Key Image

What Is a Key Image?

A key image is a cryptographic construct introduced by the CryptoNote protocol and used most prominently in Monero. When a user spends an output, their wallet computes a deterministic, one-way value from the output's private key. This value is the key image. It is included in the transaction and permanently recorded on the blockchain.

The key image serves a single critical purpose: it lets the network detect if the same output is being spent twice without revealing which output in the ring signature is the real one. In transparent blockchains like Bitcoin, double-spend prevention is straightforward because every node can see exactly which UTXO is being consumed. In a privacy-focused system where the real input is hidden among decoys, a different mechanism is required. Key images are that mechanism.

The concept was first described in the CryptoNote v2.0 whitepaper (attributed to Nicolas van Saberhagen, 2013) as part of the one-time ring signature scheme. It was first deployed in Bytecoin (2012) and later adopted by Monero, which remains its most widely used implementation.

How It Works

The key image construction relies on elliptic curve cryptography and a special hash function that maps curve points to other curve points. The formula is:

I = x * Hp(P)

Where:
  I  = the key image (a point on Edwards25519)
  x  = the one-time private spend key for the output
  P  = the corresponding one-time public key (P = x * G)
  G  = the Edwards25519 base point
  Hp = a deterministic hash-to-point function

This construction has several properties that make it suitable for double-spend prevention in a privacy system:

• Deterministic: the same private key always produces the same key image, regardless of which decoys are chosen for the ring
• One-way: it is computationally infeasible to recover the private key from the key image
• Unique per output: each one-time private key maps to exactly one key image
• Unlinkable: observing the key image on the blockchain does not reveal which public key it corresponds to

Verification in Ring Signatures

When a user creates a ring signature to spend an output, the key image is embedded in the signature itself. During verification, the network checks two parallel sets of equations for each ring member. These equations confirm that:

1. The signer knows the discrete logarithm of one of the public keys in the ring (proving ownership)
2. The key image was correctly derived from that same private key (linking the key image to the real signer without revealing which one it is)

The network then checks its database of all previously seen key images. If the key image already exists, the transaction is rejected. If it is new, the transaction is accepted and the key image is added to the permanent set.

Step-by-Step Spending Process

1. The wallet identifies the output to spend and retrieves its one-time private key (x)
2. It computes the key image: I = x * Hp(P)
3. It selects decoy outputs from the blockchain to form a ring (Monero currently uses 16 ring members including the real one)
4. It constructs a ring signature that proves knowledge of one private key in the ring without revealing which one
5. The transaction, including the key image, is broadcast to the network
6. Nodes verify the ring signature and check the key image against the spent key image database
7. If the key image is new and the signature is valid, the transaction is accepted

Comparison with Bitcoin's UTXO Model

Understanding key images becomes clearer when contrasted with how Bitcoin handles double-spend prevention. Bitcoin uses a fully transparent UTXO model:

Bitcoin's transparency makes double-spend prevention trivial but sacrifices privacy. Monero's key image approach preserves privacy but introduces permanent storage overhead as the cost. This is a fundamental design tradeoff, not an implementation limitation: you cannot prune a key image when you don't know which output it corresponds to.

Why It Matters

Key images are essential to understanding how privacy-preserving blockchains work at a cryptographic level. They represent one solution to a problem that every digital cash system must solve: preventing users from spending the same money twice. In transparent systems, this is trivially solved by making all transactions visible. In privacy systems, more sophisticated cryptography is required.

The concept also illustrates broader tradeoffs in blockchain design. Privacy comes with costs: increased storage requirements, more complex verification, and new attack surfaces. Different projects make different tradeoffs along this spectrum. Fungibility advocates argue that privacy is essential for money to function properly, since without it, some coins become "tainted" and worth less than others. Transparency advocates counter that auditability is valuable for regulatory compliance and network integrity.

