Private keys
The spend key b, the view key a and their public halves B and A
A Monero wallet is a pair of scalars: b (private spend key) and a = Hs(b) (private view key). Their public versions: B = b·G and A = a·G. An address is simply B and A written together.
The spend key
The private spend key b is a random scalar modulo l. In the classic format, the 25-word seed is b, just written in words. Generation:
- take 32 random bytes (or more, for uniformity);
- read them as a little-endian number;
- reduce modulo
l(sc_reduce32).
The spend key is needed for two things: computing a one-time output's private key (to sign a spend) and computing the key image.
The view key
The private view key could be an independent random number, but standard wallets derive it from the spend key:
That's why a single seed is enough to restore both keys. The view key is used when scanning the blockchain: for each transaction the wallet computes the shared secret 8·a·R and checks whether an output is addressed to it (details in one-time addresses).
Public keys
Two curve points, 32 bytes each. They aren't secret: your address is made of them.
Who can do what
| You have | You can | You can't |
|---|---|---|
A, B (address) | send money to this wallet | see anything |
a, B (view-only) | find incoming outputs and their amounts | spend; reliably see spends |
a, b | everything | — |
With Carrot the key hierarchy gets deeper: separate keys for "see incoming", "see everything", "generate key images". For existing wallets, a and b keep working.