CryptoNote

CryptoNote

Development status	Active
Written in	C++
Operating system	Windows, Unix-like, OS X
Type	Cryptocurrency, anonymity
License	MIT License
Website	cryptonote.org

CryptoNote is an application layer protocol that powers several decentralized privacy oriented digital currencies. Conceptually, it is an evolution of ideas behind bitcoin: both are similar in some ways yet different in many others.^[1][2]

The main difference between the two technologies is that bitcoin (and most digital currencies) is less opaque than CryptoNote-based currencies due to the latter's blockchain being almost anonymous, contrary to non-Cryptonote blockchains.^[3][4] CryptoNote currencies use a distributed public ledger that records all balances and transactions of its in-built currency like bitcoin. Unlike bitcoin, CryptoNote's transactions cannot be followed through the blockchain in a way that reveals who sent or received coins. The approximate amount of a transaction can be known, but the origin, destination, or actual amount cannot be learned. The only information available is that the actual amount was lower than the displayed amount. The only people with access to the whole set of data about a transaction are the sender or receiver of the transaction and the person who possesses one or both secret keys.

Another significant difference is hash-based proof-of-work algorithm. Bitcoin uses SHA256, which is CPU-bound function. That means that participants (miners) are only limited by their calculation speeds, and it is relatively cheap to create an application-specific integrated circuit (ASIC) device, which will surpass an ordinary computer in hashes per unit of money.^[5] CryptoNote uses memory bound function CryptoNight, which cannot be easily pipelined.^[6]

CryptoNote code was not forked from bitcoin's, so it also has other different inner algorithms, like recalculating new difficulty level or new block size.^[6]

Origins

CryptoNote technology was first described in a whitepaper CryptoNote v 1.0.^[7] An updated version has been released under the name CryptoNote v 2.0^[6] later. The Bytecoin cryptocurrency was the first one where the underlying cryptographic protocol has been implemented. CryptoNote was at first developed in Java for faster launch, and then re-written in C++ in 2013.^[8]

CryptoNote is based on many early works and protocols and takes into consideration several issues raised formerly. Below is a list of the most important papers and events that influenced CryptoNote:^[9]

• 1983 – Blind signatures described by David Chaum;^[10]
• 1997 – HashCash (an instance of a proof-of-work system) invented by Adam Back;
• 2001 – Ron Rivest, Adi Shamir, and Yael Tauman proposed ring signatures to the cryptographic community;^[11]
• 2004 – Patrick P. Tsang and Victor K. proposed using the ring signature system for voting and electronic cash;^[12]
• 2008 – Bitcoin whitepaper published by Satoshi Nakamoto;^[13]
• 2011 – An Analysis of Anonymity in the Bitcoin System, Fergal Reid and Martin Harrigan;^[14]
• 2012 – Destination Address Anonymity in Bitcoin (one-time addresses in CryptoNote).^[15]

Anonymous transactions and ring signatures

Like bitcoin, CryptoNote currencies use a public address consisting of pseudorandom numbers and letters that is derived from user's public keys. Addresses serve as public IDs of the users. However, unlike bitcoin, CryptoNote transactions hide the connection between the sender's and the receiver's addresses.

Sender privacy

To prevent sender identification, CryptoNote groups the sender's public key with several other keys (more precisely, it groups the sender's output with several other's outputs), making it impossible to tell who actually sent the transaction.^[16] If ring signatures are used, all possible senders referenced in the transaction are equiprobable and there is no way to determine the exact private key used while signing.^[17] This approach does not require dedicated master nodes for mixing coins and does not need other users to actively participate in transaction generation (see CoinJoin). It still assures the network that the original sender has the funds in his or her account to send the transaction like an ordinary signature scheme does. Instead of proving in zero knowledge manner the fact "I possess the private key which corresponds to this particular public key" the signer proves "I possess at least one of the private keys which correspond to this set of public keys".

Receiver privacy

On the receiver's end, the technology generates a new public key for each money transfer,^[18] even for the same sender and receiver. With sender's random data and receiver public address it is possible to create a pair of unique private and public keys via Diffie-Hellman protocol. Sender generates one-time ephemeral key for each transfer and only the receiver can recover the corresponding private key (to redeem the funds). No third party can determine if two different transactions were sent to the same recipient.

Double spending protection

Anonymous transactions have a potential problem. Bitcoin and similar currencies use a public ledger to verify that each person sending funds actually has such funds in their account and have not sent it to another user previously. Since CryptoNote currencies are anonymous, the network must confirm the validity of transactions in another way.

CryptoNote solved this problem^[19] by using more sophisticated scheme instead of usual ring signature: traceable ring signature. The algorithm originally proposed by Fujisaki and Suzuki in 2007^[20] allows to trace the sender of two different messages if they contain the same tag and signed by the same private key.

