Open-source technology is publicly auditable. To build trusted systems, we must start with making our code public. In doing so, we support the community in verifying that the intention of our design matches our implementation. We can build secure software in a world where anyone can audit our technology, which is why we are committed to keeping our payments protocol open-source, now and forever.

MobileCoin is a security-focused cryptocurrency [launched](https://mobilecoinfoundation.medium.com/mobilecoin-main-net-8e355d82c726) on December 7th, 2020. Its initial [code base](https://github.com/mobilecoinfoundation/mobilecoin) was developed by MobileCoin Inc. and published by the [MobileCoin Foundation](https://mobilecoin.foundation/) with an open-source license (GPLv3).

There are two GitHubs for Mobilecoin:
- [MobileCoin Foundation GitHub](https://github.com/mobilecoinfoundation/) - this GitHub contains all the code relevant to the blockchain, consensus, and fog projects. It is managed by the Foundation and follows the improvement proposal process.
- [MobileCoin Official GitHub](https://github.com/mobilecoinofficial/) - this GitHub contains all the wallets, bots, and integrations. It is managed by the core-dev team and 

All of our audits are made publicly accessible after careful review:
- [MobileCoin Audit](https://github.com/trailofbits/publications/blob/master/reviews/Mobilecoin.pdf)
- [BFT Audit](https://github.com/trailofbits/publications/blob/master/reviews/MobileCoinBFT.pdf)
- [Fog Audit](https://github.com/trailofbits/publications/blob/master/reviews/MobilecoinFog.pdf)


Open-source technology is publicly auditable. To build trusted systems, we must start with making our code public. In doing so, we support the community in verifying that the intention of our design matches our implementation. We can build secure software in a world where anyone can audit our technology, which is why we are committed to keeping our payments protocol open-source, now and forever.

Open-Source Code


![](https://raw.githubusercontent.com/mobilecoinofficial/developer-portal/main/images/digitalcash.png)

To help understand the importance of the MobileCoin technology, the ELI5 articles deliver four layers of increasingly more complex information geared toward describing the concepts to:

-   Five-year-old children who probably have never spent money

-   Grandparents who probably are not familiar with cryptocurrency, but have searched on Google, written checks, balanced their checkbooks, and transacted online through their local banks.

-   College first years who are familiar with digital cash, like Bitcoin, smartphones, and messaging apps, like Signal and WhatsApp.

-   Software engineers who have studied digital payment systems, blockchain databases, and cryptography.


Explain Like I'm Five


[What is MobileCoin's Blockchain?]: #what-is-blockchain

Blockchain is a new technology that is decentralizing trade and allowing peer-to-peer transactions to occur, removing the intermediaries. How does MobileCoin use this innovation to allow two people to send digital cash using their smartphones?

### To a Five-Year Old Child:

Imagine you have a bag of puzzle pieces and you give a piece to each of your friends. If you all get together, you can solve the puzzle. However, if someone brings a piece from another puzzle, or you are missing a piece, the puzzle remains unsolved. Whenever someone in the world wants to buy something, you or one of your friends needs to place a new puzzle piece down.

### To a Grandparent:

Blockchain is like a counting mechanism, a ledger. It is similar to the invention of double-entry accounting, which is a bookkeeping method that has been used since the 1400s. Double-entry accounting involves recording each transaction in two accounts, resulting in a credit to one account and a debit to another. The resulting transaction must balance out. Blockchains make it harder to cheat by having many different copies of the ledger, each held by a different person who all come together to agree on the information in their ledgers. The technology ensures that the accounts always balance, and no one can cheat.

### To a First Year College Student:

The importance of blockchain is that it democratizes information. It allows people to trade one-on-one. Anyone can validate that the transactions are valid. Blockchain is keeping track of data in a way that blocks large corporations or big tech companies from tracking the user's data to sell. For example, Google, AWS, and Microsoft provide cloud services, but the users' data is the product, which the technology companies can sell. Blockchain can be used for multiple uses, not just finance. It is a trustworthy database that can be used for running video games, tracking physical goods, recording weather and/or sports scores, or as a supply chain.

The blockchain itself is an append-only sequence (ledger) of all transactions. It uses cryptography to encode all of the transactions, so no one can see what has happened. This also means that previous transactions cannot be changed because the cryptography reveals if someone has tried to manipulate the data. To create a new entry in the ledger, you take the existing ledger and use a mathematical equation to add information to the chain which ensures that each new entry is provably linked to all prior transactions. The math proves truth -- any inconsistencies reveal that someone has tampered with the ledger.

### To a Software Engineer:

Blockchain is a decentralized approach to keeping track of data. It can be a ledger, a log, or a history of important items. On a blockchain network, there are multiple types of participants: servers, nodes, miners (in the case of Bitcoin's blockchain network), and/or computers. Each one of the nodes receives a proposed transaction. If one of the nodes in a trusted group of peers has a different set of transactions than the rest of the nodes, the other servers correct the mistake through consensus. As the consensus mechanism reaches its conclusion, a new block is appended to the chain using a cryptographic proof known as a hash. Succinctly, this is why it is called a blockchain: it is a chain of blocks linked by cryptographic knowledge.

The MobileCoin Blockchain is a digital ledger that records financial information of financial transactions, the giving and receiving of funds. The design of the MobileCoin Blockchain ledger is based on the CryptoNote ledger encryption protocol, which obscures the identity of all users' transaction outputs (TxOuts) using one-time recipient addresses. The transaction is encrypted by Ring Confidential Transactions (RingCT), which hides the actual transaction value amid decoys, a larger set of possibly-spent transactions. The MobileCoin Blockchain is encrypted, which means that the TxOuts are constructed in such a way that users can only receive funds or know how much they have spent by using their private keys to view or spend the transaction. Explicitly: only the counterparties in a transaction are privy to its contents.

Each TxOut is annotated with a Merkle proof of inclusion, a secret committed message in a finite group of messages, in the MobileCoin Blockchain ledger. A Merkle proof of inclusion (or membership) can be validated without going to the ledger database and in constant time -- without revealing which output the user is spending. Additionally, MobileCoin's Blockchain improves on the baseline encryption offered by CryptoNote and RingCT by deleting input rings for every transaction before the new payment is appended to the public ledger. This provably destroys the transaction graph.

One erroneous assumption about blockchains is that it is being used for both the consensus mechanism, how the servers decide on what data to append to the blockchain, and the record of those decisions, that is, the result of the consensus. Technically, the blockchain is just the record of those decisions finalized in "blocks." However, a lot of people conflate the two.

The blockchain is the result of the consensus validation. Consensus occurs after a certain number of servers (peers) vote together that the outputs being sent from one person to another are legitimate thereby coming to "consensus" on the next valid block. If they all agree the transactions are legitimate, the peers accept the transaction, and they append the encrypted part of that transaction to the blockchain. Only the recipient has the private key to decrypt it.

MobileCoin's Blockchain differs from other blockchains. Other networks retain complete copies of all transactions, so new participants can validate the chain independently. Alternatively, MobileCoin uses MobileCoin Fog to offload the transactional data. Once a transaction has been validated, most of its data is discarded. Only the information necessary to make new transactions are saved in the MobileCoin Blockchain, such as key images and outputs. MobileCoin protects users from data leakage, location monitoring, and surveillance.

Using MobileCoin Fog (discussed next), MobileCoin has made the blockchain encrypted and secure for smartphone usage.


[What is MobileCoin's Blockchain?]: what-is-blockchain

What is Blockchain?


[What is MobileCoin Fog?]: #what-is-fog

MobileCoin Fog is a new technology developed by MobileCoin, which is a service designed to support use of the MobileCoin payments network on mobile devices. MobileCoin Fog is designed so that MobileCoin and the messaging app's service operators have limited insight into users' payments. Most people understand what the Cloud is, a type of technology infrastructure that hosts an organization's network capabilities and resources in a public or private remote computing platform. Fog is similar in that it is cloud, but opaque. You cannot see what is going on inside a Fog service. It is encrypted end-to-end. How does MobileCoin use this technology to allow two people to send digital cash to each other using their smartphone?

### To a Five-Year Old Child:

Pretend that you have a glass jar of marbles. You are the owner of the jar. You can see who wants a marble and what marbles other kids pick out of the jar. But! What if Bobby wants to pick out a marble without you knowing which one it is? He wants it to be his secret only. Maybe, you add a bunch of cotton around all of the marbles. Bobby now can reach into the jar and pull out a marble without you knowing which one he pulled out. Even though you own the jar of marbles, Bobby can secretly remove a marble without you knowing which one it is. You know he is taking a marble, but that is all. That is what MobileCoin Fog does. It keeps Bobby's marble choice encrypted, so no one else knows, not even you, the owner of the jar, what marble he chose.

