So in reality, this is a system of $4$ nonlinear equations. To convince
yourself that it is in fact difficult to figure out $a$ and $b$,
try writing the above systems assuming $a=2$, $b=1$. It should become
clear that the problem is extremely difficult when $a,b$ are chosen
to be very large. As of yet, there are no known methods available to
efficiently solve this system for large values of $a$ and $b$.
Consider the following problem. Suppose your friend has a random integer
$q$, and computes $qP$ using the above form of addition. Your friend
then tells you the $x$ and $y$ coordinates $qP=\left(x,y\right)$,
but not what $q$ itself is. Without asking, how do you find out what
$q$ is? $$A naive approach might be to start with $P$ and keep
adding $P+P+P...$ until you reach $qP$ (which you will know because
you will end up at $\left(x,y\right)$). But if $q$ is very large
then this naive approach might take billions of years using modern
supercomputers. Based on what mathematicians currently know about
the problem and the number of possible $q$, none of the currently
known attacking techniques can, as a general rule, do better in any
practical sense than brute force.
In CryptoNote, your secret key is essentially just a very, very large
number $x$ (for other considerations, see section \ref{sub:generate_keys},
we choose $x$ to be a multiple of $8$). There is a special point
$G$ on the curve ed25519 called ``the base point'' of the curve
which is used as the starting point to get $xG$. Your public key is just $xG$, and you are protected by the above problem from someone using known information to determine the private key.
\subsection{\label{sub:Relation-to-Diffie}Relation to Diffie Helman}
Included in a ring signature are the following equations
involving your secret key $x$:
\begin{eqnarray*}
P&=&xG \\
I&=&x\mathcal{H}_{p}\left(P\right) \\
r_{s}&=&q_{s}-c_{s}x.
\end{eqnarray*}
Here $s$ is a number giving the index in the group signature to
your public key, and $\mathcal{H}_{p}\left(P\right)$ is a hash function which
deterministically takes the point $P$ to another point $P^{\prime}=x^{\prime}G$,
where $x^{\prime}$ is another very large uniformly chosen number.
The value $q_s$ is chosen uniformly at random, and $c_s$ is computed using
another equation involving random values.
The particular hash function used in CryptoNote is Keccak1600,
used in other applications such as SHA-3; it is currently considered
to be secure (\cite{FIPS}).
The above equations can be written as follows:
\begin{eqnarray*}
P&=&xG \\
P^{\prime}&=&xx^{\prime}G^{\prime}\\
r_{s}&=&q_{s}-c_{s}x
\end{eqnarray*}
Solving the top two equations
is equivalent to the ECDH (as outlined in a previous note (\cite{SN}))
and is the same practical difficulty as the ECDLP.
Although the equations appear linear, they are in fact highly non-linear,
as they use the addition described in \ref{sub:Twisted-Edwards-Curves} and above.
The third equation (with unknowns $q_{s}$ and $x$), has the difficulty
of finding a random number (either $q_{s}$ or $x$) in $\mathbb{F}_{q}$,
a very large finite field; this is not feasible.
Note that as the third equation has two unknowns, combining
it with the previous two equations does not help; an attacker needs to
determine at least one of the random numbers $q_{s}$ or $x$.
\subsection{\label{sub:Time-Cost-to}Time Cost to Guess q or x }
Since $q$ and $x$ are assumed to be random very large numbers in
$\mathbb{F}_{q}$ , with $q=2^{255}-19$ (generated as 32-byte
integers), this is equivalent to a 128-bit security level (\cite{BCPM}),
which is known to take billions of years to compute with current supercomputers.
\subsection{Review of Proofs in Appendix}
In the CryptoNote appendix, there are four proofs of the four basic
properties required for security of the one-time ring-signature scheme:
\begin{itemize}
\item Linkability (protection against double-spending)
\item Exculpability (protection of your secret key)
\item Unforgeability (protection against forged ring signatures)
\item Anonymity (Ability to hide a transaction within other transactions)
\end{itemize}
These theorems are essentially identical to those in \cite{FS} and show that
the ring signature protocol satisfies the above traits. The first
theorem shows that only the secret keys corresponding
to the public keys included in a group can produce a signature for
that group. This relies on the ECDLP for the solution of two simultaneous
(non-linear) elliptic curve equations, which, as explained in \ref{sub:Relation-to-Diffie},
is practically unsolvable. The second theorem uses the same reasoning,
but shows that in order to create a fake signature that passes verification,
one would need to be able to solve the ECDLP. The third and fourth theorems
are taken directly from \cite{FS}.
