What is ring signature?

A signature that proves one member of a group signed, without revealing which.

Monero uses this so a spend names several possible source outputs and an observer cannot tell which was really consumed, giving sender ambiguity by default rather than as an option (source: the Monero project documentation). It addresses only the sender; amounts and recipients are hidden by separate mechanisms.

The construction is worth understanding because it shows what privacy on a public ledger actually requires. The transaction is still published, still verified by everyone, and still permanently recorded. What changes is that the record does not identify which of several candidates was spent.

How it works

1. Assemble a ring. The spender's real output is placed alongside several decoy outputs drawn from the chain's history. All appear on equal footing.
2. Sign for the ring. The signature proves that the signer holds the key for one member, without revealing which one. Verification confirms validity; it does not identify the source.
3. Prevent double spending with a key image. Each output produces a unique value derived from its key. The network rejects any transaction whose key image has appeared before, so an output cannot be spent twice even though nobody knows which output it was.
4. Hide the rest separately. Recipients are protected by stealth addresses and amounts by commitment schemes. Ring signatures alone do not conceal either.

Two design details matter. Decoy selection quality is critical: if decoys are drawn poorly, or if the same output appears across many rings, statistical analysis can narrow the candidates. And ring size is fixed by the protocol rather than chosen by the user, so every transaction looks alike (source: the Monero project documentation). Software offering to shrink the ring is not following the rules.

Example

Illustrative. A spend names sixteen possible source outputs, one real and fifteen decoys. An observer examining the chain sees a valid transaction and sixteen candidates, each of which could be the one spent, and has no way to distinguish them from the signature alone.

Compare that with a transparent chain. There, the spend names exactly one previous output, and following it backwards through history is a matter of reading. Both transactions are equally public and equally verifiable. The difference is entirely in what a third party can reconstruct afterwards, which is why analysis firms treat the two ledger types so differently.

Why it matters when you buy

For assets using this design, the deciding question is almost never the cryptography. It is whether any exchange serving your jurisdiction lists the asset, and whether a current listing survives the next supervisory cycle. The jurisdiction pages record what each place permits, Buyability grades availability, and why you cannot buy this coin covers the causes.

Related terms

privacy coin — the asset category this defines; stealth address — hides the recipient instead; shielded transaction — the opt-in alternative approach; view key — selective disclosure to an auditor; chain analysis — what the design resists; delisting — the main availability risk.

Questions

Does a ring signature hide the amount too?

No. It provides sender ambiguity only. Amounts are concealed by separate commitment schemes and recipients by stealth addresses, so protecting a transaction takes all three working together.

Can the real signer ever be identified?

Not from the signature itself. Weakness comes from context: poor decoy selection, outputs reused across many rings, or information leaked off chain by an exchange or a wallet's network behavior.

Why can users not choose a larger ring?

Because uniformity is protection. If ring sizes varied, the choice itself would be a distinguishing signal, so the protocol fixes it and every transaction is shaped the same way.