CryptoNote authors slightly simplified the scheme, replacing tag with key image and discarding the traceability property. They called their algorithm one-time ring signature, "stressing the user’s capability to produce only one valid signature under his private key".^[6] Two different signatures under the same key (a double spend attempt) can be easily linked together, and only one will be stored in the blockchain.

The key idea is in using the image of the private key in signing/verification formulas. These are not actual images that would contribute greatly to blockchain bloat, but rather a number, which corresponds to each private key one-to-one (deterministically derived from it by the cryptographic hash function). The key image cannot be used to derive the private key and public address, but since every key image spent is stored in the blockchain, the network will block any duplicates. Likewise, any attempt to create a key image would not fit into the mathematical formula during a transaction verification and will be denied. The downside to this is that it would be impossible to identify anyone who attempts to perform a double spend with fraudulent intent or as a result of software or human error. The system, however, will block such attempts.

Egalitarian proof of work

The CryptoNote’s proof of work mechanism is actually a voting system where users vote for the right order of transactions, new features in the protocol and honest money supply distribution. It is important that during the voting process every participant have equal voting rights.^[19] Most CryptoNote coins use the CryptoNight^[21] algorithm to run its blockchain and secure its network, the only exception being Boolberry. CryptoNight is a proof-of-work algorithm that mixes graphics processing unit (GPU) and central processing unit (CPU) mining to create a system resistant to both application-specific integrated circuits (ASICs) and fast memory-on-chip devices. This is designed to create a more uniform distribution of coins through the currency's life. However, there are some questions about its susceptibility to botnets.

The algorithm includes:^[22]

• Keccak sponge construction;
• Scrypt-like 2 MB scratchpad with random look-ups (read-write);
• 64-bit multiplications;
• Advanced Encryption Standard (AES) encryptions
• Hash functions BLAKE, Grøstl, JH, Skein

Adaptive network limits

There are no hard-coded constants in CryptoNote code. Each network limit such as maximum block size, or minimum fee amount is adjusted based on the historical data of the system. Moreover, the difficulty and the maximum block size are automatically adjusted with each new block.^[23]

Philosophy

CryptoNote philosophy is built on privacy as a fundamental human right, and egalitarianism.^[24] According to the whitepaper, the CryptoNight algorithm is intended to make the coin adhere to Satoshi Nakamoto's original vision of “one-CPU-one-vote” system. Thus the tremendous advantage GPUs have over CPUs in most cryptocurrencies is considerably decreased in CryptoNight. If it is a good thing, or not, is debatable.^[25]

Current CryptoNote currencies

The CryptoNote platform has been used in several cryptocurrencies. The CryptoNote Foundation encourages developers to clone the technology. Transaction confirmation time, total number of coins and proof-of-work logic are subject to be altered in forks. Several attempts has been performed to alter core protocol: Boolberry adds address aliases and DigitalNote introduced private messaging.

Bytecoin (BCN)

Bytecoin (BCN), not to be confused Bytecoin (BTE), was the first implementation of the CryptoNote protocol launched in July 2012. Since launching, several improvements have been introduced including multisignature transactions^[26] and several security updates. In 2013, the original CryptoNote Java implementation was rewritten using C++.^[27]

The Bytecoin blockchain contains some extra information not directly related to money transfers: several blocks include geographic coordinates of universities, educational facilities among other buildings.^[28] Blocks generated since August 11, 2012 contain quotes from Cyphernomicon, Neuromancer by William Gibson and other authors.^[29]

On March 31, 2015 Bytecoin developers announced their roadmap for several upcoming releases.^[30] The following improvements were mentioned among others:-

• payment gateway capable of receiving and sending thousands transactions simultaneously
• desktop GUI wallet software (released few weeks later in April 2015^[31])
• several API layers for integration with other software
• blockchain-based aliases system
• blockchain-based assets
• smart contracts with embedded turing-complete language

Monero (XMR)

Monero is currently the most well known of all the cryptonotes and has ongoing support from the community.^[32] Forked from Bytecoin in April 2014, it has a 2-minute block target and 50% slower emission speed. Monero has been praised by Bitcoin core developers Gregory Maxwell, Peter Todd, and Wladimir J. van der Laan.^[33]

Along with simplewallet Monero has numerous GUI wallet applications as well as MyMonero that was launched on November 24, 2014. Monero has also teamed up with academic cryptographers,^[34] implemented an extensive aliasing system, OpenAlias,^[35] partially funded Privacy Solution for integrating I2P in Monero,^[36] created an anonymous voting system, URS,^[37] and implemented Electrum's mnemonic seeds.

