MLSAG Rules

Introduction

These rules are split into 3 sections: Full, Simple and Both. Full is for RCT type Full and Simple are for the other RCT types that use MLSAG signatures.

Simple is not just for RCT type Simple!

Index

1. Full Rules
2. Simple Rules

Full Rules

Creating The Ring Matrix (Full)

For RCT type full the ring matrix contains every inputs ring members: ¹

(The signer owns a whole column)

The last row contains: \(\sum CommitmentsAtIndex - \sum outPK - fee * H \) ²

Where CommitmentsAtIndex are the ring members commitments in that column.

Which means that for the true spends column the entry in the last row will be commitment to 0.

By structuring the matrix like this the true spend has to be a the same index in each inputs ring, which is not good for privacy.

Number Of Ring Members

There must be the same amount of ring members in each inputs ring.³

One MLSAGs

There must be only one MLSAG signature.⁴

Simple Rules

Creating The Ring Matrix (Simple)

For simple RCT types the ring matrix only contains the ring members of a single input: ⁵

The last row contains the ring members commitment minus the pseudo-out for this input.⁶

Simple Number Of MLSAGs

There must be the same amount of MLSAG signatures as there are inputs.⁴

Rules That Apply To Both

More Than One Ring Member

There must be more than one ring member.⁷

SS Size

The ss field must be the same length as the key matrix⁸ and each ss member lengths must be the same as the matrix's rows. ⁹

SS, CC Canonical Encoding

Every ss element and cc must be fully reduced scalars.¹⁰

Key Images Not Identity

All the key images must not be equal to the identity point.¹¹

The MLSAG Signature Must Be Correct

The signature must be valid.¹²