How Ring Signatures Hide the Sender in Monero Transactions

02 September 2026

A ring signature is not a Monero invention. The concept was described by cryptographers in 2001. Monero adopted it and made it the backbone of its privacy model. Ring signatures solve a specific problem: how to prove you are one of several possible signers without revealing which one.

Consider how a transparent blockchain works. Bitcoin shows every input and every output, each input being a prior output, so the chain of ownership is visible to anyone. If you send bitcoin from address A to address B, the network sees that A paid B. Anyone can follow the link. That is the default model Monero rejects.

The decoy selection process

A Monero wallet does not spend a single output alone. It gathers a set of past outputs from the blockchain. These are decoys - real transactions that happened at different times, sent by different people. The wallet picks them algorithmically, trying to select outputs whose age and amount distribution resemble the real output. The goal is to make the decoys look plausible.

The wallet then constructs a ring: a list of outputs where one is the actual output the sender controls and the rest are decoys. The ring size determines how many outputs appear in the list. A ring size of 11 means one real output and ten decoys. The wallet signs a message using a ring signature scheme. The signature proves that someone in the ring authorized the transaction, but it does not reveal which member.

How the math works

The ring signature uses a combination of public keys and a hash function. Each output in the ring has a public key; the signer knows the private key for exactly one of those outputs. The algorithm allows the signer to produce a signature that is verifiable against the entire set of public keys. An observer can check that the signature is valid for the ring. The observer cannot determine which public key corresponds to the actual signer.

This is fundamentally different from a standard digital signature. In a standard signature, the public key of the signer is known and the signature is bound to that specific key. In a ring signature, the signature is bound to a set - the ring itself. Without the private key of the real output, an attacker cannot tell which member owns it.

The key image solution

Ring signatures create a second problem. If no one can tell which output is real, a user could sign the same output in two different rings. That would be a double spend. The network would see two valid transactions spending the same output, but could not identify them as the same output because the rings are different.

Monero solves this with a key image. A key image is a cryptographic value derived from the private key of the real output, included in every transaction. The network checks that no key image has been used before; if one appears twice, the second transaction is rejected. The key image does not reveal which output in the ring is real. It only proves that the same output was not spent twice. The unlinkability of the transaction is preserved because the key image is not tied to a specific public key in the ring. It is a separate piece of data.

The misconception about ring size

A common belief is that bigger rings mean more privacy. That is only partially true. A larger ring makes it harder for an attacker to guess which output is real by random chance. If the ring size is 5, the real output has a 20 percent chance of being guessed. At 11, that drops to about 9 percent. At 100, it is 1 percent. The probability decreases.

But ring size is not the only factor. The selection of decoys matters more. If the decoys are old and the real output is recent, an attacker can look at the timestamps and narrow down which outputs could possibly be the real one. The same logic applies to amounts. If the real output is 10 XMR and all decoys are 0.01 XMR, the ring is useless: the network sees 11 outputs where 10 amounts are tiny and one is large, making the real output obvious.

Monero addressed this with Bulletproofs and later with the introduction of range proofs that hide amounts entirely. Since the 2018 protocol upgrade, transaction amounts are encrypted - the ring still shows the outputs but the amounts are hidden. That makes decoy selection less critical for amount privacy. The timing of decoys remains important. The current Monero wallet software uses a more sophisticated algorithm to select decoys that statistically resemble the real output. It is not perfect, but it is better than random selection.

What the transparent model cannot do

On a transparent blockchain, every input is traceable. There is no ambiguity. The sender is known because the output they spend is known. A ring signature introduces deliberate ambiguity, forcing an observer to consider multiple possibilities. That ambiguity is the entire point. The cryptographic proof does not remove the ambiguity; it confirms that one of the possibilities is correct, without specifying which one.

The trade-off is size. A ring signature is larger than a standard signature. More decoys mean more data in the transaction, and more data means higher fees and longer verification times. That is why Monero does not use arbitrarily large rings. The protocol caps the ring size at a reasonable number, currently 16 for most transactions. The developers believe this balances privacy and efficiency.

Ring signatures are not a privacy panacea. They protect the sender. They do not protect the recipient unless the recipient uses a separate address, which Monero does with stealth addresses. They do not protect the transaction amount unless the protocol hides it, which Monero does. The combination of ring signatures, stealth addresses, and encrypted amounts is what makes Monero private. Ring signatures alone would not be enough.

Back to privacy coins