Skip to main content

DLSAG: Non-interactive Refund Transactions for Interoperable Payment Channels in Monero

Part of the Lecture Notes in Computer Science book series (LNSC,volume 12059)


Monero has emerged as one of the leading cryptocurrencies with privacy by design. However, this comes at the price of reduced expressiveness and interoperability as well as severe scalability issues. First, Monero is restricted to coin exchanges among individual addresses and no further functionality is supported. Second, transactions are authorized by linkable ring signatures, a digital signature scheme used in Monero, hindering thereby the interoperability with virtually all the rest of cryptocurrencies that support different digital signature schemes. Third, Monero transactions require an on-chain footprint larger than other cryptocurrencies, leading to a rapid ledger growth and thus scalability issues.

This work extends Monero expressiveness and interoperability while mitigating its scalability issues. We present Dual Linkable Spontaneous Anonymous Group Signature for Ad Hoc Groups (DLSAG), a linkable ring signature scheme that enables for the first time non-interactive refund transactions natively in Monero: DLSAG can seamlessly be implemented along with other cryptographic tools already available in Monero such as commitments and range proofs. We formally prove that DLSAG provides the same security and privacy notions introduced in the original linkable ring signature  [29] namely, unforgeability, signer ambiguity, and linkability. We have evaluated DLSAG and showed that it imposes even slightly lower computation and similar communication overhead than the current digital signature scheme in Monero, demonstrating its practicality. We further show how to leverage DLSAG to enable off-chain scalability solutions in Monero such as payment channels and payment-channel networks as well as atomic swaps and interoperable payments with virtually all cryptocurrencies available today. DLSAG is currently being discussed within the Monero community as an option for adoption as a key building block for expressiveness, interoperability, and scalability.

A. Blue—Independent Researcher.

This is a preview of subscription content, access via your institution.

Buying options

USD   29.95
Price excludes VAT (USA)
  • DOI: 10.1007/978-3-030-51280-4_18
  • Chapter length: 21 pages
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
USD   109.00
Price excludes VAT (USA)
  • ISBN: 978-3-030-51280-4
  • Instant PDF download
  • Readable on all devices
  • Own it forever
  • Exclusive offer for individuals only
  • Tax calculation will be finalised during checkout
Softcover Book
USD   139.99
Price excludes VAT (USA)
Fig. 1.
Fig. 2.
Fig. 3.
Fig. 4.


  1. 1.

    Monero in fact uses a matrix version of LSAG (MLSAG)  [37] to prove balance without revealing spent ring members. We describe here the simplest LSAG version but our constructions can be trivially extended to support matrix version.

  2. 2.

    The One-More Discrete Logarithm hardness assumption is defined in  [13].


  1. Cryptonote currencies.


  3. Libsodium documentation.

  4. Monero monthly blockchain growth.

  5. Payment channels.

  6. Raiden network.

  7. Research meeting, 17:00 UTC, 18 March 2019.

  8. Understanding the structure of Monero’s LMDB and how explore its contents using mdb\_stat.

  9. What is Fungibility?

  10. DLSAG prototype numbers (2019).

  11. Androulaki, E., Karame, G.O., Roeschlin, M., Scherer, T., Capkun, S.: Evaluating user privacy in Bitcoin. In: Sadeghi, A.-R. (ed.) FC 2013. LNCS, vol. 7859, pp. 34–51. Springer, Heidelberg (2013).

    CrossRef  Google Scholar 

  12. Barber, S., Boyen, X., Shi, E., Uzun, E.: Bitter to better—how to make Bitcoin a better currency. In: Keromytis, A.D. (ed.) FC 2012. LNCS, vol. 7397, pp. 399–414. Springer, Heidelberg (2012).

    CrossRef  Google Scholar 

  13. Bellare, Namprempre, Pointcheval, Semanko: The one-more-RSA-inversion problems and the security of Chaum’s blind signature scheme. J. Cryptology 16(3), 185–215 (2003).

