Crypto glossary
Ring signature
A ring signature proves that one member of a group of public keys signed a message without revealing which one; Monero has used it to hide transaction senders.
Described by Ron Rivest, Adi Shamir and Yael Tauman in 2001, a ring signature is created by one signer using their own private key plus the public keys of other users, called decoys. A verifier can confirm that one of the keys in the ring produced the signature but cannot tell which. Unlike group signatures, there is no manager who can reveal the signer.
Monero, built on the CryptoNote protocol, applies ring signatures to every transaction: each input is signed with a ring that mixes the real output being spent with decoy outputs from the blockchain, 16 members in total since 2022. Key images, unique tags derived from the real key, prevent the same output from being spent twice without revealing which one it was. Combined with stealth addresses and hidden amounts, this makes Monero transactions far harder to trace than Bitcoin's.
Privacy depends on decoy selection: researchers have shown that poorly chosen decoys, such as ones much older than typical spends, can let analysts guess the real input. Larger rings cost more space and verification time. Monero's planned FCMP++ upgrade is designed to replace rings with proofs over the entire set of outputs. Regulatory pressure has led many exchanges to delist privacy coins.
Example
When a Monero user pays a merchant, their input is signed with a ring of 16 possible outputs; the blockchain shows the payment is valid, but observers cannot tell which of the 16 was actually spent.