Age | Commit message (Collapse) | Author | Files | Lines |
|
|
|
|
|
Scheme by luigi1111:
Multisig for RingCT on Monero
2 of 2
User A (coordinator):
Spendkey b,B
Viewkey a,A (shared)
User B:
Spendkey c,C
Viewkey a,A (shared)
Public Address: C+B, A
Both have their own watch only wallet via C+B, a
A will coordinate spending process (though B could easily as well, coordinator is more needed for more participants)
A and B watch for incoming outputs
B creates "half" key images for discovered output D:
I2_D = (Hs(aR)+c) * Hp(D)
B also creates 1.5 random keypairs (one scalar and 2 pubkeys; one on base G and one on base Hp(D)) for each output, storing the scalar(k) (linked to D),
and sending the pubkeys with I2_D.
A also creates "half" key images:
I1_D = (Hs(aR)+b) * Hp(D)
Then I_D = I1_D + I2_D
Having I_D allows A to check spent status of course, but more importantly allows A to actually build a transaction prefix (and thus transaction).
A builds the transaction until most of the way through MLSAG_Gen, adding the 2 pubkeys (per input) provided with I2_D
to his own generated ones where they are needed (secret row L, R).
At this point, A has a mostly completed transaction (but with an invalid/incomplete signature). A sends over the tx and includes r,
which allows B (with the recipient's address) to verify the destination and amount (by reconstructing the stealth address and decoding ecdhInfo).
B then finishes the signature by computing ss[secret_index][0] = ss[secret_index][0] + k - cc[secret_index]*c (secret indices need to be passed as well).
B can then broadcast the tx, or send it back to A for broadcasting. Once B has completed the signing (and verified the tx to be valid), he can add the full I_D
to his cache, allowing him to verify spent status as well.
NOTE:
A and B *must* present key A and B to each other with a valid signature proving they know a and b respectively.
Otherwise, trickery like the following becomes possible:
A creates viewkey a,A, spendkey b,B, and sends a,A,B to B.
B creates a fake key C = zG - B. B sends C back to A.
The combined spendkey C+B then equals zG, allowing B to spend funds at any time!
The signature fixes this, because B does not know a c corresponding to C (and thus can't produce a signature).
2 of 3
User A (coordinator)
Shared viewkey a,A
"spendkey" j,J
User B
"spendkey" k,K
User C
"spendkey" m,M
A collects K and M from B and C
B collects J and M from A and C
C collects J and K from A and B
A computes N = nG, n = Hs(jK)
A computes O = oG, o = Hs(jM)
B anc C compute P = pG, p = Hs(kM) || Hs(mK)
B and C can also compute N and O respectively if they wish to be able to coordinate
Address: N+O+P, A
The rest follows as above. The coordinator possesses 2 of 3 needed keys; he can get the other
needed part of the signature/key images from either of the other two.
Alternatively, if secure communication exists between parties:
A gives j to B
B gives k to C
C gives m to A
Address: J+K+M, A
3 of 3
Identical to 2 of 2, except the coordinator must collect the key images from both of the others.
The transaction must also be passed an additional hop: A -> B -> C (or A -> C -> B), who can then broadcast it
or send it back to A.
N-1 of N
Generally the same as 2 of 3, except participants need to be arranged in a ring to pass their keys around
(using either the secure or insecure method).
For example (ignoring viewkey so letters line up):
[4 of 5]
User: spendkey
A: a
B: b
C: c
D: d
E: e
a -> B, b -> C, c -> D, d -> E, e -> A
Order of signing does not matter, it just must reach n-1 users. A "remaining keys" list must be passed around with
the transaction so the signers know if they should use 1 or both keys.
Collecting key image parts becomes a little messy, but basically every wallet sends over both of their parts with a tag for each.