### To a Grandparent:

MobileCoin Fog is similar to encrypted information retrieval. What if you want to find out about RVing in Alaska? You search on Google for campsites. The Google team keeps track of your searches. All of a sudden, you start seeing ads for campers, camping gear, and camping insurance. Somebody at Google has shared your searches with advertisers. When you use MobileCoin to send payments through your smartphone, the information is encrypted and no one, not even the operators at Signal or any other messaging app that you are using, can see what you have spent or with whom. No one can track your spending habits. MobileCoin Fog makes this possible and practical on a mobile device, as well.

### To a First Year College Student:

Cryptocurrency is a form of online money where no trusted institution, like a bank or government, is responsible for the value or the stewardship of the currency. The issue with Bitcoin is that it is not encrypted. Anyone can track back your transactions to the beginning of the Bitcoin, harvest that data, and sell it to advertisers. It is also not super easy to use because you have to download the wallet software and understand the technology. And, finally, it is very slow. It can take anywhere from ten minutes to 60 minutes for a transaction to go through.

In cryptography, the ability to retrieve information from a server that you do not own without the operator of that server knowing what information you are trying to recover, is called encrypted information retrieval. Hiding the access pattern is extremely difficult to do. A technology, called oblivious RAM (ORAM), helps this happen. MobileCoin Fog is the first production-grade open-source implementation of ORAM that exists today.

In addition, MobileCoin has placed the ORAM data structures inside Intel's Software Guard eXtension (SGX) secure enclaves, which means reads and writes do not correlate transactions with users, even in the event of a side-channel exploit against SGX. Fog serves queries without revealing significant transaction information, and without compromising scalability.

Fog's query service provides an alternative to downloading the entire blockchain, which is critical for mobile devices. Users do not have to test every transaction using their cryptographic keys, which saves significant bandwidth and computations required for every new transaction. Fog does a form of processing of the blockchain, but does it for the users and without needing their private keys. Fog ingest, the server that houses the ORAM in the SGX enclave, looks at the blockchain as it gets updated and decrypts part of each transaction. Fog prepares this decrypted information for the user to retrieve at a later point, so that users can make queries to Fog about their transactions, and check their balances and send transactions to others. The smartphone can make an oblivious request against the oblivious database in Fog. And no one knows what you are spending your MOB on! It is encrypted, fast, and easy to use.

MobileCoin's cryptocurrency payment system runs on Signal, which is an encrypted messaging app. People used to use Pretty Good Privacy (PGP) to send encrypted messages via email. But, for the normal person, PGP was difficult to use. Signal developed a way to send an encrypted message without anyone having to think about the underlying cryptography. Similarly, MobileCoin has created a cryptocurrency that has an encrypted blockchain where you do not have to think about the underlying technology. In fact, when you use Signal, you do not send a cryptocurrency address. You literally just type in a phone number and hit send on your smartphone. Fog lets this happen.

### To a Software Engineer:

MobileCoin Fog is a solution to the scalability problem of encryption for cryptocurrency. The scalability problem is the following -- by design, no one can determine who owns a particular coin, without having the private keys of the owner. However, this forces all participants to download all the transactions and scan them with their private keys, which is prohibitive on mobile devices, and onerous for casual users. 

MobileCoin Fog is a solution to this problem, which:

-   Encrypt indexes the blockchain, so that your TxOut's have pseudorandom keys that only you can predict

-   Provides a way to search the blockchain for your pseudorandom keys

-   Provides a way to complete balance checks and build transactions, obviating the need to download the ledger completely.

Fog is dramatically more efficient than view-key scanning each transaction with each user's keys -- it does only a small amount of work per transaction and does not do work per user and per transaction, so that it can scale up to a billion users.

A single Fog server currently supports hundreds of queries per second across the entire MobileCoin ledger, and speed is expected to improve as we continue to optimize it.

Fog's search functionality is based on a nascent technology called Oblivious RAM. This technology has been studied for decades but not shipped in a real production web service until MobileCoin launched Fog. Fog also makes critical use of Intel SGX enclaves and works within the SGX threat model to ensure that the Fog service operators have no insight into your transactions. This aspect of Fog was inspired in part by the Signal Contact Discovery service.

Fog ensures that even in a threat model where MobileCoin operators and Signal operators are hacking into the operating systems of their machines and attempting to scour them for evidence, they are unable to determine the amount or the recipient of your transaction, without penetrating Intel SGX security guarantees.

Fog also has a forward secrecy property, so that if a vulnerability is found in SGX, it recovers gracefully after the patch. Crucially, users' private keys are never inside of Fog SGX enclaves, and they always remain on your mobile device.

Architecturally, Fog consists of four scalable microservices, and a database which stores a post-processed version of the blockchain (with the indexing information).

-   Fog Ingest:

This service is responsible for post-processing the blockchain and creating the indexes. The Fog Ingest SGX enclave maintains a private key, and emits the public key in an SGX-signed record called the Fog Report. When sending MOB to a Fog address, MobileCoin users obtain the report and encrypt part of the address (the view public key) for Fog Ingest, so that it can know who to tag the payment for. This ciphertext becomes part of the TxOut and goes into the blockchain when the TxOut is validated. Later, Fog Ingest picks it up, and the enclave is able to perform the indexing. The indexing works by creating a cryptographic PRNG for each user -- these PRNGs are stored in an Oblivious RAM inside of SGX. The seed to the PRNG is created by key exchange against the user's public key, and the key exchange message gets committed to the database. This ensures that the users can always reconstruct their RNGs as long as they have their private keys. TxOut's are tagged with successive outputs of the RNGs, and then committed to the database. After this, the Fog Ingest enclave deletes each TxOut's specific information, to create forward secrecy.

-   Fog View:

This service is responsible for helping users find their TxOut's based on the indexing performed by Fog Ingest. Fog View makes it possible for users to find key exchange messages so that they can build their RNGs. Fog View also hosts an oblivious RAM inside of an SGX enclave into which it loads all of the post-processed TxOut's. It then supports queries based on outputs of PRNGs, so that users can download exactly their TxOut's.

-   Fog Ledger:

This service is responsible for helping users perform other tasks that would otherwise require downloading the blockchain ledger. One such task is performing key-image checks, which resolves if a TxOut that you downloaded is already spent or not, and is a critical step in balance checking. Another such task is building Merkle proofs of membership for your TxOut, which is required to submit to consensus. This is also an SGX service and all queries like this are mediated by oblivious RAM, similar to Fog View.

-   Fog Report:

This service hosts the Fog Report -- it is accessible to all users, so that they can send transactions to Fog users.

### Summary

All together, these microservices are the basis of Signal's integration with MobileCoin, providing the best-in-class mobile payments experience, in terms of convenience, ease of use, speed, cost, and encryption.  For more information, check out: <https://mobilecoin.com/beta>.


MobileCoin Fog

With cryptocurrency, money exists in a publicly verified record as 'Unspent Transaction Outputs,' each with a unique serial number, and hard-to-counterfeit cryptographic properties. All transaction verifications happen in real-time within seconds. Exactly how does MobileCoin enable this to happen so quickly between two smartphones? The principles are simple, even if the tech is wildly complex. Let's dive in.

The Life of a Transaction
=========================

To a Five-Year Old Child:
-------------------------

Imagine you are setting up your own lemonade stand with your younger brother. You ask your parents to provide the lemons and cups, and you make the lemonade, with only a little help from your sibling. Next you set up your stand on the sidewalk in front of your house. You make a sign: "One Cup of Lemonade for 50 cents." Your first customer appears. Alice walks by your lemonade stand and says she would like to purchase a cup of lemonade. You tell her the price is 50 cents. To your surprise, Alice hands you a bag of 50 pennies. As you count each penny quietly in your head, your younger brother watches and counts each penny loudly, to show everyone that he can count too. You lose your count, so you call your parents over to confirm the amount is correct. Alice waits patiently while both you and your parents count all 50 pennies, and you hand Alice a cup of fresh ice cold lemonade. The verification that the pennies were indeed a U.S. currency had to occur ahead of time before Alice could spend her pennies at your lemonade stand. Once the pennies are in the jar, you can no longer tell which pennies were from Alice, and which pennies were from other customers. You remember how many pennies you received, but you can't go back and count them again. 

To a Grandparent:
-----------------

MobileCoin is electronic cash, so instead of pennies or dollar bills, the transaction requires payment from someone using a "wallet" app on their smartphone. Let's say Bob wants to buy concert tickets from Alice for $20. He opens the [Signal](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate) messaging app on his phone, now with a built-in MobileCoin wallet. Bob goes to "Settings" to find "[Signal Payments](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate)" where he can check his balance. Bob has enough money in his MobileCoin wallet, so he finds Alice in his list of contacts, and sends $20 to Alice. Only instead of sending U.S. Dollars (USD), Bob sends Alice the equivalent of $20 in MobileCoin (MOB). Alice gets a notification on her phone, "Bob sent you $20 worth of MOB." Alice hands Bob the concert tickets (or sends them via email). Alice and Bob are the only two people who are able to see that this transaction was completed. 

