Advanced

The Math of Monero Quiz (Advanced)

Comparative cryptography across blockchains. Test whether you can tell shared math from per-chain choices, and explain exactly how Monero hides what transparent chains reveal.

Covers material from The Math of Monero: Cryptography Across Blockchains.

Create a free account or log in to save your quiz scores and track your progress.

What single mathematical assumption do Bitcoin, Ethereum and Monero all stake their key security on?

Finding hash collisions on a 256-bit digest is hard The elliptic-curve discrete-logarithm problem is hard Factoring the product of two large primes is hard Bilinear pairings on the curve are efficiently computable

Ethereum and Monero both hash with Keccak, yet integrators are warned they are not interchangeable with 'SHA-3'. Why?

SHA-3 is a sponge while Keccak is Merkle–Damgård, giving different outputs Monero salts every Keccak call with the block height Ethereum truncates Keccak to 160 bits while Monero keeps 256 They use the original Keccak padding, which differs from standardized SHA-3

Why does Monero use the twisted-Edwards curve Ed25519 instead of Bitcoin's secp256k1?

It offers a larger field, so private keys carry more bits of security It is a pairing-friendly curve, which Monero's commitments require It has cofactor 1, eliminating the torsion issues secp256k1 suffers Its complete, constant-time addition law makes privacy primitives safer to implement

On a transparent chain an ECDSA signature is checked against one named public key. What does Monero replace this with to hide the spender, and what new problem does that create?

A zk-SNARK over the whole transaction, which then needs a trusted setup A ring signature (hides which key signed), which then needs key images to stop double-spends A blinded ECDSA signature, which then needs the verifier to learn the blinding factor A multisignature across decoys, which then needs threshold key recovery

For a standard output the sender sets the one-time key P = Hs(r·A)·G + B and publishes R = r·G. How does the recipient recognize and later spend it?

Detect by matching R against B directly; spend with x = r + b Detect with the view key; spend using r, which the sender encrypts to the recipient Detect with the view key via a·R = r·A; spend with x = Hs(a·R) + b, needing b Detect with the spend key via b·R; spend with x = Hs(b·R) + a, needing a

A key image is I = x·Hp(P), using hash-to-point rather than a fixed multiple of G. Why is Hp(P) essential?

Hash-to-point makes the key image fit in 32 bytes; c·G would not Hp(P) lets the verifier recover P from I to confirm ownership Using c·G would let two different outputs share one key image A known multiple of G would make I = c·P, linking the image to the output

In RingCT an amount is committed as C = x·G + a·H, where H = Hp(G). Why must nobody know the discrete log of H with respect to G?

Otherwise commitments could no longer be added together homomorphically Otherwise the commitment could be opened to a different amount, breaking binding Otherwise the amount a could be read directly off C, breaking hiding Otherwise the blinding factor x would leak through the view key

Pedersen commitments already hide amounts and let nodes verify Σinputs = Σoutputs. Why are Bulletproofs+ range proofs still required?

To prove each hidden amount is in range [0, 2^64), preventing overflow/inflation To compress the commitments so the transaction stays small To prove the input and output commitments use the same generator H To prove the signer knows the blinding factor of each commitment

Zcash and Monero both hide sender, receiver and amount. What is the core assumption-and-trust trade-off between their approaches?

Zcash: discrete-log only; Monero: pairing assumptions plus a trusted ceremony Zcash: smaller proofs but trusted setup + pairing assumptions; Monero: bigger txs but only discrete-log and no trusted setup Both rely on identical assumptions; they differ only in block time and supply Zcash: no trusted setup but weaker hiding; Monero: trusted setup but mandatory privacy

Q10

Why does Monero making privacy MANDATORY for every transaction strengthen anonymity beyond what the per-transaction math alone provides?

Every output becomes a plausible decoy, so the anonymity set is the whole user base It forces all amounts to be identical, removing amount-based fingerprints Mandatory privacy lets the protocol use a smaller, faster ring without weakening it It allows the network to discard spent outputs, shrinking the chain analysts can study

🎓 Graduate from Monero Academy

Create a free account, ace every quiz across all courses, and earn your place on the Graduates wall — with your own Monero address for donations. An account also tracks your progress through the courses, and graduating is the prize for finishing.

Create free account How it works