1

If I understand correctly, MLSAG is being used only when we have two keys. Is it being used in other places when we have maybe three or more keys?

To clarify, by two keys I mean we are trying to prove ownership of the private key for two public keys (P1, CommmitmentToAmount).

I may be reading the code wrong; but it says MLSAG unless MLSAG is being used to mean 2-Key MLSAG and the general case of n-keys?

Edit to clarify:

"two keys" refers to the vector size being 2, however we can have N of these vectors due to things like decoys

WeCanBeFriends
  • 660
  • 3
  • 7

1 Answers1

2

Why do we have MLSAG when we only need two keys?

We have to sign over more than one set of keys - the private keys for the inputs (real and decoys) and the private keys to the corresponding commitments.

An MLSAG signature fulfills this need - a signature over a set of N key vectors, not simply two keys. It is used to prove the signer knows the secret keys to an entire key vector.

Section 2.2. in the original RingCT paper describes this:

The intent of the MLSAG ring signature is the following:

• To prove that one of then signers knows the secret keys to their entire key vector.

• To enforce that if the signer uses any one of their m signing keys in another MLSAG signature, then the two rings are linked, and the second such MLSAG signature (ordered by the Monero block chain) is discarded.

jtgrassie
  • 19,111
  • 4
  • 14
  • 51
  • I think my terminology is off, when I refer to two keys I mean the vector is of size two. In monero, we have the two tuple consisting of the public key to sign the input and the commitment to zero for that input. Overall, we have N Key vectors however. In monero I think we only ever use a key vector of size two and never a vector of key-size 3 or more for example. – WeCanBeFriends Jun 25 '19 at 19:44
  • Each input in a tx has an MLSAG signature. The signature has 2 vectors. One for the private keys (the real inputs private key and the decoys private keys) and one for the commitments (again, real and decoys). LSAG doesn't cater to this need - a signature over a set of N key vectors. LSAG only allows a signature over a single set. – jtgrassie Jun 25 '19 at 22:22