Update 2024-12-04-Monero.md

Author: RisenCrypto

_posts/2024-12-04-Monero.md

@@ -367,17 +367,32 @@ $P_o = K_{dh}  G + S_b$
 
 $R = r G$
 
-Instead of sending money to Bob's address as done in BTC, Alice sends the money to $P_o$ & also broadcasts $R$ to the network.
+Instead of sending money to Bob's address as done in BTC, Alice sends the money to $P_o$ & publishes $R$ in cleartext as part of the transaction data.
+
 In the above expression $G$ and $S_b$ are publicly known. But $K_{dh} = H_s(r V_b \space)$ has a term $r$ which is known only to Alice.
 
 However, $V_b = v_b G$ & $R = r G$
 
 $r V_b = r  (v_b G) = v_b  (r  G) = v_b R$ 
 
-Since $v_b$ is known to Bob (& no one else), Bob can compute $K_{dh} = H_s(v_b R)$ even without knowing $r$.
+Since $v_b$ is known to Bob (and no one else), only Bob can compute $K_{dh} = H_s(v_b R)$ even without knowing $r$.
 
 So above, Alice used Diffie-Hellman to share a secret $K_{dh}$ with Bob.
 
+But most transactions have more than one output - either sender sends money to more than one receiver in the same transaction. If nothing else, she has to send change back to herself because the amount she wants to send to Bob will not match the exact amount of the input(s) she is spending. So, typically instead of just $K_{dh} = H_s(r V_b \space)$, we will have
+
+$K^0_{dh} = H_s(r V^0_b \space)$
+
+$K^1_{dh} = H_s(r V^1_b \space)$
+
+where the superscript $0, 1, ...$ etc is the output index - if a transaction has multiple ouputs, then it's indexed as $0, 1, ...$ etc
+
+$V^i_b$ is the View Output Key of the receiver of the $i$-th receiver & Alice will compute the corresponding one time Public Address as 
+
+$P^i_o = K^i_{dh}  G + S^i_b$ 
+
+where $S^i_b$ is the $i$-th receiver's spend Public Key
+
 In BTC, everytime a new mined block appears, your wallet scans the block and finds transactions sent to your address. In Monero, your wallet uses the $R$ of each new transaction to compute $P_o$ from it (using Bob's View Private Key) & checks if the transaction is sent to $P_o$ to find transactions meant for him.
 
 Only the View Private Key is required for viewing transactions coming to your wallet & the Spend Private Key isn't required.
@@ -400,6 +415,7 @@ When Bob wants to spend this output, he has to prove possession of $x_o$ - the v
 
 In BTC, where money is sent to non-secret addresses, in Monero, it's sent to a one-time address to preserve privacy & anonymity.
 
+
 #### Amount Commitments
 
 In BTC, the amount is represented in the transaction entry as the actual value. In Monero, the transaction data has Pedersen commitments of the amounts instead. Since these commitments are Hiding, nobody else can figure out the amounts in any transaction.