\section{One-Time Ring Signatures (Application)}
To understand how CryptoNote is implementing the One-Time Ring signatures,
I built a model in Python of Crypto-ops.cpp and Crypto.cpp from the Monero source
code using naive Twisted Edwards Curve operations (taken
from code by Bernstein), rather than the apparently reasonably optimized
operations existing in the CryptoNote code. Functions
are explained in the code comments below. Using the model will produce
a working ring signature that differs slightly from the Monero ring
signatures only because of hashing and packing differences between
the used libraries. The full code is hosted at the following address:
Returns a secret key and public key pair, using \texttt{random\_scalar} (as
described above) to get the secret key. Note that, as described in
\cite{Bern}, the key set for ed25519 actually is only multiples of
$8$ in $\mathbb{F}_{q}$, and hence \texttt{ge\_scalarmult\_base} includes
a \texttt{ge\_mul8} to ensure the secret key is in the key set. This prevents
transaction malleability attacks as described in (\cite{Bern},
{\it c.f.} section on ``small subgroup attacks''). This is part of the
\textbf{GEN} algorithm as described in (\cite{CN}, 4.4).
\subsubsection{check\_key}
Inputs a public key and outputs if the point is on the curve.
\subsubsection{secret\_key\_to\_public\_key}
Inputs a secret key, checks it for some uniformity conditions, and
outputs the corresponding public key, which is essentially just $8$
times the base point times the point.
\subsubsection{hash\_to\_ec}
Inputs a key, hashes it, and then does the equivalent in bitwise operations
of multiplying the resulting integer by the base point and then by $8$.
\subsubsection{generate\_key\_image}
Takes as input a secret key $x$ and public key $P$, and returns
$I=x\mathcal{H}_{p}\left(P\right)$, the key image. This is part of
the \textbf{GEN} algorithm as described in (\cite{CN}, 4.4).
\subsubsection{generate\_ring\_signature}
Computes a ring signature, performing \textbf{SIG} as in (\cite{CN},
4.4) given a key image $I$, a list of $n$ public keys $P_{i}$,
and a secret index. Essentially there is a loop on $i$, and if the
secret-index is reached, then an if-statement controls the special
computation of $L_{i},R_{i}$ when $i$ is equal to the secret index.
The values $c_{i}$ and $r_{i}$ for the signature are computed throughout
the loop and returned along with the image to create the total signature
$\left(I,c_{1},...,c_{n},r_{1},...,r_{n}\right).$
\subsubsection{check\_ring\_signature}
Runs the \textbf{VER} algorithm in (\cite{CN}, 4.4). The verifier
uses a given ring signature to compute $L_{i}^{\prime}=r_{i}G_{i}$,
$R_{i}^{\prime}=r_{i}\mathcal{H}_{p}\left(P_{i}\right)+c_{i}I$, and
finally to check if $\sum_{i=0}^{n}c_{i}=\mathcal{H}_{s}\left(m,L_{0}^{\prime},...,L_{n}^{\prime},R_{0}^{\prime},...,R_{n}^{\prime}\right)\ mod\ l$.
\subsubsection{generate\_key\_derivation}
Takes a secret key $b$, and a public key $P$, and outputs $8\cdot bP$.
(The $8$ being for the purpose of the secret key set, as described
in \ref{sub:generate_keys}). This is used in derive\_public\_key
as part of creating one-time addresses.
\subsubsection{derivation\_to\_scalar}
Performs $\mathcal{H}_{s}\left(-\right)$ as part of generating keys in
(\cite{CN}, 4.3, 4.4). It hashes an output index together with the
point.
\subsubsection{derive\_public\_key}
Takes a derivation $rA$ (computed via \texttt{generate\_key\_derivation}),
a point $B$, and an output index, computes a scalar via \texttt{derivation\_to\_scalar},
and then computes $\mathcal{H}_{s}\left(rA\right)+B$.
\subsubsection{generate\_signature}
This takes a prefix, a public key, and a secret key, and generates
a standard (not ring) transaction signature (similar to a Bitcoin
transaction signature).
\subsubsection{check\_signature}
This checks if a standard (not ring) signature is a valid signature.
\section{Conclusion}
Despite the ring signature functions in the original CryptoNote source being poorly commented, the code can be traced back to established and used sources, and is relatively straightfoward. The Python implementation provided with this review gives further indication of the code's correctness. Furthermore, the elliptic curve mathematics underlying the ring signature scheme has been extremely-well studied; the concept of ring signatures is not novel, even if their application to cryptocurrencies is.
\medskip{}
\begin{thebibliography}{BBJLP}
\bibitem[BBJLP]{BBJLP} Bernstein, Daniel J., et al. "Twisted
edwards curves." Progress in Cryptology\textendash{}AFRICACRYPT
2008. Springer Berlin Heidelberg, 2008. 389-405.
\bibitem[BCPM]{BCPM} Bos, Joppe W., et al. "Selecting
Elliptic Curves for Cryptography: An Efficiency and Security Analysis."
IACR Cryptology ePrint Archive 2014 (2014): 130.
\bibitem[Bern]{Bern} Bernstein, Daniel J. "Curve25519:
new Diffie-Hellman speed records." Public Key Cryptography-PKC
2006. Springer Berlin Heidelberg, 2006. 207-228.
\bibitem[CH]{CH} Chaum, David, and Eugene Van Heyst. "Group
signatures." Advances in Cryptology\textemdash{}EUROCRYPT\textquoteright{}91.
Springer Berlin Heidelberg, 1991.
\bibitem[CN]{CN} van Saberhagen, Nicolas. "CryptoNote
