Why this post
A lot of interesting things go on right now in Monero development, but if you don't happen to attend the two regular dev meetings on Mondays and Wednesdays or hang around in some of our Matrix rooms, you probably wouldn't know much about it. We have a blog on our website here, but you won't find regular reports there like other cryptocurrency projects publish in their "dev blogs". So far nobody posts regular updates on Reddit either.
I only recently became fully aware of this, and noticed that people building software "on top" of the Monero core software, especially wallet apps, often don't seem to be fully informed either what is coming. This may have unfortunate consequences, e.g. apps not being ready when the next hardfork arrives because their authors were not aware about necessary changes, or became aware too late.
That's why I decided to write this post about Carrot, which is mostly "flying under the radar" so far, but will bring solid improvements to Monero users.
I plan to make this the first post of a little series, containing an overview, with later posts giving more details about individual important aspects.
The next Monero hardfork
If all goes according to plan, and it currently looks as if it will, the next Monero hardfork will bring the largest changes in underlying technology since RingCT was introduced way back in 2017 and implemented hidden transaction amounts: A technology with the acronym FCMP++ will bring a decisive step up in sender privacy. You can read an introduction about it from the author, cryptographer and dev kayabanerve here. The gist of it, radically simplified: Until now, if you spend XMR, you hide among 15 other people doing so. With FCMP++ you hide among all the people who ever did an XMR transaction since Monero's genesis in 2014.
I estimate that the hardfork will take place in roughly 1 year from now, give or take a few months.
Beside FCMP++ it will introduce a second important new technology called Carrot. That's a new so-called addressing protocol that will supersede the current addressing protocol that is part of CryptoNote, the technology that Monero inherited when it forked a cryptocurrency called Bytecoin in 2014.
Lead designer of Carrot is the seasoned Monero dev jeffro256. He also implements it in the Monero core software and is quite far along already with this endeavor.
The name Carrot is a clever acronym of Cryptonote Address on Rerandomizable-RingCT-Output Transactions, but a considerable amount of cryptographical knowledge is needed to fully understand what this means, especially the "rerandomizable" in there.
It's not easy to explain what exactly an addressing protocol is either, and not being a cryptographer, I don't fully understand it yet myself, but I can describe the interesting new features that Carrot allows to implement together with FCMP++. In this overview, I will feature the two most important ones, full view-only wallets and forward secrecy.
Full view-only wallets
A view-only wallet is a wallet that lacks the capability to spend, in a fundamental way: The information needed to send valid transactions out, in Monero's case the spend secret key, is simply not there, and spending is therefore mathematically impossible, which is of course a great security feature.
Monero supports view-only wallets since its beginning in 2014, thanks to the CryptoNote dual-key system with view keys in addition to spend keys. They just have a rather large problem: They can't see spends. If a wallet app has only the view secret key available instead of both keys when scanning the blockchain, it will only be able to pick up incoming transactions, but not outgoing ones.
This is unfortunate. As soon as spends are present for a given address, the balance of a view-only wallet for that address won't be correct anymore. You also can't use such wallets to check without danger whether your XMR "are still there" if you have a paper wallet.
Carrot finally implements full view-only wallets that don't have this disadvantage. They see everything, incoming and outgoing transactions, but it's still impossible to use them to spend.
I think when Carrot becomes available people will start to use view-only wallets much more often and may soon forget that back in the pre-Carrot dark ages they were more or less defective.
I will come back to this in a later post with more details and background info.
Forward secrecy
Monero, many other cryptocurrencies and a large number of other things all over the world rely on elliptic curve cryptography (ECC) and the practical impossibility to find private keys from public keys that were derived using ECC. Unfortunately it could be that soon quantum computers will be able to do exactly that, finding private keys, and start to "crack" systems that way.
Cryptographic research is busy developing methods that are fully immune against quantum computers, but as far as encryption and signing is concerned, mostly has only algorithms on offer today that are much slower than ECC, and lead to much bigger key sizes. Using them would mean (even) slower sync and (even) bigger transactions for Monero. It looks as if it's not feasible to achieve full immunity that is practical and "just works" already with the next hardfork, thus we don't try.
That does not mean that we just ignore the whole issue however. Carrot does what is achievable in a short time frame and without degrading the user experience too much, by implementing forward secrecy.
I will try to explain in more detail in a later post what that means, thus here only a quick and simplified explanation: Thanks to forward secrecy, for transactions done using Carrot, even a fully working quantum computer won't be able to "break" their privacy in many important scenarios.
Carrot picks some pretty sweet "low-hanging fruit", so to say.
Full backwards compatibility
Before Carrot, at least two other more powerful addressing protocols had been designed for Monero, called Jamtis and Jamtis-RCT. Those two have in common to require new wallets and new addresses for everyone, with the current 95-character addresses all invalid and gone for good. The introduction of either one would have been a quite drastic event for users, needing a broad effort over the whole Monero "ecosystem", and with a danger to create confusion and loss of funds. This post of mine from 2 years ago gives some details how this would have looked.
Carrot completely avoids such difficulties, which personally I consider its most astonishing feat - it almost looks like magic to me!
Let's call today's wallet 2-key CryptoNote wallets, or 2-key wallets for short, because they have the 2 well known CryptoNote style secret keys. Carrot introduces what we can call 6-key Carrot wallets or 6-key wallets for short, because the number of secret keys rises from 2 to 6. In the proverbial "ELI5" style: More and better features need more keys.
Full backwards compatibility means that after the hardfork 2-key CryptoNote wallets will continue to work, without any changes, just like that. You can stay on the wallets you have now as long as you like. You will be able to restore as a hot wallet the paper wallet you created a few years back under Carrot. All your 95-character main addresses and subaddresses will stay.
The only small catch: To enjoy all of Carrot's features, you will have to create new 6-key Carrot wallets and move your funds over. 2-key wallets offer less thorough forward secrecy than 6-key wallets, and a full view-only wallet is only possible for a 6-key wallet. But, again, you can make that move whenever you like, right after the hardfork or much later.
Resources
Here a list of resources in case you want to read more about the mentioned topics. Be aware that they mostly assume quite a bit more knowledge about cryptography and the current workings of Monero than this post here:
