly if it was possible, I'll address that first:

Yes, it's absolutely possible for Monero to adopt this proposed PoW algorithm.  The PoW algorithm is orthogonal to the issue of privacy, as long as the PoW algorithm chosen isn't one which encourages extreme centralization.

Now, as to the second part.  Is this something we would benefit from?

Absolutely not.  The PoW suggested here aims to solve the problem of miner centralization in the bitcoin ecosystem, by reducing the gap between ASICs and other devices.  It tries to do this without screwing those who have invested in ASICs over completely, and represents a compromise which might be more palatable than just switching PoW in a manner that makes all ASICs obsolete.

By switching to this 'compromise algorithm', which benefits 50% from ASICs, we'd require anyone wanting to mine Monero profitably to invest in ASICs.  That would greatly hurt our network security (because everyone has a general purpose computer to mine with, but almost nobody is going to buy an ASIC just for the purpose of mining).

We're already seeing a ton of unprofitable mining, by botnets and enthusiasts, and we'd lose that 'free' security by switching to an algorithm requiring special hardware.  This point will be even more important when smart mining (background mining when computer is idle) is implemented into the daemon and GUI.


How can I add my business to the merchant list on the Monero website? Is there an easy way to make a listing request?

If I am familiar with GitHub, how should I go about doing it myself?

Easy method:

Visit the merchant page
Use the open issue link at bottom of page
Login to and/or create a GitHub account
Click new
Enter your merchant information
Click submit new issue
Track your request here

Do it yourself method:

Visit the GitHub for the monero website
Login to GitHub
Make a fork of the site
Click data
Click merchants.yml
Click edit
Add your merchant information in a format consistent with the existing listings
Click create a new branch for this commit and start a pull request
Click propose file change
track your pull request


Why must each input have a separate set of decoys? If we have a mixin of 6, with two inputs.

We immediately have a total of 6 * 2 = 12 decoys

Would it not be secure enough to have the 4 decoys with the two inputs which means two key images? So we have a ring size of 6 in total?

Mixin 6 means a ring size of 7.

Having 2 real inputs and 5 decoys for an overall ring size of 7 is a lower level of privacy than the current implementation, which would be 2 real inputs and 12 decoys as part of two rings of size 7.

It would be worse if you were spending 6 inputs. You'd have only 1 decoy, so your privacy level would drop enormously.

Providing a consistent level of privacy no matter how many inputs are being spent is therefore an important design goal.


Add an address to the wallet CLI with a payment ID I've tried to add an address to the address book with

address_book add xxx yyy recipient

where xxx is the address, yyy the payment ID and recipient is a description for that address but the wallet ignores the payment ID and use yyy recipient as a description.

How can I add an address with a payment ID and a description to the address book?

The syntax is (see the emphasis):

address_book [(add (<address> [pid <long or short payment id>])|<integrated address> [<description possibly with whitespaces>])|(delete <index>)]
                               ^^^

So you need to identify the payment id with pid - in your case it would look like:

address_book xxx pid yyy recipient


Does the receiver need to be online in order to complete a transaction? By reading Crypto-Note paper, I see that there is a diffie-helman key exchange.

To that end, does the receiver need to be online to complete that key-exchange?

Thanks.

Yes, there is a key exchange, which implies two-way communication.  But the first line of communication is the receiver providing their public address (public key, aka public spend-key plus public view-key).  The information going the other direction is the transaction itself.

The transaction output is encrypted by the sender using the recipient's address and broadcasted to the network, where it is recorded by miners.  When the receiver's wallet later scans the blockchain for outputs sent to it, the wallet's private view-key will decode the output on the blockchain, thus proving ownership of the output.

The receiver's wallet will only know it has a new output when it is online and scans the chain, so in that sense the answer to your question is yes.  But the receiver does not need to be online contemporaneously with the sender because the blockchain keeps that record for whenever the receiver does get online.


Can I copy my pruned blockchain .bitmonero folder to another computer and start syncing? After pruning the monero blockchain, can I copy this pruned blockchain from the .bitmonero folder to another computer and just start syncing from there? What are some disadvantages of pruning the blockchain or where one might want the entire 71GB blockchain?

After pruning the monero blockchain, can I copy this pruned blockchain from the .bitmonero folder to another computer and just start syncing from there?

Yes.

  What are some disadvantages of pruning the blockchain...

This is a good question. Let's first take a step back and understand what happens with pruning. When your domain is fetching and validating blocks, after it's done, it can prune various data it is unlikely to need again. For example, once we have validated a txs signatures, we can discard them. To keep our node useful to the rest of the network, we maintain sections/slices of our blockchain unpruned. Therefore, if everyone has a pruned node, a new participant can still download and validate the whole blockchain - they'll just be grabbing separate sections (unpruned sections) of the blockchain from different peers.

I suppose the main disadvantage is less redundancy. Imagine someone in a rural location, poor internet connection etc. They ideally sync their whole blockchain from the nearest fastest full node, but, if the nearest/fasted peer is pruned, they are then reliant on using more distant, thus slower, peers.

  ...or where one might want the entire 71GB blockchain?

If disk space is not a concern, there is simply no need to prune. ~70GB is
certainly not huge by todays standards - a lot of mobile phones have
this space available even.
If you want to optimally help the rest of the network by providing the maximum  redundancy, as detailed above.

I'm sure there are other reasons too, but those sprung to mind first.


How can I rename the wallet? Taken from /r/MoneroSupport:

How can I rename my Monero wallet in the GUI or CLI?

Can I just rename the wallet file, the *.address.txt file, and *.keys file?

Renaming the files is just fine. The wallet files have no idea what they're called, so no conflicts will happen. The FOO.address.txt file can be deleted, it's just information for the user, and is not used after creation. Just make sure the files aren't being used (ie a wallet program running) while you rename or the files will be saved again with the old name when the wallet program exits.


Sending a Monero tip that if unclaimed reverts back to the donor Is there a way to send a Monero tip that if unclaimed reverts back to the donor?

"Unclaimed" could be defined as some sort of multi-sig transaction where the tip recipients fails to send to XMR to another address under their control within a certain period.

The goal would be to tip those who take the time to learn enough to use Monero and reclaim tips from those that do not.

What happens to tips sent with Tippero that are never moved by the recipient?

At the moment there is no multisig, and there is no way to time limit Tippero tips. I'm not exactly sure what happens to Tippero tips that are never moved by the recipient, but I'd imagine at this point (only a year or 18 months after launch) they're just sitting there as entries in the redis database. Maybe eventually moneromooo or fluffypony will sweep out accounts that haven't been active in x years to the dev donation address or something, but as far as I know no decision has been made in that regard.


Understanding block reward calculation I've read this explanation of how block rewards are calculated. But I fail to apply it in practice. Let's take block #1233057 as an example:

The base reward is 8.8005 (which matches the result of the formula given in the explanation).

The block size is less that the effective median size of 60kB, so the base reward should be paid in full.

There is a transaction fee of 0.036.

So I would expect the actual reward to be 8.8005 + 0.036 = 8.8365, but it shows as 8.9017.

How is the final reward of 8.9017 calculated for that block?

chainradar doesn't show RingCT transaction fees (they are explicitly defined rather than sum(inputs) - sum(outputs), and they clearly haven't added support for that). Try http://moneroblocks.info/search/1233057


In Monero GUI Beta 2, is rewarding the solo miner automatic? I installed Monero GUI Beta 2, downloaded the blockchain and started to solo-mine. If the program finds a block and I'm rewarded, is this reward process automatic or should I do something to get my reward?

Thank you in advance...

If you start solo mining, any block reward you find will appear in your wallet automatically, without any further action needed on your part. As a reminder, if you exit the daemon, you will have to start mining again, as the GUI merely instructs the dameon to mine.

Note that the likelihood of finding a block solo mining on an average computer is pretty small: currently, assuming 200 hashes a second, you can expect a block every... 1/(720 * 200 / 220e6), that is about 1500 days. However, if you do find a block, then you get 6.9*130 = $900 at current prices. So it's a lottery in exchange for helping the Monero network.

Good luck!


GUI MMS - a graphical monero multisig app We all know Monero Multisig is still a work in progress and most online guides are quite tricky to follow for the average user. A relatively promising project is the Multisig Messaging System (MMS) leveraging PyBitmessage to create a secure communication channel across multiple signers.
However, while turning out to be an excellent tool, it is quite unused as it doesn't solve the main issue, usability.
Would it be possible to perform all the process automatically?
Imagine a GUI app where the user clicks a button to create a wallet, exchanges the addresses with other signers, pastes inputs in the GUI app and then the rest is done in background.
MMS isn't accessible from Monero RPC so I guess the GUI app would need to integrate the static wallet library somehow and talk to PyBitmessage.

Would it be possible to perform all the process automatically?

Not completely automatic no. Any UI would still need to prompt for user confirmations for example.

Imagine a GUI app where ... and then the rest is done in background. MMS isn't accessible from Monero RPC so I guess the GUI app would need to integrate the static wallet library somehow and talk to PyBitmessage.