Behind the scenes, this payment is broadcast from Bob's phone over the internet to the validator nodes on the MobileCoin blockchain network. Validator nodes are servers on the internet run by independent organizations. Every validator node in the network agrees on the details of the transaction, and the valid transaction is recorded with other transactions in a "block." The block is signed and sealed, with all the validators agreeing to store the block, forever. Inside this block is the transaction that proves Alice received the $20 of MOB from Bob. The block is added to the blockchain, and all the validators have a copy of all the blocks. The blocks cannot be altered by one validator, at least not without the other validators knowing. Bob's [Signal](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate) wallet is checking the blockchain to see that the payment went through, and as soon as it does, his phone updates with a message "Payment successful."  Bob's Signal wallet also sent a digital receipt to Alice with the proof that it was him that paid her. Alice's balance also updates on her phone, and she sees the notification on her phone. And all of this took mere seconds.

![](https://lh6.googleusercontent.com/a0_kGA7WErGBo4WJVhCq9Ir_74BWLsOigTdv105QJaUw9mHmahgOx7TunACJKrVSZd17R0KPdno_DD10ItJxYdWssysGtvwNa5xMZ1z329RK6mUz1SykyGA8wtmz6EjkI8THPYxrHfX6VdM8aw)

The life of a MOB transaction on a smartphone in a messaging app.

To a First Year College Student: 
---------------------------------

You already use payment apps like Venmo, PayPal or Cash App, and there are many apps that let you buy, sell, and send cryptocurrency. There are so many cryptocurrencies, and they all have fees to send money. Why would someone consider using a cryptocurrency for payments? Here are our top three reasons you should consider using MobileCoin.

The first reason? Payment apps, like Venmo and PayPal, have access to your payment habits, which they sell to advertisers who want to better target you with marketing campaigns. If you don't switch to private mode on Venmo, your Venmo payments are visible to everyone - and their mother. You might switch to private mode if you are donating money to religious or political organizations, buying medical prescriptions, on a date, or buying drinks at casinos. Even in private mode, Venmo has access to your financial information and can use it for offers, advertising, search results, or anything else covered in their terms & conditions. 

The second reason? You can take advantage of the best feature of cryptocurrency -- you can actually have self-custody of your money. Self-custody means you can buy, sell, store, or lend crypto-currency -- with MobileCoin's digital wallets. Payment apps like Venmo previously don't allow you to self-custody your wallet. You don't actually have access to the private keys to your money. 

The third reason? MobileCoin's digital wallet on messaging apps makes it easy to use cryptocurrency, while ensuring your MOB is secure. With cryptocurrency exchanges becoming ubiquitous around the world, including FTX, Binance, and BitFinex, you are able to buy MOB and transfer it to your digital wallet. And your crypto is safe, even if you lose your phone or change your phone number. For example, [Signal](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate) requires a PIN to regain access to your transactions where a QR Code is generated for each account. In addition, a 24-word recovery phrase, unique to you, enables you to unlock your data.

With MobileCoin's digital wallet, your transactions are completely private and secure. Using cryptography, your transaction payment history is kept private from the operators of MobileCoin and the messaging apps, like [Signal](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate), as well as any third-party organizations. A record exists that something occurred on the blockchain, but all of the participant information in the transaction and the amounts are encrypted. Only you and the person with whom you transacted knows what occurred.  When you look at other cryptocurrencies, the addresses and amounts of all transactions are publically available on their blockchain ledgers. This means once someone knows your address, all your transactions -- past and future -- are fully available for them to see. MobileCoin is a different kind of cryptocurrency than others because of its end-to-end encryption features. With MOB, all senders, receivers, and amounts are private, and the user is empowered to own their own data.

#### Getting a Digital Wallet is Easy

Bob already has the Signal app, a cross-platform centralized encrypted instant messaging service that lets him share text, voice messages, photos, videos, gifs, and files. Bob can send and receive payments in the Signal app. What if Alice doesn't have Signal installed on her phone? She can just download the app and [activate Payments in Signal](https://developers.mobilecoin.com/ecosystem/signal-payments).

When Alice creates her digital wallet, the cryptography behind the scenes creates a pair of private keys that she can use to view and spend her funds. These keys are her private credentials for interacting with her balance and they never leave her wallet and never appear on the blockchain. When she wants to receive MOB from Bob or someone else, her public address is generated from her private keys. This functionality occurs behind the scenes, which makes sending and receiving MOB so easy.

#### Concealing the Receiver and Sender

For Bob to send MOB, he needs to have already added cryptocurrency to his digital wallet. To add funds, Bob can send MOB to his wallet's public address from an Exchange. Bob must have an account set up on an Exchange that supports MobileCoin, then he can scan the QR code or copy his public wallet address and follow the Exchange's instructions to send money to his digital wallet.

We added a layer of security and privacy at this point in the life of a transaction called one-time addresses. This RingCT technology, which is an application layer protocol that combines ring signatures and Pedersen Commitments, allows Bob to generate a one-time address from Alice's public address. This is the value that will appear as the address of the output on the blockchain and reveals nothing about Alice's public or private credentials. Again, this happens behind the scenes. 

Another layer of security we added is Ring Signatures, which maintain the sender's (Bob's) privacy. About 11 different outputs are pulled from the ledger as decoys. They are all grouped together in a ring that Bob signs, which means he owns one of the outputs. Because we had to avoid double spending the same coin, we added a key image, or a unique tag, to the ring. If that key image has never appeared in the ledger before, then the real source of a ring signature transaction has never been spent before. 

#### Confidential Amounts Hide the Amount of the Transaction 

To conceal the amounts, we added a level of security called confidential amounts, or Pederson Commitments, which are a confidential way of representing a value. This confidentiality ensures the amount of the MOB is not listed on the blockchain. However, Alice can see the amount sent to her by applying her own private credentials. She can see that this particular coin is addressed to her and that the amount is $20 worth of MOB.

.

![](https://lh6.googleusercontent.com/IqKsJz4wyWn12TWUNfYBNC9B69emv21HnV-cfTsxSsHaTDa6VX46PM3JbJZJc46k0iVnX2FgzXvKtxVcV93LE5dAhknzj446pqsRyg7R6fu5P6Ad9tzxazKh6uXg-MzWDyUbTyddPWbgaaKtlQ)![](https://lh6.googleusercontent.com/RfbBDhNjmHUP0qyU4t-Ed8jIC4tM4I7MGFvjc5PptX_sG_ihiWr_Wmcz48gZbScRbvKrthqdTWr6vTcFiqApi_0eUUWIT70RHl5YytwtXTdHyEZq5AU6g9YwyrPheh_ldYrE-lCYrknLGKpWLA)

Arrows allow the user to switch between the cryptocurrency value of MOB and the related amount of U.S. dollars.

Once a transaction has been completed, the digital wallet displays the amount transacted, as well as notes on the transaction. Although the transaction just took under five seconds, layers of digital security occurred behind the scenes. The next section explains the cryptography included in the transaction, as well as the hardware levels of security that take place for the life of a transaction. 

To a Software Engineer: 
------------------------

At the core of a MobileCoin transaction is cryptography, from elliptic curves underpinning various means of encryption, to the hashing algorithms at the heart of the merkle tree data structure that provides the "chain" aspect of the blockchain.  In the ELI5 series, we previously covered the MobileCoin blockchain and MobileCoin Fog, which are the technologies we developed to reduce security risks and improve speed of transactions. In this article, we focus on cryptography, or more specifically, Elliptic Curve Cryptography (ECC), which generates security by using the mathematics of elliptic curves, as well as the benefits of secure enclave hardware for minimizing security leakage. 

Similar to the Rivest-Shamir-Adleman (RSA) algorithm, ECC, a type of mathematics that underpins a whole class of asymmetric algorithms, uses public and private keys that are mathematically linked to encrypt and decrypt information. This elliptic curve is a set of points that are defined by a math function, a starting point, multiple connections, and a fixed range. We implemented ECC because it generates smaller key sizes with the same advanced ability as RSA to maintain security, while using less "computing power," giving us an efficient option for mobile phones. For example, when RSA generates a key the size of 7680 bits, ECC generates a key the size of 384 bits, almost one-fifth the size.