Aeon (AEON)

Aeon was launched on June 6, 2014 as a fork of Monero and with the same maximum supply of 18.4 million coins.^[38] It has a block time of 4 minutes and a smoothly varying reward using the formula (M−A) / (218) / (1012) where M = 2⁶⁴ − 1 and A = supply mined to date.^[38] Consequently, it has a similar emission curve to Monero albeit offset by about 6 weeks.^[39]

In October 2014 the original developers discontinued work on Aeon and the project was considered abandoned.^[40] However, in April 2015, after a display of community approval, all of Aeon's assets were handed over to a new core team of developers including notable developers concurrently working on the Monero project. The Aeon project was thereafter rebranded and a new roadmap announced.^[41]

Aeon has been subsequently developed with a continued emphasis on secure and scalable blockchain obfuscation in the interests of user privacy, with additional new faculties pertaining to mobile and low-fidelity operating hardware.^[41]

DigitalNote (XDN)

DigitalNote is a CryptoNote based cryptocurrency, does not follow slow block reward reduction approach of CryptoNote. It halves block reward every 11000 blocks (1 month) instead. This approach is similar to bitcoin's. About 80% of all DigitalNotes were mined in the very first year by community members and miners with the fair CPU-efficient proof-of-work. The idea is to provide main coin units amount for Crypto Economy needs in the very first year, avoiding future miners manipulation and making both network and coin units decentralized. After the first year XDN has a static block reward = 150 XDN and first blockchain banking deposits with interest rate.

DigitalNote was launched in May 2014 as duckNote. Later duckNote was renamed to darkNote and introduced encrypted transactions comments and encrypted messaging features.^[42] Messaging functionality provided by DigitalNote is popular in regions with high social tension and total surveillance.^[43] Following the duckNote to DarkNote rebranding, the XDN price rose by about 50%.^[44] In 2015 DarkNote has been renamed again to DigitalNote.^[45]

Later a pure JavaScript paper wallet generator has been developed for DigitalNote.^[46] The resulting private key can be used with DigitalNote GUI wallet.

Also with DigitalNote XDN developers made first ever cryptocurrency blockchain banking deposits with interest rate on proof-of-work system.^[47]

Boolberry (BBR)

Boolberry is a Bytecoin fork with several improvements and a very intensive development. At its launch, the following improvements had been implemented:

• Wild Keccak hash function instead of CryptoNight
• user friendly address aliases are possible
• alerts from developers^[48]

DarkNetCoin (DNC)

DarkNetCoin is a fork of BoolBerry launched on October 13, 2014. It is announced as a general currency for DarkNetSpace - a platform for anonymous applications such as P2P exchange, on-chain shop, Lotto, Gamble, and Bets.^[49] DarkNetCoin inherits all features from the BoolBerry main branch: WildKeccak hash, aliases and alerts. Development roadmap includes P2P exchange, smart contracts, on-chain shops and proof-of-stake implementation. DarkNetCoin team is financed by miners: a 10% development bonus is charged from every block starting from height 4550. 1% of development bonus goes to CryptoNote team.

Quazarcoin (QCN)

Quazarcoin has been created by bitcointalk member OracionSeis as an attempt to relaunch BitMonero with a slower emission curve:^[50] 50% of Quazarcoins will be emitted during 6 years. Few months after its launch, Quazarcoin has been refocused to distributed torrent-files storage providing users with censorship-free "tracker".

Fantomcoin (FCN)

Fantomcoin is a Bytecoin fork with merged mining support. Fantomcoin can share hashpower with any other CryptoNight-based coin.^[51] It has been released with GUI user-friendly miner and command line miner for cloud mining.

Moneta Verde (MCN)

Moneta Verde is a Bytecoin fork that implements infinite coin emission driven by its network's hashrate and merged mining support.^[52] Moneta Verde is claimed to be environment-friendly.

Dashcoin (DSH)

A 1:1 clone of Bytecoin that claims to have "self-mutating code".^[53] Dashcoin is automerged from Bytecoin source tree, which means that the Dashcoin codebase is always the same as Bytecoin's. Dashcoin team released scripts generating personalized coins based on Cryptonote technology.

RedWind (RD)

RedWind is another CryptoNote Starter fork created for only one mission – funding colonization of Mars.^[54] RedWind was launched in September 2014.

Breakoutcoin (BRO)

Breakoutcoin is a fork of CryptoNote repository announced by Breakout Gaming (BRO)^[55] as a coin intended for online gaming.^[56] BreakoutCoin offers several new features in CryptoNote: Proof-of-Bergstake and BotlessNight hashing algorithm. Initial coin offering was scheduled to October 14, 2014.

