Advanced

Monero Internals Quiz (Expert)

No hand-holding. Test whether you truly understand Monero's cryptography and protocol internals.

Covers material from Monero Internals: Cryptography & Protocol Deep Dive.

Create a free account or log in to save your quiz scores and track your progress.

On Ed25519, what is a Monero private key and what operation produces the matching public key?

A 256-bit seed; the public key is its Keccak-256 digest A field element mod the prime p; the public key is its modular inverse times G A scalar mod ℓ; the public key is scalar·G (scalar multiplication) A curve point of order ℓ; the public key is its compressed y-coordinate

For a standard (non-subaddress) output, how is the one-time output public key P built?

P = r·B + Hs(A)·G, with A published as R P = Hs(a·R)·G + B, computed by the sender from the view key a P = Hs(r·B)·G + A, deriving the offset from the spend key P = Hs(r·A)·G + B, with R = rG published in the tx

What exactly is a key image, and what property makes it stop double-spends?

I = x·Hp(P) — unique per output, so a repeat image is rejected I = Hp(x·P) — the hash-to-point of the secret-scaled key I = x·Hp(R) — derived from the transaction public key R I = x·G — the output public key serving as its own image

In RingCT, an output amount is committed as C = aH + xG. What must hold for the transaction to be valid (ignoring fees)?

Every commitment C must be a multiple of the second generator H only The transaction fee must be hidden inside one of the output commitments Each output's blinding factor x must be the Keccak hash of its amount a Σ input commitments = Σ output commitments (+ fee·H)

What do Bulletproofs+ prove, and why are they needed?

That the signer knows the blinding factor of every commitment That each amount is an exact multiple of the atomic unit That each hidden amount is in range [0, 2^64), so no inflation That the sum of output amounts does not exceed the inputs

Why does a view tag speed up wallet scanning?

It caches the shared secret Hs(a·R) so it need not be recomputed It indexes the output into the subaddress lookup table It's a 1-byte hint that lets a wallet skip most outputs before the full check It is a truncated key image used to pre-filter spent outputs

What makes RandomX resistant to ASICs?

Random code execution in a VM PLUS memory-hardness (a ~2 GB dataset) — a CPU with fast RAM is near-optimal It rotates the hashing algorithm every block from a fixed set of seven It requires gigabytes of fast VRAM, favoring commodity GPUs over ASICs It chains AES rounds over a small scratchpad that fits in L1 cache

When sending to a subaddress whose public spend point is D, the sender publishes the transaction public key as R = rD rather than R = rG. Why is this necessary?

Because the subaddress point D must stay unlinkable, and publishing R = r*G would let observers recompute D Because subaddresses are defined over a different base point than G, so R must be built from D To make the transaction public key R itself encode the subaddress index n for the receiver So the recipient's view-key computation a*R reproduces the sender's shared secret a*R = r*(a*D); R = r*G would not match the offset spend key

In a current RingCT transaction the per-output ecdhInfo field is only 8 bytes. Why does it not also need to carry the 32-byte commitment blinding factor (the mask)?

Because the mask is derived deterministically from the shared secret, so both parties recompute it and only the masked amount need be stored Because the receiver reconstructs the mask from the aggregated Bulletproof+ range proof Because the blinding factor is fixed at zero for all current outputs Because the mask is published separately in outPk next to the commitment

Q10

Why does a RingCT transaction attach a fresh pseudo-output commitment to each input instead of using the input's original on-chain amount commitment directly in the balance equation?

Each input must be committed under a distinct second generator to prevent amount overflow, which the pseudo-out provides Pseudo-outs are smaller than full commitments, so substituting them reduces the transaction's weight The original commitment reveals the input amount in the clear, so the pseudo-out re-hides it before broadcast The original commitment's blinding factor was fixed by a prior transaction and cannot be chosen, so a pseudo-out commits to the same amount under a new controllable mask, letting the masks be arranged to balance while CLSAG proves the difference opens to zero

🎓 Graduate from Monero Academy

Create a free account, ace every quiz across all courses, and earn your place on the Graduates wall — with your own Monero address for donations. An account also tracks your progress through the courses, and graduating is the prize for finishing.

Create free account How it works