  14. Bender, A., Katz, J., Morselli, R.: Ring signatures: stronger definitions, and constructions without random oracles. In: Halevi, S., Rabin, T. (eds.) TCC 2006. LNCS, vol. 3876, pp. 60–79. Springer, Heidelberg (2006).

    CrossRef  Google Scholar 

  15. Bowe, S., Hopwood, D.: Hashed time-locked contract transactions (2017).

  16. Bünz, B., Bootle, J., Boneh, D., Poelstra, A., Wuille, P., Maxwell, G.: Bulletproofs: short proofs for confidential transactions and more. In: S&P, pp. 315–334 (2018)

    Google Scholar 

  17. Chase, M., et al.: Post-quantum zero-knowledge and signatures from symmetric-key primitives (2017).

  18. Croman, K., et al.: On scaling decentralized blockchains. In: Clark, J., Meiklejohn, S., Ryan, P.Y.A., Wallach, D., Brenner, M., Rohloff, K. (eds.) FC 2016. LNCS, vol. 9604, pp. 106–125. Springer, Heidelberg (2016).

    CrossRef  Google Scholar 

  19. Decker, C., Wattenhofer, R.: A fast and scalable payment network with Bitcoin duplex micropayment channels. In: Pelc, A., Schwarzmann, A.A. (eds.) SSS 2015. LNCS, vol. 9212, pp. 3–18. Springer, Cham (2015).

    CrossRef  Google Scholar 

  20. Diffie, W., Hellman, M.: New directions in cryptography. IEEE Trans. Inf. Theor. 22(6), 644–654 (2006)

    CrossRef  MathSciNet  Google Scholar 

  21. Fiat, A., Shamir, A.: How to prove yourself: practical solutions to identification and signature problems. In: Odlyzko, A.M. (ed.) CRYPTO 1986. LNCS, vol. 263, pp. 186–194. Springer, Heidelberg (1987).

    CrossRef  Google Scholar 

  22. Goldreich, O., Micali, S., Wigderson, A.: Proofs that yield nothing but their validity or all languages in NP have zero-knowledge proof systems. JACM 38(3), 691–729 (1991)

    CrossRef  MathSciNet  Google Scholar 

  23. Goodell, B., Noether, S.: Thring signatures and their applications to spender-ambiguous digital currencies. Cryptology ePrint Archive, Report 2018/774, 2018.

  24. Green, M., Miers, I.: Bolt: Anonymous payment channels for decentralized currencies. In: CCS, pp. 473–489 (2017)

    Google Scholar 

  25. Khalil, R., Gervais, A.: Revive: rebalancing off-blockchain payment networks. In: CCS, pp. 439–453 (2017)

    Google Scholar 

  26. Koshy, P., Koshy, D., McDaniel, P.: An analysis of anonymity in Bitcoin using P2P network traffic. In: Christin, N., Safavi-Naini, R. (eds.) FC 2014. LNCS, vol. 8437, pp. 469–485. Springer, Heidelberg (2014).

    CrossRef  Google Scholar 

  27. Kumar, A., Fischer, C., Tople, S., Saxena, P.: A traceability analysis of Monero’s blockchain. In: Foley, S.N., Gollmann, D., Snekkenes, E. (eds.) ESORICS 2017. LNCS, vol. 10493, pp. 153–173. Springer, Cham (2017).

    CrossRef  Google Scholar 

  28. Libert, B., Peters, T., Qian, C.: Logarithmic-size ring signatures with tight security from the DDH assumption. In: Lopez, J., Zhou, J., Soriano, M. (eds.) ESORICS 2018. LNCS, vol. 11099, pp. 288–308. Springer, Cham (2018).

    CrossRef  Google Scholar 

  29. Liu, J.K., Wei, V.K., Wong, D.S.: Linkable spontaneous anonymous group signature for Ad Hoc groups. In: Wang, H., Pieprzyk, J., Varadharajan, V. (eds.) ACISP 2004. LNCS, vol. 3108, pp. 325–335. Springer, Heidelberg (2004).

