xmr.irish · v5.0

MODELeducational models of protocol behaviour — not live chain data

Privacy primitive

Future protocol

Consensus

Economics

MONERO PROTOCOL · 01 · RING SIGNATURES · CLSAG

Decoy selection — 16 statistical twins

The signer chooses 15 decoys from the chain's own UTXO set, weighted toward recent ages. From the verifier's seat, none of the 16 is distinguishable from any other.

Ring 16gamma over log-age · model approxReady

FIG. 01 · TIME TIDE · DENSITY CURVE = SAMPLING WEIGHT

SPOTLIGHT TEST — pick the real spender

#00

#01

#02

#03

#04

#05

#06

#07

#08

#09

#10

#11

#12

#13

#14

#15

Verifier sees: 16 valid signaturesP(spotting real spender) → 1/16

What you're seeing

The curve is the sampling density. The buoys are 16 UTXOs the wallet pulled up from the chain. One of them is the real spender. Fifteen are statistical doppelgängers.

Monero samples each ring member from a gamma distribution applied to the log of output age (wallet2's gamma_picker, shape ≈ 19.28, rate ≈ 1.61) — heavy near recent outputs, where most real spends occur, tapering into older ones. The curve drawn here is a log-space approximation of that shape, not the wallet's exact sampler. The intent is that the distribution matches real spending behaviour, so the true spender's age is always somewhere on the wave the verifier already expects — whether it actually does is the open question OSPEAD studies.

Parameters

Ring size16

Wallet samplergamma(19.28, 1.61)

Drawn herelog-space approx

True spender age7d

Anonymity set16

P(guess)1/16 ≈ 6.25%

Sampling procedure

Sample 15 ages

From the gamma picker over log-age. Most land in the last week.

Resolve to UTXOs

Pick a random output that existed at each sampled age.

Shuffle

Mix the real spender in among the 15. Order is uniform.

Sign ring

CLSAG — one of the 16 keys produces a valid signature.

Cracks in the wall: heuristic analysis can sometimes shift probability away from 1/16 toward a smaller set (output-age outliers, multi-input pattern matching). FCMP++ retires this surface entirely — see F6 · FCMP++.

And here's what's wrong with it: this whole mechanism rests on the decoy distribution matching how outputs are really spent. Monero Research Lab's OSPEAD work asks whether it does. Open the OSPEAD simulator →

Simulate · Decoy selection