Thia way the coordinating wallet can keep track of which images have been added and which wallet they come from. Reasoning:
1. The key images must be added only once (coordinator will get key images for key a from both A and B, he must add only one to get the proper key actual key image)
2. The coordinator must keep track of which helper pubkeys came from which wallet (discussed in 2 of 2 section). The coordinator
must choose only one set to use, then include his choice in the "remaining keys" list so the other wallets know which of their keys to use.
You can generalize it further to N-2 of N or even M of N, but I'm not sure there's legitimate demand to justify the complexity. It might
also be straightforward enough to support with minimal changes from N-1 format.
You basically just give each user additional keys for each additional "-1" you desire. N-2 would be 3 keys per user, N-3 4 keys, etc.
The process is somewhat cumbersome:
To create a N/N multisig wallet:
- each participant creates a normal wallet
- each participant runs "prepare_multisig", and sends the resulting string to every other participant
- each participant runs "make_multisig N A B C D...", with N being the threshold and A B C D... being the strings received from other participants (the threshold must currently equal N)
As txes are received, participants' wallets will need to synchronize so that those new outputs may be spent:
- each participant runs "export_multisig FILENAME", and sends the FILENAME file to every other participant
- each participant runs "import_multisig A B C D...", with A B C D... being the filenames received from other participants
Then, a transaction may be initiated:
- one of the participants runs "transfer ADDRESS AMOUNT"
- this partly signed transaction will be written to the "multisig_monero_tx" file
- the initiator sends this file to another participant
- that other participant runs "sign_multisig multisig_monero_tx"
- the resulting transaction is written to the "multisig_monero_tx" file again
- if the threshold was not reached, the file must be sent to another participant, until enough have signed
- the last participant to sign runs "submit_multisig multisig_monero_tx" to relay the transaction to the Monero network
|
|
51895fd7 split wallet and wallet_api (moneromooo-monero)
|
|
b0b7e0f0 Spend proof without txkey (stoffu)
|
|
|
|
|
|
- refactoring: proof generation/checking code was moved from simplewallet.cpp to wallet2.cpp
- allow an arbitrary message to be signed together with txid
- introduce two types (outbound & inbound) of tx proofs; with the same syntax, inbound is selected when <address> belongs to this wallet, outbound otherwise. see GitHub thread for more discussion
- wallet RPC: added get_tx_key, check_tx_key, get_tx_proof, check_tx_proof
- wallet API: moved WalletManagerImpl::checkPayment to Wallet::checkTxKey, added Wallet::getTxProof/checkTxProof
- get_tx_key/check_tx_key: handle additional tx keys by concatenating them into a single string
|
|
This speeds up building a lot when wallet2.h (or something it
includes) changes, since all the API includes wallet2.h
|
|
867b67c4 Wallet API: override update subdir when built from src (Jaquee)
|
|
Transactions in the txpool are marked when another transaction
is seen double spending one or more of its inputs.
This is then exposed wherever appropriate.
Note that being marked with this "double spend seen" flag does
NOT mean this transaction IS a double spend and will never be
mined: it just means that the network has seen at least another
transaction spending at least one of the same inputs, so care
should be taken to wait for a few confirmations before acting
upon that transaction (ie, mostly of use for merchants wanting
to accept unconfirmed transactions).