    CrossRef  Google Scholar 

  30. Malavolta, G., Moreno-Sanchez, P., Kate, A., Maffei, M., Ravi, S.: Concurrency and privacy with payment-channel networks. In: CCS, pp. 455–471 (2017)

    Google Scholar 

  31. Malavolta, G., Moreno-Sanchez, P., Schneidewind, C., Kate, A., Maffei, M.: Anonymous multi-hop locks for blockchain scalability and interoperability. In: NDSS, January 2019

    Google Scholar 

  32. Maxwell, G., Poelstra, A., Seurin, Y., Wuille, P.: Simple schnorr multi-signatures with applications to Bitcoin. Cryptology ePrint Archive, Report 2018/068, 2018.

  33. Meiklejohn, S., et al.: A fistful of Bitcoins: characterizing payments among men with no names (IMC 2013). In: IMC, pp. 127–140 (2013)

    Google Scholar 

  34. Moreno-Sanchez, P., Randomrun, Le, D.V., Noether, S., Goodell, B., Kate, A.: DLSAG: non-interactive refund transactions for interoperable payment channels in monero. Cryptology ePrint Archive, Report 2019/595, 2019.

  35. Möser, M., et al.: An empirical analysis of traceability in the Monero blockchain. PETS 2018(3), 143–163 (2018)

    Google Scholar 

  36. Noether, S., Goodel, B.: Dual linkable ring signatures.

  37. Noether, S., Mackenzie, A.: Ring confidential transactions. Ledger 1, 1–18 (2016)

    CrossRef  Google Scholar 

  38. Pedersen, T.P.: Non-interactive and information-theoretic secure verifiable secret sharing. In: Feigenbaum, J. (ed.) CRYPTO 1991. LNCS, vol. 576, pp. 129–140. Springer, Heidelberg (1992).

    CrossRef  Google Scholar 

  39. Poelstra, A.: Lightning in scriptless scripts (2017).

  40. Poelstra, A.: Scriptless scripts (2017).

  41. Poon, J., Dryja, T.: The Bitcoin Lightning Network. Whitepaper (2016).

  42. Reid, F., Harrigan, M.: An analysis of anonymity in the Bitcoin system. In: Altshuler, Y., Elovici, Y., Cremers, A., Aharony, N., Pentland, A. (eds.) Security and Privacy in Social Networks. Springer, New York (2013)

    Google Scholar 

  43. Rusty: Lightning Networks Part II: Hashed Timelock Contracts (HTLCs) (2015).

  44. van Saberhagen, N.: Cryptonote v 2.0. Whitepaper (2013).

  45. Schnorr, C.P.: Efficient signature generation by smart cards. J. Cryptology 4(3), 161–174 (1991).

    CrossRef  MathSciNet  MATH  Google Scholar 

  46. Spagnuolo, M., Maggi, F., Zanero, S.: BitIodine: extracting intelligence from the Bitcoin network. In: Christin, N., Safavi-Naini, R. (eds.) FC 2014. LNCS, vol. 8437, pp. 457–468. Springer, Heidelberg (2014).

    CrossRef  Google Scholar 

Download references


This work has been partially supported by the Austrian Science Fund (FWF) through the Lisa Meitner program and by the National Science Foundation under grant CNS-1846316.

Author information

Authors and Affiliations


Corresponding author

Correspondence to Pedro Moreno-Sanchez .

Editor information

Editors and Affiliations

Rights and permissions

Reprints and Permissions

Copyright information

© 2020 International Financial Cryptography Association

About this paper

Verify currency and authenticity via CrossMark

Cite this paper

Moreno-Sanchez, P., Blue, A., Le, D.V., Noether, S., Goodell, B., Kate, A. (2020). DLSAG: Non-interactive Refund Transactions for Interoperable Payment Channels in Monero. In: Bonneau, J., Heninger, N. (eds) Financial Cryptography and Data Security. FC 2020. Lecture Notes in Computer Science(), vol 12059. Springer, Cham.

Download citation

  • DOI:

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-51279-8

  • Online ISBN: 978-3-030-51280-4

  • eBook Packages: Computer ScienceComputer Science (R0)