Starting with the unspent transaction output (UTXO) model of cryptocurrency, we added additional layers to the transactions (as described earlier to the first-year college student) to build better privacy than other cryptocurrency models. Transactions in most other cryptocurrencies reveal the owners of inputs and outputs, as well as amounts. MobileCoin has privatized this information by including:

-   Ring Signature: Hides the input transactions in a group. The decoy transactions are all equally likely to be part of the transaction, so the sender is concealed.

-   RingCT One-Time Address: Hides the recipient.

-   RingCT Confidential Amount: Hides the amount.

#### Checks and Balances of Transaction Process in a Secure Enclave

To ensure the transactions are processed with the most privacy and security possible, we added another layer of security above and beyond the inputs and outputs. We moved the transaction process inside Intel's Software Guard eXtension (SGX) secure enclaves. Secure enclaves ensure confidence that the machine is running the correct code, through remote attestation, and security because the piece of code runs in a "black box" where even the operating system is unable to decipher what the code is doing. 

When Bob submits his transaction to the network, he submits it as an encrypted message into an SGX enclave within a node on the network. Only the SGX enclave can see the full contents of the transaction. And this is where the enclave validation occurs:

-   The enclave first verifies that all of the inputs used in the ring signatures exist in the ledger by applying membership proofs, or Merkle Proofs, to prove that the inputs were spent and exist in the ledger. 

-   The enclave proves that the amount of the value going in is the amount going out, even though the code cannot see the actual value. Bulletproofs, or range proofs, ensure that all amounts denote valid amounts of MobileCoin. 

-   The enclave checks a Ring Confidential Transaction signature, which serves to show that everything being spent was actually owned by the signer and that the value of the inputs equals the value of the outputs.

#### Redacting the Transaction for Additional Privacy and Efficiency

That's not all. We realized at MobileCoin that since the inputs, the proofs and the signatures were verified within the enclave, the additional information did not need to be saved. The enclave could remove the extraneous information, retaining only the key images, which uniquely identify the inputs, and the outputs, or coins, that were created by the transaction. The fee is also converted into a coin. At this point, the enclave emits a signed block, indicating it performed the checks correctly. In addition, by redacting the inputs in the rings that created the outputs, leakage is avoided, diminishing Chain analysis attacks. 

Because modern mobile phones cannot store an entire blockchain ledger locally, MobileCoin figured out a way to offload the balance checks to the MobileCoin Fog, as discussed previously. 

And that is the life of a transaction from one smartphone to another. 

If you want to experience the life of a transaction for yourself, now is the time to try it out -- easily and painlessly. For more information, check out our guide on [how to use MobileCoin](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate) within the [Signal app](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate).


With cryptocurrency, money exists in a publicly verified record as 'Unspent Transaction Outputs,' each with a unique serial number, and hard-to-counterfeit cryptographic properties. All transaction verifications happen in real-time within seconds. Exactly how does MobileCoin enable this to happen so quickly between two smartphones? The principles are simple, even if the tech is wildly complex. Let's dive in.

Life of a Transaction


To ensure MobileCoin users can communicate securely with each other and send and receive MOB tokens while preventing adversaries from tampering with or learning about their transaction amounts, we at MobileCoin have implemented Zero-Knowledge Proofs (ZKPs) with computational indistinguishability. ZKPs make sure that no one, except you, and not even the messaging application's service provider or the MobileCoin developers, can access your personal data.

To a Five-Year-Old Child:
-------------------------

Let's say you're a twin and you both received money for your birthdays. You assume it's the same amount, since you're twins. But, maybe mom and dad were feeling a little more generous toward your sibling, since he had cleaned his room every day this year, and you hadn't. So, you set up a little game. You received $50 and you want to see if he received the same amount. You tell him that you have ten Play-Doh plastic containers. You write 30, 40, 50, 60, 70, 80, 90, 100, 110, and 120 on the top of the canisters to represent dollar amounts and then slice thin slots on the top of each can. You tell your brother to leave the room and you will place a feather in the canister representing the amount of money you received. You place a feather in the canister marked "50" and tape up all of the canisters. You tell your brother, Allen, to come back and to slide a stick of gum into the container that represents what he received after you leave the room. He received $100, but you don't know this. 

You return and open up your container marked "50." There is no stick of gum inside, so now you know that your brother received a different amount, but you don't know whether it was more or less than what you received. Your brother also returns and looks in his canister. He doesn't see a feather, so he knows that you both received different amounts, but he doesn't know if it was more or less, either. This is a simple example of how ZKP works. By this method, you learn that you did not receive the same amount of money for your birthdays, but you still have no clue if your brother received more or less than you, and vice versa, or how much. The ZKP protocol maintained the privacy of both of your sensitive information, which was the amount of money you had received, while making a transaction.

To a Grandparent:
-----------------

Suppose an older gentleman is getting up in years and he is nearly blind. In the morning he dresses, reaches into his sock drawer and pulls out two socks. He asks his wife what the colors of the socks are. His wife tells him one is red and one is yellow. She says he can't wear those because they don't match. He knows that she can see the socks and that she can tell if they're red or yellow. But, he also knows that she could just be messing with him for her own amusement. She has a weird sense of humor. So, he doesn't really trust her. In order to tell what the truth is, he plays the sock game.

He places the socks behind his back and he swaps them a number of times, so she can't see which ones they are. But, he keeps track of them and knows which one is which. He asks her, which one is the red sock? If they're both red and indistinguishable, she has to guess with a 50/50 chance the sock is the one she previously said was red. But, if they are yellow and red, then they are distinguishable and she can just point to the red sock. If, by chance, she guesses the correct color of sock three times in a row, then he knows that she knows that they're different somehow. Note: He'll never be 100% sure that she wasn't playing with him, but after enough iterations, he is fairly convinced because the probability of her guessing right is so low that it's negligible.

This answers the first property of ZKPs, which is completeness. If the socks are indeed different colors, she will be able to answer the test questions 100% of the time.

The second property is soundness. If the socks are not different colors, her chance of passing all of the tests is very low.

The third property is zero-knowledgeness. If the statement is true, and the socks are different colors, the verifier (the old man) only learns that the statement is true and nothing else. In this case, the zero-knowledgeness is true. However, suppose we videotape this interaction with a black and white camera. Suppose you watch the video tape and this interaction where his wife guesses right every time. And, at the end you see that the older gentleman believes that the socks are a different color. 

Does watching the video convince you that it's true? The answer should be, "No, watching the video does not convince me." You can't tell by watching the black and white video what color the socks are. The proof convinces the old man and he knows he chose the sock randomly. But, if you're an observer, you can't know that the two didn't collude, and you can't know that those numbers aren't random, because you didn't choose the number of times that he should swap the socks. He could just be pretending to be satisfied with her answers when the socks are actually the same color. Indeed, anyone could make such a video, whether or not the socks are the same or different colors. Because anyone could make such a video, whether or not they know the color of the socks, we can be sure that the video doesn't convey any information at all about the socks. So, in this case, the interaction is zero knowledge.

To a First Year College Student:
--------------------------------

When learning about cryptography, ZKPs, or computer algorithms, are a protocol where one party (the prover) can prove to another party (the verifier) that a given statement is true while the prover avoids expressing any additional data except that the statement is indeed true. For example, ZKPs are a generalization of digital signatures. I want to sign a message and prove to you that I signed it. The secret is my secret key that is associated with a public key in any asymmetric cryptology system used to connect to the internet securely. A particularly simple form of ZKP is proving that I possess this key. And so I produce the signature and in order for it to work correctly, there has to be this random challenge aspect. But if I just look at the output, a bunch of raw bits of signature, I shouldn't be able to distinguish them apart from essentially just random noise.

In addition, ZKPs can be either interactive or non-interactive ZKPs. Interactive proofs are primarily used in theory to provide the definition of ZKPs, which rely on the verifier randomly challenging the prover through multiple steps until the verifier believes the statement is true. 

In practice, it is typically highly desirable to eliminate interaction from ZKPs. Non-interactive ZKPs can be produced entirely by the prover, and then verified by anyone. There is a general technique for making interactive proofs non-interactive, called the Fiat-Shamir transform. In fact, Bulletproofs are constructed by applying the Fiat-Shamir technique to a secure interactive zero-knowledge range proof, which is where the security ultimately comes from. This works for any "public coin" interactive proof, where the verifier's messages are always simply random challenge values, and the verifier does not need to hold any secrets. In the Fiat-Shamir transform, the verifier is "simulated" using a hash function. Whenever the verifier needs to create a challenge value, we determine this challenge value by taking all messages the verifier has seen so far in the protocol, and feeding them into a hash function. Then the results of this hash function are used as the challenge value. The idea is that the hash function typically produces uniformly distributed output values, and it is intractable for a malicious prover to "tamper" with the hash function by driving it to produce specific chosen challenge values. As long as the output looks random and the prover can't influence the challenge values, the security of the protocol is the same as the interactive version. 

