Ring Confidential Transactions

If every transaction on a public blockchain records who sent what to whom and for how much, then anyone with a copy of that ledger — and everyone has a copy — can trace your entire financial life. If you try to hide the destination, you still leave the amount exposed. If you hide the amount, the network can no longer verify that no coins were created from thin air. Walk that chain of constraints to its edge, and you hit a wall. Shen Noether found a way to close all three gaps at once. The problem starts with how Bitcoin works. Every transaction is signed by the owner of the coins being spent, and those signatures are what let the whole network agree on who owns what. That mechanism is also a surveillance surface — the same transparency that makes decentralized verification possible also makes your transaction history readable by anyone. CryptoNote, the protocol underlying early Monero, directly attacked two of the three privacy gaps. It used ring signatures to hide the sender: your public key is placed inside a ring of decoy keys, and an observer can see that someone in that ring signed, but not which member. One-time keys then hide the recipient, so addresses don't repeat in ways that link payments. However, amounts stayed visible. And there the problem stalled. The reason hiding amounts is hard isn't intuitive. It's not just about encryption. If you encrypt a transaction amount, the network can't check that you haven't spent more than you had or created coins from nothing. You need a way to prove a mathematical relationship — inputs equal outputs — without revealing either number. That's the tension Ring Confidential Transactions, by Noether and Adam Mackenzie, was built to resolve. Before getting to amounts, it's worth being precise about how the ring signature piece actually works, because Noether extends it significantly. The canonical scheme is LSAG, which stands for Linkable Spontaneous Anonymous Group signatures. In LSAG, a signer produces a key image defined as the signer's private key multiplied by the hash-to-point of the signer's public key. Stated plainly: you take your secret key, apply it as a scalar multiplication to a curve point derived by hashing your public key, and that product is your key image. The key image is bound to your private key but reveals nothing about which decoy you hid behind. Two signatures from the same private key produce the same key image — and the network rejects any transaction whose key image has already appeared. That's how double-spending is caught without deanonymizing the spender. MLSAG, or Multilayered Linkable Spontaneous Anonymous Group signatures, generalizes this from single keys to key vectors. Instead of signing as one member of a ring of individual keys, the signer proves they know all the private keys in one column of an n-by-m key matrix. MLSAG produces m key images — one per row — and a collection of scalar responses. Noether proves three security properties for MLSAG: unforgeability, signer ambiguity, and linkability. The signature scales as order m times n plus one, and for m greater than one, it's actually more compact than the earlier CryptoNote construction. This generalization matters because hiding amounts requires signing over multiple inputs simultaneously, and you need the ring to span that full structure. Now to amounts. The tool Noether borrows — crediting Bitcoin Core developer Gregory Maxwell — is the Pedersen commitment. The construction needs two group points: G, the standard basepoint, and H, a second point whose discrete logarithm relative to G is unknown. A commitment to amount a with blinding factor x is written as x times G plus a times H. Verbally: you take the blinding scalar, multiply it by the basepoint, and then add the amount multiplied by the masking point H. The result is a single curve point that hides the amount completely. The critical property is homomorphism — Pedersen commitments add. A commitment to three plus a commitment to five gives a commitment to eight. This means the network can verify that the sum of input commitments minus the sum of output commitments equals a commitment to zero, confirming that no coins were created or destroyed, without learning any individual amount. Transaction fees stay visible — they're paid as unmasked multiples of H so miners can verify the fee. The blinding factor x is what prevents guessing. Without it, someone could try every plausible amount value and check whether the resulting commitment matches. The random scalar makes that infeasible. However, the blinding factors across inputs and outputs must be arranged so the commitment difference lands on zero with a known private key — that "amount key" construction allows the MLSAG signature to prove balance without revealing any individual value. Commitments alone, though, leave one gap open. Because the arithmetic happens in a finite field, a negative number wraps around to an astronomically large positive number. An attacker could commit to a negative value that algebraically balances the transaction while effectively creating coins. This is the range proof problem, and it's the final piece. The solution is to decompose each output amount into its binary representation — a sum of bits, each multiplied by the appropriate power of two — and prove each bit is either zero or one. For each bit position, the prover produces a small ring signature over a two-element ring: a commitment to zero and a commitment to the relevant power of two. If the actual bit is neither zero nor one, neither ring element is a valid commitment to zero and the ring can't be signed. The verifier checks that these per-bit commitments sum to the overall output commitment. Noether suggests the range zero to two to the sixty-fourth, given that Monero has two to the sixty-fourth atomic units. These per-bit proofs don't need to be linkable, so they use a simpler ring signature scheme rather than MLSAG. The cost is real: every output carries per-bit commitments and their associated ring signatures, and every verifier must check each one. That's where the practical overhead of Ring Confidential Transactions lives. But it's also what makes inflation impossible. Put all the pieces together, and a complete Ring Confidential Transactions transaction works like this. The sender selects decoy inputs from the blockchain, wraps each real input in a Pedersen commitment, and arranges output commitments so inputs minus outputs commits to zero. An MLSAG signature is then built over a key matrix that spans the input keys and commitment rows, signed against a message hash that includes the outputs. The MLSAG produces key images that let the network detect reuse. Each output carries a range proof built from per-bit ring signatures. A verifier then checks four things: the MLSAG signature is valid, no key image has appeared before, the commitment balance is zero, and every range proof verifies. If all four pass, the transaction is accepted. The sender's identity stays hidden among the ring members. The amounts stay hidden behind the commitments. And no coins were created. Compared to other privacy approaches at the time, Ring Confidential Transactions' design choices are distinctive. Zerocash offers strong privacy guarantees but requires a trusted setup — a ceremony during which certain secret parameters must be generated and then destroyed, with security dependent on that destruction actually happening. Noether also notes that generating a Zerocash proof could take around three minutes and substantial random access memory. CoinJoin and mixer approaches hide transactions through coordination but require either a trusted party or a matching protocol between participants. Ring Confidential Transactions needs none of that. Mixing is spontaneous — decoys are pulled from the existing blockchain — and there's no central party, no coordination, no ceremony. The formal security guarantees Noether proves reduce to standard hard problems. Unforgeability rests on the discrete logarithm assumption in the random oracle model: a forger would have to solve discrete logarithm. Signer ambiguity reduces to the Decisional Diffie-Hellman assumption — if that problem were easy, an attacker could identify which ring column produced a signature. Linkability follows directly from the key image construction. The same private key always produces the same image, so reuse is detectable. These are the same mathematical foundations that secure most of modern internet cryptography. They're not exotic assumptions. Ring Confidential Transactions shipped in Monero in 2017 and became mandatory for all transactions. Every transaction on the network since then has carried hidden amounts, hidden senders, and hidden recipients simultaneously. The paper didn't just describe a protocol. It became the infrastructure of a live financial system — one that handles the three privacy gaps Bitcoin left open, without asking anyone to trust a setup they can't verify. This lecture was created by ennepō. Go to https://ennepo.ai to Discover, Create and Follow the latest research in your field. Read when you can. Listen when you want to.