A third obstacle involved Monero forks (such as Monero Original and Monero Classic) retaining the transaction output (TXO) set, jeopardizing the privacy of Monero users. For example, if Alice spends her output on the Monero Classic chain with ring A, B, C, D, E (where A is the real input) and thereafter spends the same output on the Monero chain with ring A, F, G, H, I (where, again, A is the real input), an observer could reasonably infer (by analyzing both chains) that A was the input being spent, i.e., the real input. Now, if another user used Alice's output A as a decoy output, their privacy was weakened, as the output was, due to Alice's behavior, rendered obsolete as decoy. Fortunately, the Monero developers added several mitigations (for example, a user now has an option to reuse their ring), rendering aforementioned analysis mostly obsolete. In addition, the user can utilize a special tool which ensures no provably spent outputs (e.g. Alice's output in previous example) are used as decoy outputs. This significantly reduced the impact of key image reusage, for example, in the event of a Monero user claiming their Monero Classic. Subsequent research by Justin Ehrenhofer confirmed their effectiveness.
0 commit comments