Anonymity technology in cryptocurrencies

CryptoNote is an application-level protocol on which a family of anonymous cryptocurrencies is built, the most famous of which are Bytecoin and Monero. Anonymity in CryptoNote is implemented through the use of ring signatures (the sender is hidden) and one-time addresses (the recipient is hidden).

The protocol was developed in 2012 by a developer (or group of developers) under the pseudonym Nicholas van Saberhagen. Its mathematical component and motivation are described in the CryptoNote Whitepaper. Bytecoin, launched in the summer of 2012, was the first cryptocurrency based on this technology. Later, several teams launched their networks using the Bytecoin code as a basis.

CryptoNote technology uses a blockchain transaction database similar to that of BTC. The database is also protected from modification using a hash-based proof-of-work method. But in CryptoNote, computation time depends more on the speed of random memory access than on the speed of performing simple mathematical operations. The algorithm includes:

Keccak and sponge function
a 2MB buffer similar to that used in the Scrypt algorithm, to which random read and write access is performed;
64-bit multiplication operations;
AES encryption round calculation;
Additional hash functions: BLAKE, Grøstl, JH, Skein.
These innovations complicate the creation of specialized processors for mining, the massive use of which in the BTC network has led to the fact that there is no economic sense for owners of ordinary personal computers to participate in mining.

Transactions in CryptoNote are similar to transactions in BTC: each transaction means a change in ownership of a specified number of units. Several researchers point out that based on the BTC blockchain, it is possible to identify the ownership of some BTC addresses. To make this kind of analysis difficult, CryptoNote technology uses one-time addresses as recipient addresses and ring signatures, which simultaneously indicate the right to dispose of one of the outputs that form a given amount, but do not allow one to determine which of the listed outputs the sender used.

Transactions signed with a ring signature reference multiple other transactions on the blockchain. It is not required that all listed transactions be addressed to a given sender. From an observer's point of view, such a transaction is equally likely to use as input any of the transactions it refers to. The more references to previous transactions included in the ring signature, the greater the uncertainty and the larger the size of the signature itself. The network commission for its inclusion in the block depends on the size of the transaction. The sender can choose between reducing the commission and increasing anonymity. This approach to anonymity can be described as passive decentralized mixing.

Transaction outputs are sent to a one-time address, which is generated from the sender's real address and a random transaction key. The recipient will be able to calculate the private key needed to dispose of what he received from his private key and the same random key specified in the body of the transaction. From an observer's perspective, multiple transactions to the same address will appear to be sent to different addresses that have nothing in common.