CryptoNoteCoin (CNC)

CryptoNoteCoin is the official reference coin launched for educational purposes only. Official site warns users from trying to use CryptoNoteCoin for commercial purposes because coin emission restarts every 2 months.^[57]

Pebblecoin (XPB)

Pebblecoin is a CryptoNote-based coin launched in January 2015. It uses a new proof-of-work algorithm called Boulderhash that requires 13 GB RAM. Developer claims that this algorithm is protected against botnets.^[58]

Discontinued

Comparison of discontinued CryptoNote currencies

Name Launch End of life Details ASAP coin July 2014 10 seconds block target (6 block per minute) Buddhacoin June 2013 A CryptoNote based coin created as a substitute for the Chinese yuan in Tibet CherryNote July 2014 600 seconds block target (1 block per 10 minutes) Dosh—KAPITAL August 2014 November 2014 A currency created as a part of the Outback project. Three other blockchains were created in the scope of this project: Silverback Diamondback Greenback Infinium-8[59] July 2014 Infinium-8 is a fork of the CryptoNote Starter project[60] with infinite emission but without merged mining support. MountCoin[61] June 2014 August 2014 25 seconds block target OneEvilCoin[62] Renamed to MAGNATOJ on November 30, 2015.[63] July 2014 August 2014 Total coins: 666 ÷ 10000 = 8265395.0016 PaladinCoin August 2013 December 2013 A coin used as a medium of exchange on MMORPG sites

Controversy and criticism

Daemon-wallet architecture

Unlike in Bitcoin, all CryptoNote currencies have functionality of network node and wallet split into two separate executables: daemon and simplewallet. Wladimir J. van der Laan writes:

"To name an example of it done right, IMO: Monero's 'simplewallet'. It is a command-line utility wallet that communicates with the node software, and remembers where it was in the chain, and processes changes to the chain state since its last invocation when it 'refreshes'. What is nice is that one can run an arbitrary number of simplewallets against one node daemon, and unlike bitcoind's wallet it doesn't need to run as always-on daemon itself. It can be invoked when the user wants to do something with the wallet, or see if there are new transactions." Bitcoin Development (17 September 2015).

Blockchain bloat and ring signature size

The kind of ring signature used in CryptoNote grows linearly with a number of public keys used in mixing.^[64] The exact formula is bytes, where is the number of said keys (including the key of the sender). There were proposed another ring signature with a lesser size, for example Chandran signatures size is proportional to square root of . When is quite large, the difference becomes more significant: under particular conditions, Chandran signature is 4KB while the CryptoNote ring signature is 36KB.^[65] But as for 2015 none of the proposed algorithms are actually implemented in any cryptocurrency.

Developer of Boolberry, the CryptoNote-based coin, proposed another solution for this problem by going back and actually pruning the old signatures from the blockchain; however, said solution has not been implemented yet.[reference needed]

Nevertheless, an analogy to bitcoin's simple payment verification is still possible: a user can avoid running full node and keeping the whole blockchain by querying the network for the Merkle branch of a transaction.

Origins

The author of the white paper went by the name Nicolas van Saberhagen, although like Satoshi Nakamoto (the author of the bitcoin white paper) that name is likely a pseudonym. Saberhagen's true identity and location remains unknown. Some have claimed that the real creator is someone in the bitcoin community. Adam Back, Nick Szabo and even Satoshi Nakamoto^[66] himself have been floated as possible suspects,^[67] but there is little to no evidence actually supporting those claims.

Stanford Bitcoin Group’s possible involvement in creation of the CryptoNote protocol has also been discussed.^[68] Prior to CryptoNote cryptocurrency protocol, the domain cryptonote.org hosted an encrypted message application also named CryptoNote.^[69] This application was developed by the members of the Stanford Bitcoin Group but had not received wide recognition. This website currently hosts the CryptoNote technology.

Coin Mill conspiracy theory

Several CryptoNote-based coins launches are looking very similar: their announcement threads on bitcointalk.org forum were created by "newbie" accounts and looked alike stressing the slogans such as 'CPU-only mining' and being 'ASIC resistant'. Moreover, same file sharing service used for releases. It is supposed that the only purpose of such launches was to earn easy money and creators were not intended to support and develop these forks.^[70]

Faked versions of whitepaper

Community activists discovered altered versions of CryptoNote whitepapers with digital signatures not corresponding to Nicolas van Saberhagen PGP key and missing PGP watermarks.^[71] This incident has been attributed to documents' forgery.^[72] The possible goal of people behind this action was to refute claims about public availability of CryptoNote since 2012 in order to gain competitive advantage.^[71][73] Modified whitepaper included link to discussion thread started in May, 2013 on bitcointalk.org forum and have been generated using TeX Live software released in 2013 with XMP date property set to 2014.

Bytecoin and Cicada

Bytecoin Tor site included a hidden message with a reference to Cicada 3301. Users also noticed that Cicada-style pictures were used by Bytecoin developers or by somebody impersonating them. Bytecoin blockchain contains several riddles composed of multiple messages. One of these messages possibly refers to Cicada: "And it's the name of person you should give your key. To find it - follow little rabbit on land you've recently inhabit."^[28]

See also

References