Same Tools, Different Trade-offs
Bitcoin, Ethereum, Zcash and Monero side by side: the shared foundation, the Zcash-vs-Monero assumption trade-off, why mandatory privacy matters, and the FCMP++ roadmap.
#cryptography
19 lessons with this tag.
Monero's Math II: Hiding Amounts
Pedersen commitments C = xG + aH, the homomorphic balance check, the overflow loophole, and how Bulletproofs+ prove amounts in range with no trusted setup.
Monero's Math I: Hiding Sender & Receiver
Stealth addresses via ECDH (P = Hs(rA)G + B), ring signatures that hide which key signed, and key images I = x·Hp(P) that stop double-spends without naming the output.
Where the Math Diverges: Transparent vs Private
What a transparent transaction reveals, why pseudonymity isn't privacy, the three things a private chain must hide, and the two schools that solve it.
Digital Signatures: ECDSA, Schnorr & EdDSA
How all blockchain signatures descend from Schnorr, why ECDSA names the spender, and how Monero generalizes one signature into a privacy-preserving ring.
Elliptic Curves: One Idea, Different Curves
Why Bitcoin and Ethereum use secp256k1, Monero uses Ed25519, and Zcash adds pairing curves — and how the curve choice follows from each chain's goals.
Hash Functions: The Common Workhorse
SHA-256 vs Keccak across Bitcoin, Ethereum and Monero, the hash-to-scalar and hash-to-point maps Monero adds, and how hashing becomes commitment.
The Shared Math Under Every Blockchain
The four ideas every cryptocurrency is built from — finite fields, groups and the discrete-log problem, one-way hashes, and signatures — and why Monero invents almost no new math.
The Roadmap: Seraphis, Jamtis & FCMP++
Where the protocol is heading: full-chain membership proofs via curve trees that replace ring signatures, the Seraphis transaction protocol, and the Jamtis addressing scheme.
Multisig, the Janus Attack & the Burning Bug
M-of-N key aggregation and its rounds, plus two subtle failure modes every contributor must know — the Janus subaddress-linking attack and the burning bug — and their mitigations.
Bulletproofs+: The Weighted Inner-Product Argument
Generators, the Fiat-Shamir transcript, the weighted inner-product that shrinks the proof, batch verification, and the transaction-weight clawback.
CLSAG: Exact Construction & Domain Separation
The aggregation coefficients, the domain-separated challenge hashes, and how one ring proves both key ownership and commitment opening — with the round-robin written out.
Decoy Selection & the Output Distribution
Why decoys must mimic the real spend-age distribution (a gamma fit), how the selection algorithm works, and the deanonymization that a naive selector causes.
Cofactor 8 & Point Validation
Ed25519 has cofactor 8, so points can carry a torsion component. Why key images must be checked for the prime-order subgroup, the hash-to-point map, and the bugs that ignoring this caused.
Anatomy of a Monero Transaction
A byte-level tour: inputs with key images, outputs with one-time keys and view tags, ecdhInfo, the range proof, tx_extra, fees and the balance proof.
RingCT, Pedersen Commitments & Bulletproofs+
Hiding amounts with commitments C = aH + xG, the balance equation, and how Bulletproofs+ prove a value is in range without revealing it.
CLSAG Ring Signatures & Key Images
How Monero proves you own one ring member without revealing which — LSAG → MLSAG → CLSAG — and how the key image I = x·Hp(P) stops double spends.
Stealth Addresses: The Math
One-time output keys via ECDH: R = rG, P = Hs(rA)G + B, how the receiver recovers the one-time private key, subaddresses, and view tags.
The Curve: Ed25519 & Monero's Keys
The twisted-Edwards group Monero is built on, scalars mod ℓ, points, and how spend/view keypairs and addresses are actually derived.