jeffro256

Ledger Change Steal Bug

Software affected

All Ledger Monero application software up to, but not including, version 2.2.1. The fix commit is 844ed749.

Impact

Adversary with control of the hot device (USB, Bluetooth, etc) can fool

Post-quantum Turnstile Design for Carrot/FCMP++ Enotes

Problem

The potential scenario in which future technology (i.e. quantum computers) allows machines to break the security of the discrete log problem poses a threat to the economic security and privacy of the Monero network. FCMP++ mitigates most of the of on-chain privacy concerns posed by a quantum adversary, however, it does not address the economic security threats due to such a machine's ability to forge FCMP++ proofs. The Monero network should migrate to post-quantum (PQ) cryptography before the first working quantum computer is suspected of breaking an Ed25519

Carrot follow-up audit

Background

Cyperstack finished their audit of Carrot in November of 2024. Since then, a handful of tweaks were made to Carrot that may be worth reviewing. There were also a couple misunderstadings by Cypherstack on the protocol shown in the review because the lack of spec clarity. It makes the most sense to ask Cypherstack to do the follow-up audit since they are already so familiar with Carrot.

Scope

In a nutshell, the scope is the set of changes in the Carrot specification repository since commit dbb04d91d40b68b2a8b82b895acf762c864b4cbc and revisiting some previous assumptions in the first audit.

How to View-scan Monero without View Keys, public nor private

Requirements

Working quantum computer
Address spend pubkey of target, main or subaddress

How it works

Background

Jeffro256's Roadmap of Long-term Goals for Monero

In rough order of when I think they could be done.

Known paths forward

FCMP++ integration
Carrot address protocol integration
Carrot key hierarchy wallets
Better multisig integration

Extracting Monero Wallet Seeds From Addresses with a Quantum Computer

Wallet Derivation Assumputions

Not multisig
The private spend key is the seed src
The private view key is a hash of solely the private spend key src
Subaddresses are generated by adding the public spend key to a base point multiplied by a scalar hash of the private view key and a small "index" space src

This is not the exact math, but here is a simplified deriviation scheme which preserves all the relationships that we care about:

Short On-chain Memos Encrypted in Carrot Anchors in Two-out Selfsends

What

SOME CATS is a scheme to send 16-byte transaction memos in 2-out transactions using Carrot. SOME CATS memos are:

Encrypted - Memos are encrypted to the receiver, optionally visible to the sender as well
Indistinguishable - Transactions containing a SOME CATS memo are indistinguishable from normal Carrot transactions
Available on-chain - The memo will always be available on-chain as long as its associated transaction is
Receiver agnostic - The receiver doesn't need to support SOME CATS to spend funds sent in a SOME CATS transaction, so long as they support the Carrot addressing protocol

Carrot Recoverable Indistinguishable Blinded Proof Of Existence before Timestamp

What

CRIBPOET lets you prove you knew about information before some point in time by posting a Carrot transaction from your wallet to the Monero blockchain.

Carrot - Uses the Carrot addressing protocol, so any wallet with the new Carrot key hierarchy will have the ability to support this scheme by default
Indistinguishable - Uses steganography to look like a regular old 2-out transaction
Blinded - The commitment to the information contains a blinding factor that makes it impossible to guess the message from the commitment
Recoverable - The blinding factor is recoverable through normal Carrot balance recovery, which means you don't have to keep track of any ephemeral information.

	#!/usr/bin/env python3

	import argparse
	import contextlib
	import os
	import requests
	import subprocess

	MONERO_REMOTE = 'seraphis-migration'
	MONERO_REPO = 'https://github.com/{}/monero.git'.format(MONERO_REMOTE)