|
|
b2d416f2 Distinguish "not enough money" and "not enough unlocked money" (binaryFate)
|
|
|
|
|
|
Fix #1530
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
CID 161844
|
|
Silences CID 161874
|
|
CID 161872
|
|
|
|
|
|
|
|
1307e3cc WalletAPI: add getDefaultDataDir() (Jaquee)
|
|
ad4649ac Enable verifying wallet password with having to load wallet. (m2049r)
|
|
|
|
a839a6fa Wallet API: add tx unlock time (Jaquee)
|
|
|
|
e31aac80 walletAPI: add getRefreshFromBlockHeight() (Jaquee)
48c0cb1b wallet api: pause refresh while commiting tx (Jaquee)
f233c01c CMakeLists.txt - ios/xcode fix (Jaquee)
|
|
|
|
|
|
|
|
|
|
|
|
It was unused, so harmless
Reported by erikd on IRC
|
|
|
|
bbf4c210 Wallet API: add spend/view key getters (Jaquee)
|
|
|
|
It sweeps all outputs below the given threshold
This is available via the existing sweep_all RPC, by setting
amount_threshold the desired amount (in atomic units)
|
|
|
|
|
|
|
|
|
|
|
|
db1c7d80 wallet api: add missing mining options (Jaquee)
|
|
|
|
|
|
|
|
|
|
26bd7aac wallet_api: fix logging init via api (moneromooo-monero)
|
|
|
|
|
|
ce7fcbb4 Add server auth to monerod, and client auth to wallet-cli and wallet-rpc (Lee Clagett)
|
|
7549116e Wallet API: Easylogger wrapper for gui (Jaquee)
|
|
|
|
4efc926d Wallet API: Catch error from tools::is_local_address (Jaquee)
|
|
|
|
|
|
|
|
|
|
|
|
9bd9906e Factor is_address_local code into a tools function (moneromooo-monero)
|
|
c02e1cb9 Updates to epee HTTP client code - http_simple_client now uses std::chrono for timeouts - http_simple_client accepts timeouts per connect / invoke call - shortened names of epee http invoke functions - invoke command functions only take relative path, connection is not automatically performed (Lee Clagett)
|
|
|
|
|
|
- http_simple_client now uses std::chrono for timeouts
- http_simple_client accepts timeouts per connect / invoke call
- shortened names of epee http invoke functions
- invoke command functions only take relative path, connection
is not automatically performed
|
|
|
|
17246d05 wallet: print exception message on get_random_outs_error (moneromooo-monero)
|
|
|
|
|
|
This replaces the epee and data_loggers logging systems with
a single one, and also adds filename:line and explicit severity
levels. Categories may be defined, and logging severity set
by category (or set of categories). epee style 0-4 log level
maps to a sensible severity configuration. Log files now also
rotate when reaching 100 MB.
To select which logs to output, use the MONERO_LOGS environment
variable, with a comma separated list of categories (globs are
supported), with their requested severity level after a colon.
If a log matches more than one such setting, the last one in
the configuration string applies. A few examples:
This one is (mostly) silent, only outputting fatal errors:
MONERO_LOGS=*:FATAL
This one is very verbose:
MONERO_LOGS=*:TRACE
This one is totally silent (logwise):
MONERO_LOGS=""
This one outputs all errors and warnings, except for the
"verify" category, which prints just fatal errors (the verify
category is used for logs about incoming transactions and
blocks, and it is expected that some/many will fail to verify,
hence we don't want the spam):
MONERO_LOGS=*:WARNING,verify:FATAL
Log levels are, in decreasing order of priority:
FATAL, ERROR, WARNING, INFO, DEBUG, TRACE
Subcategories may be added using prefixes and globs. This
example will output net.p2p logs at the TRACE level, but all
other net* logs only at INFO:
MONERO_LOGS=*:ERROR,net*:INFO,net.p2p:TRACE
Logs which are intended for the user (which Monero was using
a lot through epee, but really isn't a nice way to go things)
should use the "global" category. There are a few helper macros
for using this category, eg: MGINFO("this shows up by default")
or MGINFO_RED("this is red"), to try to keep a similar look
and feel for now.
Existing epee log macros still exist, and map to the new log
levels, but since they're used as a "user facing" UI element
as much as a logging system, they often don't map well to log
severities (ie, a log level 0 log may be an error, or may be
something we want the user to see, such as an important info).
In those cases, I tried to use the new macros. In other cases,
I left the existing macros in. When modifying logs, it is
probably best to switch to the new macros with explicit levels.
