Hello guys, I have a question on the monero tx. Do you know whether the "public key" in one tx's output will get reused when the public key owner receiving another tx, and is it a real public key from the private key?

What you are asking is unclear. You might have been asking "can an output public key be reused on the chain be reused ?". If so, then yes, if the sender sends to the same recipient with the same tx secret key (which would be dumb).

If it appears in the key image, is it means that the public key owner maybe the sender of the tx?

"is it a real public key from the private key?" => "it is a public key directly generated by ECDSA or get any additional encryption on the raw public key like btc address?"

You're too unclear. I thought you were on about output public keys. If you're on about key images, make your question precise.

But duplicate key images will not be accepted on the chain.

Duplicate pubkeys would cause duplicate key images too, if that's what you were asking.,

I'm sorry. I just want to ensure that whether the sender's public key will get leaked in the key image's Public Key list, for example in localmonero.co/blocks/tx/7d1d98cebf…5298fcc0636da23e6a219ba0fac355e6011 expand the key image there is a d21ff... public key, is this key maybe belongs the the sender of this tx?

sorry, a944e... public key, not d21ff...(this is the key image)

A key image belongs to an output. The key image is different from the output pubkey.

If you have a key image, it will belong to someone, yes. But from that key image, you can't get either the output pubkey it's from nor the wallet address it was created for.

At most, you can get a set of 11 (usually) output pubkeys it might correspond to.

Thanks for your clear answer!

Btw there is one advantage to Seraphis that I forgot about (this applies to the address-friendly Seraphis adjustment as well). Multisig participants can create key images, so they can do full balance recovery without tedious interactions to reconstruct key images.

is that same for view key holders of non-ms?

Seraphis allows a lot of different wallet permission schemes, but in the address-friendly adjustment anyone with the private view key can do full balance recovery.

It's less of an 'adjustment' and more like an a different protocol - but the two protocols use similar concepts.

Seraphis github: github.com/UkoeHB/Seraphis

I welcome comments/feedback, help on security proofs/models/etc. Ping for: coinstudent2048[

blinding should be binding throughout

?

they are not "blinding factors" but "binding factors"

commitments are bound, not blinded.

Please search for the word 'blinding' in this paper and note its first appearance: web.stanford.edu/~buenz/pubs/bulletproofs.pdf

your paper uses "blinding" 10 times. The fact other papers make the same mistake is besides the point. Just a recommendation to use the correct terminology.

Can you provide a source that 'binding' is the correct term?

(one of many)

there's no "binding factor" there

computation binding is a property of pedersen commitments

blinding factor is a common term for the... blinding factor

"this is called the binding property"

_property_ not _factor_

One binds a commitment, and it (in a pedersen commitment) is computationaly binding.

it's bound via DL problem, and unconditionally hidden via the ... factor

yeah 'blinding factor' seems a pretty common term, but I don't see 'binding factor' used anywhere

fair enough

the original CT text calls it that too

it's a great well written draft in any case, so thank you

🙏

Binding is a property of a commitment construction. Pedersen commitment masks are often called blinding factors

TBH it's an unfortunate choice of terms, since they sound so similar...

We could just change to bounding and bending.

bonding. blending.

Forked it. Don't expect too much, I messed up some math in the Lounge before 😊... but I do what I can.

I'd be happy to hear your thoughts