Ring signatures and stealth addresses

Understand two non-SNARK privacy primitives that predate and complement zero-knowledge proofs: ring signatures, which prove one of n listed keys signed without revealing which (sender ambiguity), and stealth addresses, which let a payer send to a fresh one-time address only the payee can detect and spend (recipient unlinkability). Learn how linkable ring signatures use key images to prevent double-spends, how the dual-key stealth protocol works, and the honest boundary: these hide who, not what or why, and their privacy is bounded by the ring size and by metadata.

Track

Research

Module

13 · Zero-Knowledge identity & private protocols

Prerequisites

Public-key cryptography · Digital signatures · Ed25519 vs ECDSA

Zero-knowledge proofs are powerful but not the only route to privacy. Two older primitives solve two specific linkage problems directly and cheaply. Ring signatures attack the sender side: they let a transaction prove it was authorised by one of a set of plausible signers, so an observer cannot tell which. Stealth addresses attack the recipient side: they let each payment land at a fresh address that only the intended recipient can link to themselves, so a recipient's incoming payments are not visibly tied together.

They are worth studying alongside the ZK material because they illustrate the same honest discipline from different mathematics, and because real privacy systems combine them. Monero, for example, uses ring signatures for sender ambiguity, stealth addresses for recipient unlinkability, and range proofs for amount hiding — three primitives each solving one leakage channel, none solving all of them.

A ring signature proves that one member of a ring of n public keys produced the signature, without revealing which. The signer needs only the others' public keys — no coordination or setup with them — which is why it is called spontaneous. The classic construction (Rivest–Shamir–Tauman, 2001) chains per-member values into a loop that only closes if someone in the ring knew a private key.

synthetic — Schnorr-style ring signature, why it closes (illustrative)
Ring of public keys P_0 .. P_{n-1}; real signer is index pi with sk x_pi.

Sign(m):
  pick random alpha; set L_pi = alpha*G
  for every other i != pi: pick random c_i, s_i; set L_i = s_i*G + c_i*P_i
  global challenge c = H(m || L_0 || ... || L_{n-1})
  close the ring:  c_pi = c - sum_{i != pi} c_i
  solve:           s_pi = alpha - c_pi * x_pi
  signature = (c, s_0, ..., s_{n-1})

Verify: recompute each L'_i = s_i*G + c_i*P_i and check
        c == H(m || L'_0 || ... || L'_{n-1})
Only someone holding ONE private key in the ring can make it close.

Plain ring signatures have a problem for money: the same key could sign twice and nobody could tell, enabling double-spends. Linkable ring signatures (Liu–Wei–Wong, 2004, and the CLSAG scheme used by Monero) fix this with a key image: a deterministic value derived from the signer's private key that is identical across all of that key's signatures but reveals nothing about which ring member it is. The network records key images; a repeated key image means a double-spend and is rejected — anonymity preserved, reuse detected.

Anonymity

It is infeasible to tell which ring member signed; the anonymity set is the ring size n.

Unforgeability

Only a holder of one of the ring's private keys can produce a valid signature.

Spontaneity

The signer needs only the public keys of the decoys; no setup or cooperation with them.

Key image (linkable)

A deterministic per-key value, constant across signatures by that key, used to detect double-signing without revealing the signer.

If a recipient publishes one address, every payment to them is publicly visible and linkable: anyone sees their balance and who paid them. Stealth addresses fix this. The recipient publishes a meta-address once; each payer derives a fresh one-time address from it using ephemeral randomness, so payments land at distinct, unlinkable addresses that only the recipient can detect and spend.

synthetic — dual-key stealth address protocol (DKSAP) (illustrative)
Recipient keys:  spending key b, viewing key a
Meta-address (public):  (A, B) = (a*G, b*G)

Payer, per payment:
  pick ephemeral r
  shared secret s = r*A           (= r*a*G)
  stealth address P = H(s)*G + B
  publish ephemeral pubkey R = r*G alongside the payment to P

Recipient scans each payment's R:
  s' = a*R  (= a*r*G = s)         # needs only the VIEWING key a
  P' = H(s')*G + B
  if P' == P: "this payment is mine"

Spend: private key for P is  p = H(s) + b   # needs the SPENDING key b
       check: p*G = H(s)*G + b*G = P

The split between viewing key and spending key is useful: the viewing key lets a party (an auditor, an accountant, a watch-only wallet) detect incoming payments without being able to spend them, while the spending key stays offline. This is the same "viewing key" idea used for optional, selective auditability in shielded systems. Ethereum has a stealth-address standard (EIP-5564) formalising this meta-address scheme on-chain.