This is very useful also in cases where repetition is used to increase confidence in the interactive proof. For instance, suppose we wanted to drive the chance of successfully cheating in the sock game down to 2^{-100}. In the interactive protocol, we have to play the sock game 100 times, so that's 100 back-and-forth messages. If we can make it non-interactive, then there's only one message, which contains all 100 challenges and responses.

To an Engineer:
---------------

Now, for ZKPs to be useful, what we really want to do is get rid of the need for interaction. Ideally, the proof is just a message that one party can send to another without knowing who it will be in advance. For many useful ZKPs, the only interaction the verifier has to do is send random challenge values. Cryptographers can make these "interactive proofs" non-interactive by replacing the challenge values with the output of a cryptographic hash function. A hash function is not strictly speaking random -- it is deterministic based on its inputs. However, cryptographers agree that hash functions' output can look random and are hard to tamper with in any way. So, instead of the prover interacting with a verifier to convince a statement is true, the prover "simulates" the verifier using the hash function. The prover may play the sock game 100 times (against the hash function). The prover then writes down the entire transcript of messages in the protocol, and can send this to anyone. Anyone can verify that the hash function was evaluated correctly to compute challenge values, and that the verifier indeed was convinced each time successfully. Such transcripts can then be committed to a blockchain so that anyone can later verify the correctness of the chain.

We incorporated a specific kind of ZKP called Bulletproofs, to build "range proofs" for encrypted values, proving that commitments to value lie in a specific range, without revealing the values to the verifier. These range proofs are critical to ensure our transactions remain private and balanced without revealing to the verifier the amounts of the transactions. Bulletproofs are short non-interactive ZKPs, and are used in the transaction math constrained to small positive numbers existing within a specific range -- which is all part of the specification for the protocol. Bulletproofs are designed to allow efficient confidential transactions in cryptocurrencies where the amount that is transferred in the transaction is hidden.

In every instance, ZKPs must satisfy three properties:

1. Completeness: If the statement is true, the prover can prove to the verifier that the statement is true (with overwhelming probability). With reference to MobileCoin, this means that whatever the specifics of your transaction are, if it is well-formed then a proof of balance can be formed. 

2. Soundness: Alternatively, if the statement is false, the prover cannot succeed in convincing the verifier that the statement is true (with non-negligible probability). In other words, the prover can only convince the verifier if the prover is actually telling the truth. In reference to MobileCoin, this means that no one can convince the network to accept a bad transaction. 

3. Zero-Knowledgeness: If the statement is true, the verifier only learns that the statement is true and nothing else (the proof does not leak any additional information). This is established within MobileCoin with reference to the Fiat-Shamir technique of taking an interactive ZKP and creating a digital signature based on it. The Bulletproof is equivalent to the transcript of an interactive proof, which is itself zero knowledge. Anyone can sample correct transcripts of that interactive proof, without even knowing the committed values. So, we know that those transcripts convey no information about the committed values. 

A technical subtlety here is that the hash trick actually makes it difficult for an adversary to sample the proof. Once you replace the challenge values with hash function outputs, the adversary can't sample the proof on their own anymore -- you would actually need to know the secret values to be able to build the proof after that point. We agree it's zero knowledge before we replace it with hash functions. Then we agree that replacing it with hash functions can't do any damage in real life. That's how we construct non-interactive ZKPs.


To ensure MobileCoin users can communicate securely with each other and send and receive MOB tokens while preventing adversaries from tampering with or learning about their transaction amounts, we at MobileCoin have implemented Zero-Knowledge Proofs (ZKPs) with computational indistinguishability. ZKPs make sure that no one, except you, and not even the messaging application's service provider or the MobileCoin developers, can access your personal data.

Zero-Knowledge Proofs 

#### **Get the Signal App**
Make sure you have the latest Signal app on your phone.  

<a href="https://signal.org/install/" style="display: inline-flex;">
 <img src="https://developers.mobilecoin.com/native_images/appstore.svg" width="135px" style="margin:10px;" /><img src="https://developers.mobilecoin.com/native_images/playstore.png" width="135px" style="margin:10px;" />
 </a>

* * * * *

Activate Payments
-----------------
Activating payments will let you send and receive MobileCoin.
1. Open the Signal app on your phone.
2. Tap Profile (in the top left) 
3. Tap Settings ⚙️ 
4. Tap Payments 💳 
5. Tap Activate Payments
6. Accept and Agree to the Terms

![](https://images.squarespace-cdn.com/content/v1/624b284acc6f4b3917c9d40d/7f1400e3-a06d-47b3-b6ce-bd2a5045ab62/gif.gif?format=750w)


 Get the Signal App
Make sure you have the latest Signal app on your phone.

Get your Wallet

* * * * *

Got MOB?
----------------------------
You must have MobileCoin (MOB) before you can add it to your wallet. Here are step-by-step guides on buying MobileCoin on a decentralized exchange:
- [Buy in a web browser](/overview/how-to-buy-mobilecoin/fennec)
- [Buy on a mobile phone](/overview/how-to-buy-mobilecoin/mixin)
- [See more exchanges](/ecosystem)

* * * * *

Transfer in from an exchange
----------------------------
1.  Go to  Settings > Payments > Add Money.
2.  Tap Copy to copy the wallet address linked to your Signal account.
3.  Go to a supported exchange.
4.  Follow steps to send on your exchange, paste the wallet address linked to your Signal account and send.
5.  Return to Signal Settings > Payments.


Add Funds to your Wallet

Buying MobileCoin in your web browser is as easy as following this guide to buy MobileCoin with the Fennec Wallet on the 4Swap Exchange. In this guide, we will show you how to get MobileCoin by first buying Bitcoin and then exchanging it for MobileCoin. You will learn how to use the Fennec wallet that works right in your browser.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 1: Buy Bitcoin to swap for MobileCoin.

 The easiest way is to buy Bitcoin is on an exchange like [FTX.us](http://FTX.us) or [Coinbase](http://coinbase.com).

To buy Bitcoin on [FTX](https://ftx.us/):

-   Register and go through the ID verification process. For more info and detailed steps to how to complete the ID verification process, check out [FTX's video](https://www.youtube.com/watch?v=am-oCJnZaug).
-   At the top of the FTX page, click WALLET to deposit some Bitcoin to exchange for MOB. You can use your credit card to purchase Bitcoin directly on FTX. Click the BUY BTC WITH CREDIT CARD button, and now you have Bitcoin in your wallet. For more details, here's an [explainer video](https://youtu.be/8Lnm-ij7Ga4?t=195).

To buy Bitcoin on [Coinbase.com](http://coinbase.com/):

-   Register and go through the ID verification process. For more info and detailed steps of how to set up a Coinbase account and buy Bitcoin, check out [Coinbase's tutorial](https://www.coinbase.com/learn/tips-and-tutorials/how-to-set-up-a-crypto-wallet).
-   Once you have set up your account, a green button will appear to add a payment method. Coinbase will likely make two small deposits to your bank account, which appear immediately. Login to your bank account and enter the two deposit amounts when prompted. Once you do this, the green button will change to say BUY CRYPTO.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 2:  Install the Fennec crypto wallet on your browser

You now need a wallet to hold your crypto. You can obtain a wallet by adding the Fennec desktop wallet extension to [Chrome supported browsers](https://chrome.google.com/webstore/detail/fennec/eincngenkhohbbfpkohipekcmnkfamjp) and [Firefox](https://addons.mozilla.org/en-US/firefox/addon/fox_fennec/).

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-9.43.04-AM-1024x395.png)\
After you add the extension, follow the instructions to set up an account. Make sure to backup the keystore to your computer when prompted or you could lose your crypto assets permanently. You also want to make sure you choose a strong password. Note: Passwords can't be reset, so you need to make sure you remember your password.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 3: Send Bitcoin to your Fennec wallet

Now go over to your Fennec wallet (click the orange fox icon in your extensions bar to pop out your wallet). On the home screen you will see buttons for Send, Receive, and Swap. Below that you will see a box with tabs for Assets and Activities. Use the search bar in this box to search for BTC and click ADD ASSET.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-11-29-at-6.09.28-PM-1024x760.png)

Once you have added Bitcoin as an asset you can go back and hit the RECEIVE button. Make sure the bar is showing BTC. You should see an address that looks like a QR code with a long string of letters and numbers and a small button to copy the address in the bottom right corner. That's your wallet address. Copy it.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-11-30-at-11.42.56-AM-1024x755.png)\
Go back to Coinbase in your browser. Click the big button in the upper right corner that says SEND/RECEIVE. Make sure the SEND tab is active. At the bottom of the popup choose Bitcoin for the type of coin. Enter the amount you would like to send to your wallet. Choose a very small amount for your first transaction to make sure that you are doing everything correctly. Paste the address that you copied from your Fennec wallet into the TO field. Hit CONTINUE.

