Are Monero Transaction Anonymous?

Question

Lets say i have a monero address and want to send my coins to another address. Will that transaction be private? Can somebody find out that i sent those coins? Are there any altcoins that i can use to send funds from one address to another without anyone knowing that i did?                                                                                                                           

Answer 1

Short answer: yes, it will be anonymous

Long answer:

The following applies to all Cryptonote based coins, unless stated otherwise:

On the blockchain, all addresses are one time addresses. In Bitcoin, you are exhorted to not reuse addresses, but Monero enforces this. Every new transaction causes a new one time address to be generated, in such a way that the recipient can derive the private keys to that new one time address (and thus spend those funds).

Moreover, Monero uses ring signatures to obscure which outputs are being spent. Those ring signatures are made with 1 private key (the one you're spending) and an arbitrary of public keys, those of outputs that you cannot spend. The transaction you send will appear to spend one of that set. The trick is that you can generate signatures such that an observer (ie, someone finding the tx on the blockchain) can be assured that one of the outputs in that tx was spent with the corresponding private key, but cannot tell which one. On the blockchain, they only see the public keys of your spent output, and the N other public keys you picked from the blockchain.

So, to recap: an observer sees that an output among this set of outputs was spent, but does not know which one. And sees that it went to that new one time address, which has no link to the recipient's address (unless the observer has the recipient's view private key, nice trick to allow a third party read only access to your income).

Now, the devil's in the details. There are other ways inferences could be made, such as particular amounts being spent (ie, if you're sent a very specific amount of dust, it's the only output of that particular amount on the blockchain). The Cryptonote protocol splits amounts by denominations (ie, sending 153 monero will, create three outouts, 100 monero, 50 monero, and 3 monero, so it's a lot easier to hide). Monero is currently working on an adaptation of gmaxwell's Confidential transactions (https://lab.getmonero.org/pubs/MRL-0005.pdf), which can be used with ring signatures, so that this avenue will be fully blocked (this is Monero only, other Cryptonote coins do not have this).

So, yes, if you use Monero, your transactions will be private. Cryptonote is the state of the art in blockchain privacy, though Zerocash may top it once it is released, though Zerocash also has issues of its own, so this will be an interesting thing to see.

By the way, all the papers on https://lab.getmonero.org/ are worth reading if you want to know more about the details.

Answer 2

For the math lovers, I will provide the mathematical intuition behind one-time public keys.

The assumption behind this technique is the hardness of discrete logarithm problem for groups like $Z_p^*$, Elliptic curve group.

Monero is using Elliptic Curve group as the underlying group. For simplicity, I will explain the concept with $Z_p^*$ but similar analogy and correctness will hold for any group where solving discrete logarithm is hard.

Consider the following

Let $Z_p^*$ be a group with multiplication modulo $p$ where $p$ is a prime and let $g$ be the generator of the group.

let $x$ be the secret key where $x$ is chosen uniformly randomly ${1,2,...,p-1}$ and the corresponding public key would be $ y = g^x$ modulo $p$.

Now using the key pair $(y,x)$ and any random string s we can generate one-time payable public key $(p',x')$ in the following way

        \begin{equation}
            x' = x + Hash(s)
        \end{equation}
        \begin{equation}
            y' = g^xg^{Hash(s)} \ \text{mod}\ p
        \end{equation}

Here the assumption is that Hash(s) will give us a string of length equal to the length of $p$.

Observe that only the user having secret key $x$ will generate $x'$ to spend from currency sent to the one time public key $y'$ under the assumption of the hardness of discrete logarithm problem on $Z_p$. And to an external observer, $y$ and $y'$ are statistically uncorrelated.