Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It only takes a minute to sign up.
Sign up to join this community
It is understood that colored coin is possible with stealth addresses, but what about ring signatures such as how they are used in the cryptonote protocol (Monero, Bytecoin)?
I feel like coloring the destination would undermine the obfuscation of the stealth ring
Based on my understanding of Cryptonote's ring signature implementation, no, it cannot be used with colored coins.
With Bitcoin, there is a one-to-one correspondence between inputs and outputs of transactions. Suppose there is a transaction X with an output X1 that sends 1 satoshi to Alice's address A, and everyone agrees that output X1 is colored so that it grants title to Alice's 1977 Chevy Nova. If Alice decides to give the car to Bob, she creates a new transaction Y, with an input pointing to X1, and whose sole output Y1 sends 1 satoshi to Bob's address B. Now Bob can prove, by creating a signature corresponding to his address B, that he is the rightful owner of the car. If Mallory tries to claim the car by creating a different transaction with input X1, he will be found out, because he can't sign that transaction with Alice's private key, so it won't verify. If Alice tries to give the car to someone else by creating a second properly signed transaction Z with input X1, it will be detected as a double spend because another transaction spending X1 precedes it in the block chain.
With ring signatures, this correspondence is broken. When creating a transaction, in addition to the one output (of a previous transaction) that you really want to spend, you can list many others. You create a signature that proves that you are authorized to spend one of the outputs you listed, but doesn't give any information about which one it was. However, a linking algorithm ensures that any future attempt to spend that output again will be noticed and rejected.
In the above scenario, if Alice uses a ring signature on her transaction Y, including not only X1 but another output Z1, then her signature will not prove that she is entitled to spend X1 (and therefore is the rightful owner of the car and can give it away); it only proves that she is entitled to either X1 or Z1.
Furthermore, Mallory could create a transaction M that includes X1 and another output K1 that he is entitled to spend. Since he has the private key corresponding to K1, he can properly sign the transaction M, but it won't be clear whether it is spending X1 (which would convey title to the car) or K1 (which won't).
Now, ring signatures are an optional feature in Cryptonote. If you want, you can create a transaction with only a single input, which will make it unambiguous which previous output you are spending. To avoid confusion such as Mallory's transaction above, a colored coin protocol for Cryptonote would probably specify that to convey title, you have to use a transaction with a single input; then Mallory's multiple-input transaction above would still be a legal Cryptonote transaction, but the community would agree it doesn't grant him title to the car.
In short, the whole point of colored coins is to create an unbroken chain of transactions that traces the title of the car, and the whole point of ring signatures is to avoid creating such a chain. So if you want colored coins, you have to avoid using ring signatures in this way.