MMS is supported in the wallet RPC so anyone wanting to create a more user friendly experience could absolutely make use of the wallet RPC to do so. The Monero GUI uses the wallet library, so can use the MMS functions directly.
I suspect the main reason it's not exposed in the GUI is simply to do with the dependance on PyBitmessage. Whatever the reason, as far as I'm aware there's no technical roadblock preventing it being added, rather it just requires someone to care enough about MMS in the GUI to add it there.


RPC binary request with Python I am currently working with the Monero daemon RPC and have a little problem understanding the format of the binary request (/get_o_indexes.bin for example).

Does anyone have an example of how should I generate my binary request with Python's requests library?

To call the binary methods, you have to send raw binary data as an application/octet-stream in the request body and read the binary data sent back in the response body.

There's a StackOverflow answer that shows making binary requests using Python here. Quoting the requests library example:

import requests

data = 'test data'
res = requests.post(url='http://localhost:8888',
                data=data,
                headers={'Content-Type': 'application/octet-stream'})

Here you would replace data with the binary tx id (which is 32 bytes), wrapped as a Levin packet. A brief overview can be found here.

For working out how to serialize the request data and deserialize the returned response data, you should start by looking in this folder.

Here is an annotated response for the interested:

0111010101010201        signature
01                      version
0c                      section
09 6f5f696e6465786573   field: string length then data: o_indexes
85                      type (uint64 | array flag)
08                      length 2 (0x08 >> 2)
aca87f0000000000        idx
ada87f0000000000        idx
06 737461747573         field: string length then data: status
0a                      type (string)
08                      length 2 (0x08 >> 2)
4f4b                    OK
09 756e74727573746564   field: string length then data: untrusted
0b                      type (bool)
00                      false

Here is a quick and dirty example of calling then parsing the response using Python.


What is known about Nicolas van Saberhagen? What if anything is conclusively known about Nicolas van Saberhagen?

Are there any educated guesses about who this person or group may be (similar to how there are guesses about the identity of Satoshi Nakamoto) based on available clues? For example is it likely that this person or group is an academic or cryptographer based solely on the level of knowledge required to draft the CryptoNote white paper?

Reasonably, we have no real idea. This person or group is currently unknown just like Satoshi Nakamoto. The text in this Wikipedia article sums up some thoughts in the community about the creator(s) of CryptoNote:

  The author of the white paper went by the name Nicolas van Saberhagen,
  although like Satoshi Nakamoto (the author of the bitcoin white paper)
  that name is likely a pseudonym. Saberhagen's true identity and
  location remains unknown. Some have claimed that the real creator is
  someone in the bitcoin community. Adam Back, Nick Szabo and even
  Satoshi Nakamoto himself have been floated as possible
  suspects, but there is little to no evidence actually supporting
  those claims.

  Stanford Bitcoin Group’s possible involvement in creation of the
  CryptoNote protocol has also been discussed. Prior to CryptoNote
  cryptocurrency protocol, the domain cryptonote.org hosted an encrypted
  message application also named CryptoNote. This application was
  developed by the members of the Stanford Bitcoin Group but had not
  received wide recognition. This website currently hosts the CryptoNote
  technology.

Further reading:

http://web.archive.org/web/20141205173019/http://thebitcoinnews.com/2014/11/24/bytecoin-satoshis-new-project/

http://bytecoiner.org/bytecoin-source-of-origin/

https://medium.com/@AckermanRonald/stanford-wide-gate-steep-steps-ad95cfccca21


How are subaddresses and account addresses generated from master wallet keys? I guess we have something similar to Bitocin HD wallet structure but the resources I found (https://monerodocs.org/public-address/subaddress/ and discussion in https://github.com/monero-project/research-lab/issues/7) seem to describe only a basic sub-address generation.

How is the account/subaddress structure built? For example, how can I compute subaddress Sa(a,i) where a is the account index and i is the subaddress index within the account?

how can I compute subaddress Sa(a,i) where a is the account index and
  i is the subaddress index within the account?

You're right, it is not fully explained in either of those links.

Take a look at get_subaddress_spend_public_keys and get_subaddress_secret_key in the source code.

You'll see in the code that subaddress_index is a struct containing "major" and "minor", where major means the account index and minor means the subaddress index within that account. You'll also see the in second link that the string "SubAddr" is added into the mix.

Bringing it all together:

m = Hs("SubAddr" || a || account_index || subaddress_index_within_account)

Where a is a 32 byte scalar (the private view key), and account_index and subaddress_index_within_account are both 32 bit little endian unsigned integers.

Note that "SubAddr" needs to be a null terminated string, i.e. will be 8 bytes and not 7.

