11

In monero, there are three types of RingCT transactions:

enum {
  RCTTypeNull = 0,
  RCTTypeFull = 1,
  RCTTypeSimple = 2,
};

They can be observed in https://xmrchain.net/

But it's not clear what differences there are among the three types, and why there are three types at all. Why not only one type?

kenshi84
  • 2,475
  • 1
  • 13
  • 31
QuriousAboutRingCT
  • 111
  • 2

1 Answers1

10
  • Null is used for coinbase transactions. There are no inputs to sign, so no signatures can be provided. If a miner uses this mode (as opposed to tx.version == 1) then the coinbase output can be used as a dummy input in any rct transaction (AFAIK, primarily due to how it is stored in a database).
  • Simple is currently used when a transaction has multiple inputs. There is a LSAG signature for each input. Each LSAG is smaller in size than a tx.version == 1 signature, so there is still some space savings over the original signature method.
  • Full is used when the transaction has a single input. The MRL-005 discusses this mode in the MLSAG section - it is a signature over all inputs. This allows for more space savings over Simple mode when there are multiple inputs. However, Full mode requires that all "real" inputs be at the same offset within the ring, and therefore has not been enabled primarily due to privacy concerns (along with one subtle implementation detail).

Edit - Some clarification:

  • Full mode is used, but only when a transaction has 1 input.
  • Simple mode is actually a collection of MLSAG signatures, each of which links the commitment to zero with the key image / previous output address.
Lee Clagett
  • 906
  • 6
  • 10
  • 1
    As a slight update, MLSAGs were replaced with Borromean signatures recently. – user36303 Jan 14 '17 at 21:37
  • 2
    Borromean signatures are used for the range proofs, which is separate from verifying the signatures to prior transaction outputs. – Lee Clagett Jan 14 '17 at 21:43
  • 1
    I've posted to MRL repo about my understanding of how Simple works, and I'm confused here why Full is still used in the case of only one input; wouldn't both Simple and Full be practically the same?

    Another side question (maybe I should make a separate SE post): is Borromean only used for the rangeproof but not for the input rings? It seems to be able to reduce the signature size by a few tens of bytes.

     – kenshi84 Jan 15 '17 at 02:10
  • 1
    The "one signature for all" scheme is a tad smaller, so gets used for one input, where it doesn't have a drawback. – user36303 Jan 15 '17 at 11:42
  • 1
    And to answer the other question - Borromean is only used for the range proof. MLSAG is used for the inputs / commitments. That mode ensures that the commitment to zero is at the same index in the ring as the signature for the input, without revealing the ring position. – Lee Clagett Jan 15 '17 at 15:36