The transfer of Bitcoin into your Fennec wallet may take some time (could take up to an hour). When confirmed, you should see in your Fennec wallet that you have Bitcoin.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-11.26.30-AM.png)

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 4: Swap your Bitcoin for MOB at 4swap

You can do the first part of this step while you're waiting for your Bitcoin to arrive into your Fennec wallet. [4swap.org](https://4swap.org/) is a decentralized exchange that currently lists MOB. Go to [4swap.org](https://4swap.org/) and click the big pink button that says USE 4SWAP.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-9.39.19-AM-1024x684.png)

Click CONNECT WALLET (another pink button).  Since you have already installed the Fennec wallet on your browser, 4swap should ask you automatically if you want to connect your Fennec wallet to 4swap. Click CONNECT FENNEC.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-9.40.00-AM-1024x218.png)

Once you have Bitcoin in your wallet and your wallet is connected to a decentralized exchange that trades in MOB (4swap), this last bit should be easy. Make sure the top line on 4swap says BTC (Bitcoin). Enter the amount of Bitcoin that you want to swap. Make sure the second line says MOB (MobileCoin). Once you enter the amount of Bitcoin that you want to swap, the MOB line should auto-populate with the correct exchange amount and the SWAP button should activate and become pink. Hit SWAP.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-11.27.43-AM-1024x393.png)

After a few seconds your MOB should appear in your Fennec wallet. Congrats! You now own MobileCoin!



### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg) Send your MOB from the Fennec browser wallet to your MobileCoin desktop wallet

This is a really easy process. But first you have to [download your MobileCoin desktop wallet and create an account.](https://mobilecoin.com/news/how-to-download-and-set-up-your-mobilecoin-desktop-wallet) Once you've got your MobileCoin desktop wallet installed, it's simply a process of sending and receiving money, which you've done before.

Open your Fennec desktop wallet and choose SEND.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image9-1024x752.png)

Choose ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image8.png).

Make sure the top line says MOB and choose SELECT FROM ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image22-1024x706.png)

Here you will need to add your MOB wallet address. Click the + to add a new address. Open your MobileCoin desktop wallet and enter your password to unlock your wallet. Once your wallet is open, you will see your address (it is the square filled with lots of blue, white, and green letters and numbers). Click on the address block to copy it.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image10-blur-867x1024.png)

Back in your Fennec wallet, paste your address into the address box on the bottom. Name your address something memorable. Click SAVE. Fennec will make your re-enter your password. After you do, you will see a green button pop up that says SAVED SUCCESSFULLY.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image27-blur-1024x1018.png)

Click on the address box. This will open the send screen. Click into the box that says MOB and enter the amount you want to send.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image17-1024x652.png)

Hit the big orange button that says SEND. You should see another green button pop up that says SEND SUCCESSFULLY! Your MOB should appear in your MobileCoin wallet within a few seconds. If you don't see it appear automatically, log out and log back in to your wallet.


Buying MobileCoin in your web browser is as easy as following this guide to buy MobileCoin with the Fennec Wallet on the 4Swap Exchange. In this guide, we will show you how to get MobileCoin by first buying Bitcoin and then exchanging it for MobileCoin. You will learn how to use the Fennec wallet that works right in your browser.

Buy MOB with Fennec Wallet

Buying MobileCoin is as easy as following this guide on how to use MixSwap and the Mixin mobile app. MixSwap is an aggregator for 3 decentralized exchanges that allow you to buy MobileCoin by "swapping" Bitcoin, USDT, and other currencies for MobileCoin. To swap with MixSwap, you need to use Mixin. Mixin is a mobile app with a built-in crypto wallet. Like Signal, Mixin supports messaging your contacts with end-to-end encryption and is built on the Signal protocol. 

Download Mixin Messenger
----------------------------

-   Google Play: <https://play.google.com/store/apps/details?id=one.mixin.messenger>

-   App Store: <https://apps.apple.com/us/app/mixin-messenger/id1322324266>

[Watch this video on YouTube on how to buy MobileCoin on Mixin.](https://www.youtube.com/watch?v=pE6d7Aa_kKM)

Send Bitcoin to your Mixin Wallet
---------------------------------

First, you need to get your wallet address in your Mixin app. Open the Mixin app then choose the square icon on the bottom left corner to access your wallet. Once you are in your wallet, tap on the line that says BTC (Bitcoin). This will take you to the Bitcoin send and receive page. Tap on RECEIVE. A popup will appear; tap GOT IT. Then tap COPY to copy your wallet address.

Connect the MixSWap Exchange
----------------------------

Tap on the search icon in the top right corner (the magnifying glass). Enter the number 7000103767 and tap SEARCH. This will locate a bot called MixSwap. You will know you have the right app because you will see a purple bird logo. Tap on the bot and add it to your app. Once you have the MixSwap bot installed, you can access the bot from your home screen in the app.

Swap Bitcoin for MobileCoin
---------------------------

Open the bot and tap the icon in the bottom right that looks like a little robot with antennae. This will open the exchange screen. Enter the amount of Bitcoin that you want to trade for MOB. The only tricky part here is that they do not tell you how much Bitcoin you have in your wallet, so you may need to toggle back to your wallet to see how much you have. Once you enter the Bitcoin amount, the corresponding MOB amount should auto-populate. Make sure that the receive category says MOB and tap EXCHANGE.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 1: Buy Bitcoin on a coin exchange

While there are a number of coin exchanges and thousands of cryptocurrencies, one of the easiest ways is to buy Bitcoin on a coin exchange like FTX.us or Coinbase.

To buy Bitcoin on [FTX](https://ftx.us/):

-   Register and go through the ID verification process. For more info and detailed steps to how to complete the ID verification process, check out [FTX's video](https://www.youtube.com/watch?v=am-oCJnZaug).
-   At the top of the FTX page, click WALLET to deposit some Bitcoin to exchange for MOB. You can use your credit card to purchase Bitcoin directly on FTX. Click the BUY BTC WITH CREDIT CARD button, and now you have Bitcoin in your wallet. For more details, here's an [explainer video](https://youtu.be/8Lnm-ij7Ga4?t=195).

To buy Bitcoin on [Coinbase.com](http://coinbase.com/):

-   Register and go through the ID verification process. For more info and detailed steps of how to set up a Coinbase account and buy Bitcoin, check out [Coinbase's tutorial](https://www.coinbase.com/learn/tips-and-tutorials/how-to-set-up-a-crypto-wallet).
-   Once you have set up your account, a green button will appear to add a payment method. Coinbase will likely make two small deposits to your bank account, which appear immediately. Login to your bank account and enter the two deposit amounts when prompted. Once you do this, the green button will change to say BUY CRYPTO.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 2: Download the [Mixin Messenger](https://mixin.one/messenger) app onto your phone

Mixin Messenger is available on both iOS and Android. Create an account. You will need to choose a 6 digit pin and enter it four times (they really don't want you to forget this pin).

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image23.png)

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 3: Transfer your Bitcoin to your Mixin Messenger wallet on your phone

First, you need to get your wallet address in your Mixin app. Open the Mixin app then choose the square icon on the bottom left corner to access your wallet.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image13-1.png)

Once you are in your wallet, click on the line that says BTC (Bitcoin). This will take you to the Bitcoin send and receive page. Click on RECEIVE.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image4-473x1024.png)

A popup will appear; click GOT IT. Then click COPY to copy your wallet address.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image7-blur-473x1024.png)

Now you need to go back to Coinbase. You can do this on a desktop or you can use their mobile app. If you are using the mobile app, please follow the instructions below. If using a desktop, you can find those instructions at the top of this post in the desktop section.

Login to your Coinbase app. At the bottom of the home screen you will see five icons. Click the one in the middle with the two arrows. This will open a popup where you can then choose the SEND option.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image19-473x1024.png)

This will take you to a screen that lists the different types of cryptocurrencies that you own. Click on BTC (Bitcoin). Enter the amount of Bitcoin that you want to send (in USD) and choose CONTINUE.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image29-473x1024.png)

It will ask you if you would like to access your contacts to send crypto to a friend. Choose NOT NOW. Then paste the address from your Mixin wallet into the TO field and choose PREVIEW SEND.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image5-1-473x1024.png)

Make sure everything looks correct and click SEND NOW. This transaction could take 30 minutes to an hour or more to show up in your Mixin wallet.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 4: Swap your Bitcoin for MOB in Mixin Wallet

There are two sub steps to this last step. First, go back to your Mixin app and click on the search icon in the top right corner (the magnifying glass). Enter the number 7000103767 and click SEARCH. This will locate a bot called MixSwap. You will know you have the right app because you will see a purple bird logo.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image24.png)

Click on the bot and add it to your app. Once you have the MixSwap bot installed, you can access the bot from your home screen in the app.