Finally, to get the wallet address for a subaddress, you need to follow the usual base58 procedure (which involves adding an identifier for the type of wallet address and adding a checksum) on the public view and spend keys (C, D), calculated as:

D = B + m*G
C = a*D

Also note that there is a special case, where the first subaddress of the first account is not calculated using the formula above, and instead is simply the ordinary main wallet address (A, B).

Edit: See an example Javascript implementation of a subaddress generator here: https://github.com/knaccc/subaddress-js


What are the reasons for running a full node on a VPS? How can I do this? I've seen some people say they run full nodes on a VPS. What are the reasons for doing this and how might I do it too?

What are the reasons for doing this

First, a full node hosted on a VPS ensures high uptime. If you run a node on a personal computer, you will likely only run it partially, because you turn your computer off from time to time. Higher uptime is better for the network. However, ideally, such a node would run off a personal computer instead of a VPS. There's always an aspect of centralization with respect to VPS providers which people have to keep in mind when making such a decision.

Additionally, people might find it more convenient to run their node on a VPS.

  and how might I do it too?

There's a guide on the official website:

  monerod

  monerod is the daemon software that ships with the Monero tree. It is a console program, and manages the blockchain. While a bitcoin wallet manages both an account and the blockchain, Monero separates these: monerod handles the blockchain, and simplewallet handles the account.

  This guide assumes you have already set up your VPS account and are using SSH to tunnel into the server console.

  Linux, 64-bit (Ubuntu 14.04)

  Make sure that port 18080 is open

  monerod uses this port to communicate with other nodes on the Monero network.

  Example if using ufw: sudo ufw allow 18080

  Example if using iptables: sudo iptables -A INPUT -p tcp --dport 18080 -j ACCEPT

  Download the current Monero Core binaries

  wget https://downloads.getmonero.org/linux64

  Make a directory and extract the files.

  mkdir monero
     tar -xjvf linux64 -C monero

  Launch the daemon

  cd monero
     ./monerod

  Options:

  Show list of all options and settings:

  ./monerod --help

  Launch the daemon as a background process:

  ./monerod --detach

  Monitor the output of monerod if running as daemon:

  tail -f ~/.bitmonero/bitmonero.log


Selfish Mine paper mistaken? Reading the paper on so-called 'Selfish Mining' http://fc14.ifca.ai/papers/fc14_submission_82.pdf

On page 12 Figure 2 relative pool revenue equals 1 at 50% of hash power 'selfishly' mining. The authors are saying you only need 50% of hash power to obtain 100% of fee revenue.. Am I missing something or is this just an obvious red flag for the analysis? Referencing their state machine on page 8 Figure 1, every time the private pool publishes their branch there should be a 50% chance of public miners finding the next block. Are they saying there would be a near-perma fork, with the private pool never actually publishing, leaving all revenues in limbo (ie never been resolved to a main branch)?

A 51% attack allows the attacker to effectively censor the blocks of any other mining participants, as even if they do mine blocks, the attacker can outrun the competing chain.


Running a Monero node from a home PC with Broadband unlimited download over TOR. Doable? I want to run a Monero node from home.

My PC details:

Processor Intel (R) Pentium (R) CPU N3700 @1.60GHz
  1.60GHz
RAM -  4 GB 64 bit operating system x64 based processor
Total space 465 GB, Out of this used space is 288GB and Free space is
177GB

Right now I just want to familiarise myself with Monero by setting up the node and sorting out a wallet but in future I may setup a website which accepts Monero payments.  I have no interest in using my node for mining. I will only use it for conducting my own Monero transactions.

At the moment, I use my PC mainly for emails, websurfing, watching movies sometimes on youtube, or for using the Microsoft Office Suite (Word, Excel..etc). Security wise, I use Malwarebytes sometimes. I'm a careful user. I use TOR browser sometimes. As of today, there is free space of 177GB on my PC. I don’t have another PC just a laptop I use when travelling so want to keep it for that.

My questions:*

Can I run my node at home whilst using my PC as I do already?
Can I set up using TOR? And always use it through TOR?
If I cannot use TOR, then after I am running a node, are outsiders able to connect to it? If yes, what is the risk here for my PC? I mean does my IP show or what?
Can I prevent others from connecting to my node?
What will be the best hardware wallet to use with my node?

Thank you in advance for any help.

Yes. Given your computer spec/storage-space, you will probably want to run it as a pruned node though.
Yes. Instructions.
Regardless of Tor usage or not, you decide if others can connect to your node. Tor is not a firewall.
Yes. You can start the daemon with flags --no-igd --hide-my-port --in-peers 0 (these can also be applied in the GUI via daemon startup flags in the settings).
"best" is subjective and not really a suitable question for StackExchange. You can use either a Trezor or Ledger.