For Bitcoin-based systems, privacy is typically achieved through different mechanisms. Layer 2 solutions like Lightning and Spark provide transaction privacy by moving activity off the main chain, while techniques like CoinJoin and silent payments enhance on-chain privacy without requiring the permanent storage overhead of a key image scheme.

Use Cases

Monero and CryptoNote-Based Coins

Key images are foundational to Monero's transaction model. Every Monero transaction includes at least one key image (one per input), and the Monero network maintains a complete database of all key images ever used. As of 2026, this includes tens of millions of key images accumulated over a decade of operation.

Other CryptoNote-derived coins that use key images include Wownero, Zano, and Conceal (CCX). Each inherits the same basic key image construction from the CryptoNote specification, though implementations may vary in ring size and other parameters.

FCMP++: The Next Evolution

Monero's most significant protocol upgrade in recent years is FCMP++ (Full-Chain Membership Proofs++). This replaces traditional ring signatures (which used a fixed set of 16 decoys) with zero-knowledge membership proofs that prove the spent output exists among all outputs on the chain (over 100 million). Key images are retained under FCMP++ for double-spend prevention; only the ring signature scheme changes.

FCMP++ also introduces forward-secret outputs, which protect against future adversaries with quantum-capable discrete logarithm oracles. Even such an adversary could not compute the key image of an unspent forward-secret output, providing a defense against post-quantum threats.

Academic Research and Analysis

Key images have been the subject of significant academic study, particularly in the areas of blockchain analysis and privacy evaluation. Researchers have used key image data to study transaction patterns, evaluate the effective anonymity set of ring signatures, and identify weaknesses in early ring construction algorithms. This research has directly influenced improvements to Monero's decoy selection algorithm and the eventual move toward full-chain membership proofs.

Risks and Considerations

Permanent Storage Growth

The key image database grows monotonically with every transaction processed and can never be pruned. Each key image is 32 bytes (a compressed Edwards25519 curve point), and the set must be complete for consensus validation. While Monero supports blockchain pruning that removes old transaction proofs, the key image set itself is exempt from pruning. The full Monero blockchain is approximately 250 GB, with pruned nodes requiring around 100 GB: both include the complete key image database.

Hard Fork Key Image Reuse

When a CryptoNote-based blockchain undergoes a contentious hard fork, users who hold coins on both chains face a subtle privacy leak. If they spend the same output on both chains, the same key image appears on both. An observer monitoring both chains can correlate these key images to narrow down which ring member was the real signer, effectively deanonymizing the transaction.

This attack has been studied in practice. Researchers analyzing Monero's 2017 hard fork (which produced Monero Classic, Monero Original, and other forks) found that key image reuse across chains significantly degraded the privacy of users who spent on multiple forks.

Exchange-Assisted Deanonymization

Centralized exchanges that comply with KYC/AML regulations know which outputs they own. When those outputs are spent, the exchange knows the corresponding key image. Over time, an exchange (or an entity collaborating with multiple exchanges) could build a database mapping key images to real outputs, progressively eroding the effective anonymity set for other users whose transactions included exchange-owned decoys.

Statistical Analysis of Ring Composition

While key images themselves do not leak information about the real signer, patterns in ring construction can. Early versions of Monero used small ring sizes and naive decoy selection algorithms, which allowed researchers to statistically identify the real input in many transactions. Modern Monero uses a ring size of 16 with a gamma distribution for decoy age selection, and FCMP++ eliminates the problem entirely by using the full output set.

No Trusted Setup Required

One advantage of key images over some alternative privacy mechanisms: they require no trusted setup ceremony. Zcash's original zk-SNARKs required a multi-party computation ceremony to generate parameters; if that ceremony were compromised, undetectable inflation would be possible. Key images derive their security purely from the hardness of the elliptic curve discrete logarithm problem, with no external trust assumptions beyond the underlying elliptic curve cryptography.

This glossary entry is for informational purposes only and does not constitute financial or investment advice. Always do your own research before using any protocol or technology.