The --log-level options and set_log commands now also accept
category settings, in addition to the epee style log levels.
|
|
d561f4ad enable clang checks that were disabled (Chris Vickio)
0aefb2f6 remove std::move from return statements (pessimizing-move warning) (Chris Vickio)
629d5b76 change counter from bool to int (deprecated-increment-bool warning) (Chris Vickio)
fb76d439 add extra braces around subobjects (missing-braces warning) (Chris Vickio)
3b6d5f25 make struct/class declarations consistent (mismatched-tags warning) (Chris Vickio)
fcf66925 remove unused fields from network_throttle (unused-private-field warning) (Chris Vickio)
296f8c16 inline unused function (for unused-function warning) (Chris Vickio)
|
|
dea53962 fix timeout in check_connection (Jaquee)
|
|
1d317981 Wallet API: add key image import/export functions (Jaquee)
|
|
46550c0b Wallet API: add rescanSpent() (Jaquee)
|
|
|
|
|
|
|
|
|
|
|
|
db56a03f Wallet2 + API: Callbacks for unconfirmed transfers (Jaquee)
|
|
0d3918e1 Wallet api: Update trustedDaemon when daemon is changed (Jaquee)
dbb838f4 GUI cold signing (Jaquee)
afb85a02 Wallet API: functions for supporting/creating view only wallets (Jaquee)
|
|
5eed5b05 Wallet API: functions for supporting/creating view only wallets (Jaquee)
|
|
|
|
|
|
fix conflict
|
|
|
|
|
|
|
|
60fe1b61 Add parse_uri to wallet2_api (MoroccanMalinois)
|
|
21c5af5a wallet2_api: add an address book payment id lookup API (moneromooo-monero)
|
|
29333c41 wallet api: prevent setting refresh height too high (Jaquee)
|
|
c0a0fcaf wallet2_api: some new APIs to access daemon state (moneromooo-monero)
|
|
|
|
|
|
|
|
|
|
tools::dns_utils; support integrated address with dns lookup
|
|
|
|
4bb0bff2 AddressBook: use unsigned type for row ID's (anonimal)
|
|
+ fixed fast refresh when creating wallet offline
+ improved close wallet logic (make sure refresh thread is stopped)
|
|
Fixes build warnings and may also prevent future headaches.
|
|
third party uses of the wallet api can transition.
|
|
|
|
|
|
f4772bae Fix a few minor typos (Pierre Boyer)
|
|
fcd178ef wallet_api: add a few daemon related getters (moneromooo-monero)
|
|
657a70e0 wallet: add a getter for the filename path (moneromooo-monero)
|
|
|
|
Blockchain height, version, Mining hash rate...
|
|
|
|
Daemon RPC version is now composed of a major and minor number,
so that incompatible changes bump the major version, while
compatible changes can still bump the minor version without
causing clients to unnecessarily complain.
|
|
17b6bd6 Fix DNS failures in offline mode preventing daemon startup (moneromooo-monero)
|
|
5fc36f9 wallet2_api: fix history leak on destruction (moneromooo-monero)
|
|
|
|
|
|
|
|
Wallet API: add approximateBlockChainHeight()
|
|
9150a16 Wallet API: use stored refresh height when rebuilding cache (Jacob Brydolf)
|
|
|
|
|
|
40a68e2 wallet2_api: add API for create_unmixable_sweep_transactions (moneromooo-monero)
|
|
c441a61 wallet2_api: API to sign and verify a message (moneromooo-monero)
|
|
|
|
|
|
0c530de Wallet API: Pause refresh while creating transaction (Jacob Brydolf)
|
|
63fe6fd wallet2_api: allow connection to return "yes, but wrong version" (moneromooo-monero)
|
|
35da3cb Wallet API: added getTxKey() (Jacob Brydolf)
|
|
|
|
eb19492 wallet2_api: do not copy the whole pending tx when iterating (moneromooo-monero)
|
|
97288a5 wallet2_api: add API for tx notes (moneromooo-monero)
|
|
af8a260 wallet_api: txkey checking functions for the GUI (moneromooo.monero)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
m_amount_out was sometimes getting initialized with the sum of
an transaction's outputs, and sometimes with the sum of outputs
that were not change. This caused confusion and bugs. We now
always set it to the sum of outputs. This reverts an earlier
fix for bad amounts as this used the other semantics. The wallet
data should be converted automatically in a percentage of cases
that I'm hesitant to estimate. In any case, restoring from seed
or keys or rebuilding the cache will get it right.