Once you are inside the bot, click the icon in the bottom right that looks like a little robot with antennae.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image18.png)

This will open the exchange screen. Enter the amount of Bitcoin that you want to trade for MOB. The only tricky part here is that they do not tell you how much Bitcoin you have in your wallet, so you may need to toggle back to your wallet to see how much you have. Once you enter the Bitcoin amount, the corresponding MOB amount should auto-populate. Make sure that the receive category says MOB and click EXCHANGE.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image14-1-473x1024.png)

You now own MobileCoin! 


### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 5: Move your MOB into your MobileCoin desktop wallet

First, quit and restart your MobileCoin desktop wallet TWICE to make sure it updates and is running the latest version. In your MobileCoin desktop wallet, tap the SEND/RECEIVE tab and then tap RECEIVE MOB. Tap the button in the top right corner of the address box to turn your address into a QR code.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-11-30-at-12.39.52-PM-752x1024.png)

In Mixin Messenger on your phone, where all of your currencies are listed, tap on the MOB section. Tap SEND. It will ask if you want to send to a contact or an address. Choose ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/IMG_2018-473x1024.png)

On the address screen tap the PLUS sign in the top right corner to add your MobileCoin desktop wallet address. Name your wallet in the Label section. In the Address section tap the square on the right side to open the camera and then use your phone to scan the QR code on your MobileCoin desktop wallet on your computer. Once you scan the code it should populate in the address line. You may need to enter a memo on the last line to activate the Continue button. Tap CONTINUE and enter your pin.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/IMG_2020-473x1024.png)

You should then see your address listed on the Address page. Tap on the address and it will open to a screen where you can enter the amount you would like to send. Enter the amount and tap CONTINUE. Enter your pin again.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/IMG_2021-473x1024.png)

This completes your transaction! You should see your MOB show up in your MobileCoin desktop wallet momentarily. Be aware that sometimes you may need to restart your desktop wallet for the transaction to appear.


Buying MobileCoin is as easy as following this guide on how to use MixSwap and the Mixin mobile app. MixSwap is an aggregator for 3 decentralized exchanges that allow you to buy MobileCoin by "swapping" Bitcoin, USDT, and other currencies for MobileCoin. To swap with MixSwap, you need to use Mixin. Mixin is a mobile app with a built-in crypto wallet. Like Signal, Mixin supports messaging your contacts with end-to-end encryption and is built on the Signal protocol.

Buy MOB with Mixin Wallet

MobileCoin can be sent between any two people with a mobile phone, anywhere in the world. Our partnership with the Signal Messenger app makes MobileCoin available to more than 100 million users across the globe. 

MobileCoin payments sent through Signal are fast, encrypted, and environmentally friendly. Your money arrives on time, every time.

* * * * *

Send Payments
-------------

THIS ACTION CAN NOT BE UNDONE. Be certain of where you are sending to.

1.  Go to Signal Settings > Payments > Send Payment.
2.  Select a contact that accepts payments.
3.  Enter the amount you want to send.
4.  Add a note and select the check mark.
5.  Tap Pay.
6.  Tap Confirm Payment.\
    Note: THIS ACTION CAN NOT BE UNDONE. Once you confirm, the funds will process.

or

1.  Go to the chat with your contact.
2.  Select the attachment icon and select Pay.
3.  Enter the amount you want to send.
4.  Add a note and select the check mark.
5.  Tap Pay.
6.  Tap Confirm Payment.\
    Note: THIS ACTION CAN NOT BE UNDONE. Once you confirm, the funds will process.


* * * * *

Transfer out to an exchange
---------------------------

THIS ACTION CAN NOT BE UNDONE. Be certain of where you are transferring to.

1.  Go to [Signal Settings](https://support.signal.org/hc/articles/360009091591) ![profile_avatar.png](https://support.signal.org/hc/article_attachments/360091706271/profile_avatar.png) > Payments > Menu > Transfer to exchange.
2.  Go to your exchange and view the wallet address.
3.  In Signal, scan or enter the wallet address from the exchange. For the address, look for the 26-35 string of numbers and letters most commonly below the QR code. 
4.  Tap Next.
5.  Tap Pay.
6.  Tap Confirm.\
    Note: THIS ACTION CAN NOT BE UNDONE.
    
* * * * *

Cancel or Undo Payment
----------------------

You can not cancel a payment once you have hit send. You can message your contact and ask them to send you a payment.

If you hit Send, your payment will process. Turning your phone off or disabling your connection will not stop the payment if you have hit send.


MobileCoin can be sent between any two people with a mobile phone, anywhere in the world. Our partnership with the Signal Messenger app makes MobileCoin available to more than 100 million users across the globe.

Send Payments


Transaction details, including the payment amount and time of transaction, are part of the MobileCoin ledger and are unknown to Signal.
-   View transaction history and details in Signal Settings > Payments.
-   Tap a transaction to see its status and message. 
-   After there are a few transactions, tap See All, to view sent and received activity separately.



Transaction details, including the payment amount and time of transaction, are part of the MobileCoin ledger and are unknown to Signal.
-   View transaction history and details in Signal Settings  Payments.
-   Tap a transaction to see its status and message. 
-   After there are a few transactions, tap See All, to view sent and received activity separately.

View Transactions

Enable your Signal PIN
----------------------
A Signal PIN is used to recover the wallet linked to your Signal account if you lose your phone or install the Signal app on a new phone. The PIN is unknown to Signal and it can not be reset if you forget it. To activate your wallet, you must have a Signal PIN enabled in Profile > Settings > Account.

* * * * *

Restore wallet with your PIN
------------------------------

Your balance will automatically restore when you reinstall Signal if you confirm your Signal PIN. 


* * * * *

Uninstalled Signal
------------------
It's okay if you uninstalled your Signal. Just Reinstall it and recover your wallet with your PIN or 24 word passphrase.

-   If you remember your [Signal PIN](https://support.signal.org/hc/articles/360007059792), you can recover settings and the wallet linked to your Signal account.
-   If you do not know your Signal PIN, you can register and restore the wallet linked to your Signal account with the 24 word passphrase. [Follow the steps listed above](https://support.signal.org/hc/en-us/articles/360057625692-In-app-Payments#payments_wallet_restore_passphrase).

* * * * *

View wallet passphrase
----------------------

You can also restore your balance using a recovery phrase, which is a 24-word phrase unique to you. Write it down and store it in a safe place. You can view this list again after creating.

1.  Go to Signal Settings > Payments > Menu > View Recovery Phrase.
2.  Tap Start.
3.  Record the 24 words in order.
4.  Tap Next.
5.  Enter the two words that are requested.
6.  Tap Done.
7.  Recovery passphrase is saved the first time you complete this.\
    Note: There is a limit to your attempts.
    
* * * * *

Restore wallet with passphrase
------------------------------

Restore the wallet linked to your Signal account by using the recovery passphrase you previously recorded. Your recovery passphrase is a total of 24 words.

1.  Have your 24 words available.
2.  Go to [Signal Settings](https://support.signal.org/hc/articles/360009091591) ![profile_avatar.png](https://support.signal.org/hc/article_attachments/360091706271/profile_avatar.png) > Payments > Restore Payments Account.
3.  Tap Start.
4.  Enter a word.
5.  Select Next.
6.  Repeat until all 24 words are entered in order.
7.  Review the recovery phrase list.
8.  Tap Next to submit the passphrase.
9.  If the passphrase is not correct you will start again from the beginning. 




Enable your Signal PIN
----------------------
A Signal PIN is used to recover the wallet linked to your Signal account if you lose your phone or install the Signal app on a new phone. The PIN is unknown to Signal and it can not be reset if you forget it. To activate your wallet, you must have a Signal PIN enabled in Profile  Settings  Account.

Backup & Restore Wallet

![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_07-1-e1635381496489.png)

The MobileCoin desktop wallet is available for [Mac](https://get.mobilecoin.com/mac), [Ubuntu](https://get.mobilecoin.com/ubuntu), [Redhat](https://get.mobilecoin.com/redhat) and [Linux](https://get.mobilecoin.com/linux) operating systems.

MobileCoin Desktop Wallet Download Process For Mac

If you've already downloaded and set up your MobileCoin desktop wallet, [learn how to add funds here. ](https://mobilecoin.com/news/how-to-buy-mob-in-the-us)

1.  1\. Allow downloads from [mobilecoin.com](http://mobilecoin.com/).
2.  2\. Open the MobileCoin Wallet installer from your downloads folder.
3.  3\. Drag the Wallet icon into your Applications folder.
4.  4\. Double-click the MobileCoin Wallet app in your Applications folder.
5.  5\. Allow your Mac to open the app.