A valid linkable ring signature establishes a precise statement: one holder of a private key in this ring authorised this message, and (via the key image) this key has not signed a conflicting message before — under the signature scheme's assumptions. A stealth-address payment establishes that funds were sent to a one-time address derivable from a published meta-address. Both are exactly what their systems need to move value privately.

Neither establishes who the signer or recipient actually is beyond "a member of this ring" / "the holder of this meta-address", nor that the ring is large enough to hide anyone, nor that amounts or network metadata are private, nor that the transaction is legitimate or safe. For RootRaven the lesson is that privacy is channel-by-channel evidence: report the ring size (the sender anonymity set), the amount-hiding and metadata posture separately, and never read "the signature is valid and unlinked" as "the actor is anonymous" or "the action is safe". A valid signature over a ring is an authorisation under an assumption, not a verdict about identity or intent.

Expected direction: Three channels (any three): (1) Amount — ring signatures and stealth addresses hide the sender and recipient but not the value; unless amounts are separately hidden (e.g. range proofs / confidential transactions), a unique amount links sender to recipient. Orthogonal leak, not a flaw in either primitive. (2) Decoy/ring-size and selection — the sender anonymity set is only 11, and if decoys are chosen in a statistically distinguishable way, heuristics down-weight them, shrinking the effective set below 11. This is a limit of the primitive's configuration, not a break of unforgeability. (3) Network / timing metadata — IP origin, broadcast timing, and behavioural patterns (consolidating stealth outputs, reusing relayers, deposit/withdraw timing) re-link transactions regardless of the signatures. Orthogonal leak. (Also valid: careless consolidation of stealth outputs re-links a recipient.) Restatement: a valid linkable ring signature guarantees one holder of a ring key authorised the message and did not double-sign (via key image), with anonymity equal to the ring size; stealth addresses guarantee each payment lands at a one-time address only the recipient can detect/spend. Neither guarantees amount privacy, metadata privacy, an anonymity set larger than the ring/look-alike set, or that the transaction is legitimate. "Fully private" is the conjunction of all channels, which these two primitives do not provide alone.

What does a ring signature prove, and what is its anonymity set?

It proves that one holder of a private key among the ring of n listed public keys produced the signature, without revealing which (and without the decoys' cooperation — spontaneity). The anonymity set is the ring size n: a ring of 11 hides the signer among 11.

What problem do linkable ring signatures solve, and how, without breaking anonymity?

They prevent double-spending by a signer who could otherwise sign twice undetectably. A key image — a deterministic value derived from the signer's private key, identical across all of that key's signatures but revealing nothing about which ring member it is — is recorded by the network; a repeated key image flags a double-spend while the signer stays anonymous.

In the dual-key stealth protocol, what do the viewing key and spending key each enable?

The viewing key (a) lets its holder scan payments and detect which one-time stealth addresses belong to the recipient (compute the shared secret and match P), without being able to spend. The spending key (b) is needed to derive the one-time private key p = H(s) + b and actually spend. This allows watch-only/auditor detection while spending authority stays separate.

Why do ring signatures and stealth addresses not provide "fully private transactions" on their own?

Each hides one channel — ring signatures the sender, stealth addresses the recipient — but not amounts, timing or network metadata, and the anonymity set is only the ring/look-alike set. Full transaction privacy is the conjunction of all channels, so amount-hiding (range proofs), metadata protection and adequate set sizes are separately required; a valid signature and a fresh stealth address do not make the actor anonymous or the action safe.