|
|
|
|
|
|
06b642d wallet_api: add address validation functions (moneromooo-monero)
|
|
b6b86ab wallet2_api: recognize full size payment ids as valid (moneromooo-monero)
|
|
2bf65df wallet_api: do not override invalid payment id (moneromooo-monero)
|
|
e76dcdd wallet: improve error messages when not enough money for transfer (moneromooo-monero)
|
|
The payment id from integrated addresses is also parsed
|
|
|
|
Instead, return an empty string to mark the error
|
|
|
|
|
|
|
|
697ce1d libwallet_api: reverted deleted curly brace (Ilya Kitaev)
bb9094f libwallet_api: fixes for transaction history (Ilya Kitaev)
62b3708 libwallet_api: do not signal on sent/received tx until wallet completely synchronized (Ilya Kitaev)
11fab41 libwallet_api: TransactionHistory: read/write syncchronization (Ilya Kitaev)
559f379 libwallet_api: test: adjusted mixin_count=4 as it's minumum allowed (Ilya Kitaev)
8b0cb8c libwallet_api: some renamings (Ilya Kitaev)
db3282c Initialize transaction history if empty (Ilya Kitaev)
85f5e73 libwallet_api: fixes for transaction history (Ilya Kitaev)
|
|
|
|
|
|
|
|
synchronized
|
|
|
|
|
|
|
|
|
|
|
|
65ea836 wallet2_api: added Wallet::daemonBlockChainTargetHeight() libwallet_api: Wallet::blockChainTargetHeight (Jacob Brydolf)
|
|
libwallet_api: Wallet::blockChainTargetHeight
Signed-off-by: Jacob Brydolf <jacob@brydolf.net>
|
|
|
|
|
|
|
|
|
|
|
|
on error
|
|
|
|
|
|
|
|
|
|
|
|
|
|
We keep 1, 2, 3 multipliers till the fee decrase from 0.01/kB
to 0.002/kB, where we start using 1, 20, 166 multipliers.
This ensures the higher multiplier will compensate for the
block reward penalty when pushing past 100% of the past median.
The fee-multiplier wallet setting is now rename to priority,
since it keeps its [0..3] range, but maps to different multiplier
values.
|
|
Saves some substantial space.
Also avoid calculating tx hashes we don't need.
|
|
|
|
|
|
|
|
|
|
|
|
This plugs a privacy leak from the wallet to the daemon,
as the daemon could previously see what input is included
as a transaction input, which the daemon hadn't previously
supplied. Now, the wallet requests a particular set of
outputs, including the real one.
This can result in transactions that can't be accepted if
the wallet happens to select too many outputs with non standard
unlock times. The daemon could know this and select another
output, but the wallet is blind to it. It's currently very
unlikely since I don't think anything uses non default
unlock times. The wallet requests more outputs than necessary
so it can use spares if any of the returns outputs are still
locked. If there are not enough spares to reach the desired
mixin, the transaction will fail.
|
|
d7597c5 refreshing wallet even if error happened (Ilya Kitaev)
6d32a3d wallet_api: async init, Wallet::connected status, log level (Ilya Kitaev)
193d251 libwallet_api cmake: conditionally creating libwallet_merged2 only for STATIC build (Ilya Kitaev)
10c06dd wallet_api: segfault on refresh fixed (Ilya Kitaev)
9d2cb4f WalletListener functionality (Ilya Kitaev)
d27b883 hack to successfull linking for MSYS2 (Ilya Kitaev)
083380c Transaction fee multiplier aka priority integraged (Ilya Kitaev)
00ed12b Wallet::paymentIdValid (Ilya Kitaev)
|
|
|
|
|
|
STATIC build
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|