2

It is understood that colored coin is possible with stealth addresses, but what about ring signatures such as how they are used in the cryptonote protocol (Monero, Bytecoin)?

I feel like coloring the destination would undermine the obfuscation of the stealth ring

2
  • There are several ways ring signatures could be used in a cryptocurrency. Can you be more specific about what you have in mind, or give a reference? Jul 22, 2014 at 21:07
  • How they are used in the cryptonote protocol, @NateEldredge
    – CQM
    Jul 22, 2014 at 21:14

1 Answer 1

2

Based on my understanding of Cryptonote's ring signature implementation, no, it cannot be used with colored coins.

With Bitcoin, there is a one-to-one correspondence between inputs and outputs of transactions. Suppose there is a transaction X with an output X1 that sends 1 satoshi to Alice's address A, and everyone agrees that output X1 is colored so that it grants title to Alice's 1977 Chevy Nova. If Alice decides to give the car to Bob, she creates a new transaction Y, with an input pointing to X1, and whose sole output Y1 sends 1 satoshi to Bob's address B. Now Bob can prove, by creating a signature corresponding to his address B, that he is the rightful owner of the car. If Mallory tries to claim the car by creating a different transaction with input X1, he will be found out, because he can't sign that transaction with Alice's private key, so it won't verify. If Alice tries to give the car to someone else by creating a second properly signed transaction Z with input X1, it will be detected as a double spend because another transaction spending X1 precedes it in the block chain.

With ring signatures, this correspondence is broken. When creating a transaction, in addition to the one output (of a previous transaction) that you really want to spend, you can list many others. You create a signature that proves that you are authorized to spend one of the outputs you listed, but doesn't give any information about which one it was. However, a linking algorithm ensures that any future attempt to spend that output again will be noticed and rejected.

In the above scenario, if Alice uses a ring signature on her transaction Y, including not only X1 but another output Z1, then her signature will not prove that she is entitled to spend X1 (and therefore is the rightful owner of the car and can give it away); it only proves that she is entitled to either X1 or Z1.

Furthermore, Mallory could create a transaction M that includes X1 and another output K1 that he is entitled to spend. Since he has the private key corresponding to K1, he can properly sign the transaction M, but it won't be clear whether it is spending X1 (which would convey title to the car) or K1 (which won't).

Now, ring signatures are an optional feature in Cryptonote. If you want, you can create a transaction with only a single input, which will make it unambiguous which previous output you are spending. To avoid confusion such as Mallory's transaction above, a colored coin protocol for Cryptonote would probably specify that to convey title, you have to use a transaction with a single input; then Mallory's multiple-input transaction above would still be a legal Cryptonote transaction, but the community would agree it doesn't grant him title to the car.

In short, the whole point of colored coins is to create an unbroken chain of transactions that traces the title of the car, and the whole point of ring signatures is to avoid creating such a chain. So if you want colored coins, you have to avoid using ring signatures in this way.

3
  • your second to last paragraph seems to contradict your topic sentence in some way, like perhaps the community could have a namespace that doesn't use ring signatures, perhaps segregated from the rest of the protocol via proof of burn? (although I extremely dislike intermediary coins)
    – CQM
    Jul 23, 2014 at 5:49
  • I'm not sure what you mean. In order to use colored coins in a currency that has ring signatures, colored transactions would have to use just one input (one public key), even though ring signatures allow you to use as many as you want. That effectively reduces the ring signature to an ordinary signature. But there would be no need to "segregate" the colored coins. Jul 23, 2014 at 13:52
  • I am thinking that a colored coin software package would just always tailor transactions this way.
    – CQM
    Jul 23, 2014 at 14:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.