Advanced

The Math of Monero Quiz (Advanced)

Comparative cryptography across blockchains. Test whether you can tell shared math from per-chain choices, and explain exactly how Monero hides what transparent chains reveal.

Covers material from The Math of Monero: Cryptography Across Blockchains.

Create a free account or log in to save your quiz scores and track your progress.

What single mathematical assumption do Bitcoin, Ethereum and Monero all stake their key security on?

The elliptic-curve discrete-logarithm problem is hard Finding hash collisions on a 256-bit digest is hard Factoring the product of two large primes is hard Bilinear pairings on the curve are efficiently computable

Ethereum and Monero both hash with Keccak, yet integrators are warned they are not interchangeable with 'SHA-3'. Why?

Monero salts every Keccak call with the block height SHA-3 is a sponge while Keccak is Merkle–Damgård, giving different outputs Ethereum truncates Keccak to 160 bits while Monero keeps 256 They use the original Keccak padding, which differs from standardized SHA-3

Why does Monero use the twisted-Edwards curve Ed25519 instead of Bitcoin's secp256k1?

It is a pairing-friendly curve, which Monero's commitments require It has cofactor 1, eliminating the torsion issues secp256k1 suffers Its complete, constant-time addition law makes privacy primitives safer to implement It offers a larger field, so private keys carry more bits of security

On a transparent chain an ECDSA signature is checked against one named public key. What does Monero replace this with to hide the spender, and what new problem does that create?

A zk-SNARK over the whole transaction, which then needs a trusted setup A blinded ECDSA signature, which then needs the verifier to learn the blinding factor A multisignature across decoys, which then needs threshold key recovery A ring signature (hides which key signed), which then needs key images to stop double-spends

For a standard output the sender sets the one-time key P = Hs(r·A)·G + B and publishes R = r·G. How does the recipient recognize and later spend it?

Detect with the view key; spend using r, which the sender encrypts to the recipient Detect with the view key via a·R = r·A; spend with x = Hs(a·R) + b, needing b Detect with the spend key via b·R; spend with x = Hs(b·R) + a, needing a Detect by matching R against B directly; spend with x = r + b

A key image is I = x·Hp(P), using hash-to-point rather than a fixed multiple of G. Why is Hp(P) essential?

A known multiple of G would make I = c·P, linking the image to the output Hp(P) lets the verifier recover P from I to confirm ownership Using c·G would let two different outputs share one key image Hash-to-point makes the key image fit in 32 bytes; c·G would not

In RingCT an amount is committed as C = x·G + a·H, where H = Hp(G). Why must nobody know the discrete log of H with respect to G?

Otherwise the commitment could be opened to a different amount, breaking binding Otherwise the blinding factor x would leak through the view key Otherwise the amount a could be read directly off C, breaking hiding Otherwise commitments could no longer be added together homomorphically

Pedersen commitments already hide amounts and let nodes verify Σinputs = Σoutputs. Why are Bulletproofs+ range proofs still required?

To compress the commitments so the transaction stays small To prove the signer knows the blinding factor of each commitment To prove each hidden amount is in range [0, 2^64), preventing overflow/inflation To prove the input and output commitments use the same generator H

Zcash and Monero both hide sender, receiver and amount. What is the core assumption-and-trust trade-off between their approaches?

Zcash: no trusted setup but weaker hiding; Monero: trusted setup but mandatory privacy Zcash: discrete-log only; Monero: pairing assumptions plus a trusted ceremony Both rely on identical assumptions; they differ only in block time and supply Zcash: smaller proofs but trusted setup + pairing assumptions; Monero: bigger txs but only discrete-log and no trusted setup

Q10

Why does Monero making privacy MANDATORY for every transaction strengthen anonymity beyond what the per-transaction math alone provides?

Mandatory privacy lets the protocol use a smaller, faster ring without weakening it Every output becomes a plausible decoy, so the anonymity set is the whole user base It allows the network to discard spent outputs, shrinking the chain analysts can study It forces all amounts to be identical, removing amount-based fingerprints

🎓 Graduate from Monero Academy

Create a free account, ace every quiz across all courses, and earn your place on the Graduates wall — with your own Monero address for donations. An account also tracks your progress through the courses, and graduating is the prize for finishing.

Create free account How it works