    ![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_07-1-859x1024.png)
6.  6\. Create a password for your Wallet and click the TERMS OF USE.
7.  7\. Read through TERMS OF USE carefully.
8.  8\. Once complete, click CLOSE TERMS OF USE to return to set up.
9.  9\. Check the box next to "I have read and accept the TERMS OF USE" and click CREATE WALLET.
10. 10\. Choose an Account Name if desired and click CREATE ACCOUNT.

    ![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_11-849x1024.png)
11. 11\. Click SHOW SECRET ENTROPY. Save your Secret Entropy in a secure location and click I HAVE SECURED MY ENTROPY.
12. 12\. Confirm that you have secured your entropy, or go back to view it again.![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_13-853x1024.png) 
13. 13\. Set a Transaction Pin and a minimum MobileCoin amount for pin-activated transfers.
14. 14\. Click SET PIN.\
    ![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_14-853x1024.png)

Welcome to MobileCoin Wallet! [Now you're ready to add some money to your wallet!](https://mobilecoin.com/news/how-to-buy-mob-in-the-us)


Setup a Desktop Wallet


### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg) Move your MOB from the Fennec browser wallet to your MobileCoin desktop wallet

This is a really easy process. But first you have to download your MobileCoin desktop wallet and create an account. Once you've got your MobileCoin desktop wallet installed, it's simply a process of sending and receiving money, which you've done before.

Open your Fennec desktop wallet and choose SEND.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image9-1024x752.png)

Choose ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image8.png).

Make sure the top line says MOB and choose SELECT FROM ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image22-1024x706.png)

Here you will need to add your MOB wallet address. Click the + to add a new address. Open your MobileCoin desktop wallet and enter your password to unlock your wallet. Once your wallet is open, you will see your address (it is the square filled with lots of blue, white, and green letters and numbers). Click on the address block to copy it.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image10-blur-867x1024.png)

Back in your Fennec wallet, paste your address into the address box on the bottom. Name your address something memorable. Click SAVE. Fennec will make your re-enter your password. After you do, you will see a green button pop up that says SAVED SUCCESSFULLY.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image27-blur-1024x1018.png)

Click on the address box. This will open the send screen. Click into the box that says MOB and enter the amount you want to send.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image17-1024x652.png)

Hit the big orange button that says SEND. You should see another green button pop up that says SEND SUCCESSFULLY! Your MOB should appear in your MobileCoin wallet within a few seconds. If you don't see it appear automatically, log out and log back in to your wallet.


  Move your MOB from the Fennec browser wallet to your MobileCoin desktop wallet

Add Funds to Desktop


Deactivate Payments
-------------------

If you do not want to use the MobileCoin wallet in Signal, you can deactivate it. You will not be able to send or receive payments in Signal after you deactivate.

1.  Recommended: [View and copy the wallet passphrase before proceeding.](https://support.signal.org/hc/en-us/articles/360057625692-In-app-Payments#payments_wallet_view_passphrase)
2.  Go to [Signal Settings](https://support.signal.org/hc/articles/360009091591) ![profile_avatar.png](https://support.signal.org/hc/article_attachments/360091706271/profile_avatar.png) > Payments > Menu > Deactivate Payments.
3.  Recommended: Transfer a balance to use again.\
    Note: If you choose not to transfer, the balance will remain in your Signal account. 
4.  Tap Deactivate.



Deactivate

How to Use MobileCoin

<div class="lines-header">

<h1> the <strong>MobileCoin</strong> network</h1>

The MobileCoin open-source software ecosystem introduces several innovations to the cryptocurrency community, including:

<h3 style="color: #6aacd3">MobileCoin Ledger</h3>

a new encrypted blockchain built on a technology foundation that includes CryptoNote and Ring Confidential Transactions (RingCT)

<h3 style="color: #a7a7a8">MobileCoin Consensus Protocol</h3>

a high-performance solution to the Byzantine Agreement Problem that allows new payments to be rapidly confirmed

<h3 style="color: #85ccba">Secure Enclaves</h3>

trusted execution environments using Intel's Software Guard eXtensions (SGX) to provide defense-in-depth improvements to encryption and trust 

<h3 style="color: #95b4cf">MobileCoin Fog</h3>

a scalable service infrastructure that enables a smartphone to manage an encrypted cryptocurrency with locally-stored cryptographic keys

</div>

![](/images/ecosystem_diagram_1.png)

<h2 style="color: #6aacd3">MobileCoin Ledger</h2>

In order for any payments network to function, it must be able to maintain a history of transactions. MobileCoin Ledger describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a blockchain, in which each block contains transactions that include *transaction outputs (txos)* that might be spent in the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never been spent before. The underlying design is based on the encrypted CryptoNote ledger protocol, which obscures the identity of all txo owners using one-time recipient addresses. The link between sender and recipient is protected through the use of input rings that guard the actually-spent txo in a large set of possibly-spent txos.

The monetary value of each txo is encrypted using the method of Ring Confidential Transactions (RingCT). RingCT is implemented using bulletproofs for improved performance. Only the receiver of the transaction can reveal the encrypted monetary value and spend the new txos that are written to the ledger. The recipient's cryptographic control over spending ensures that all transactions in MobileCoin are irreversible, similar to cash transactions in the real world.

Each txo in the input ring of a transaction is annotated with a Merkle proof of inclusion in the MobileCoin Ledger blockchain. This allows new transactions to be validated with fewer blockchain read operations, improving efficiency and reducing information leaked to data-access side channels.

Additionally, the MobileCoin Ledger dramatically improves on the baseline security offered by CryptoNote and RingCT by requiring that the input rings for every transaction are deleted before the new payment is added to the public ledger. Digital signatures are added to the ledger in place of the full transaction records to provide a basis for auditing.  

<h2 style="color: #a7a7a8">MobileCoin Consensus Protocol</h2>

MobileCoin users must agree on the content of the blockchain for it to be useful as a record of accounts. Bad actors will have a financial motive to misrepresent the ledger to enable fraud and counterfeiting. In distributed computing, the challenge of reaching agreement in a group that can't exclude malicious agents from participating is called the Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement Problem.

The MobileCoin Consensus Protocol solves the Byzantine Agreement Problem by requiring each user to specify a set of peers that they trust, called a *quorum*. Quorums are based on the real-life trust relationships between individuals, businesses, and other organizations that compose the MobileCoin Network. There is no central authority in the MobileCoin Network. Users accept statements about the blockchain ledger when their quorum convinces them that these statements are true. While the algorithmic design of MCP is based on the Stellar Consensus Protocol, the MobileCoin Network is not interoperable with the Stellar payment network. 

The MobileCoin Consensus Protocol avoids the environmentally-damaging mathematical "work" required by Proof-of-Work (PoW) consensus protocols like Bitcoin and realizes a much higher transaction rate than the Bitcoin consensus protocol. In contrast to Proof-of-Stake (PoS) consensus protocols, practical control of governance in MCP is ceded to the users who are trusted the most by the extended MobileCoin community, rather than to the wealthiest users who control the largest financial stakes. 

MCP ensures that all operators agree on the sequence of valid payments that are completed. New transactions are grouped in blocks and published approximately once every five seconds to the MobileCoin Ledger.

<h2 style="color: #85ccba">Secure Enclaves</h2>

Recent advances in trusted computing make it possible to run software on a remote host without exposing sensitive data to that server's operator, even when she has complete control of the remote computer's operating system (i.e. root access). Originally designed for digital rights management, these *secure enclave* technologies behave like a black box that ensures confidentiality and integrity for its content.

The MobileCoin Network implements secure enclaves using Intel's Software Guard eXtensions (SGX) to process new transactions according to the MobileCoin Consensus Protocol. Any code that needs to observe the input rings of a new transaction executes inside the black box created by the SGX trusted execution environment. Remote attestation and end-to-end encryption are used to protect the communication channel between a user submitting a new transaction and the secure enclave running on the remote server. The operator of the remote server cannot access any data that the user submits to the secure enclave, and so cannot see the set of txos used in the transaction input ring.

Remote attestation and end-to-end encryption similarly protect the communication channels between secure enclaves running on different remote servers. When the SGX remote attestation system is functioning as Intel designed, it is not possible for any operator in the MobileCoin Network to observe the full content of transactions. Complete data is only shared between secure enclaves that safely delete the information that could otherwise be used to statistically associate payment senders to payment recipients. 

<h2>MobileCoin Fog</h2>

MobileCoin Fog is a scalable service infrastructure developed by MobileCoin to enable cryptocurrencies to be safely managed from a smartphone. Fog solves two major technical challenges of encrypted cryptocurrencies on mobile devices:
1. Identifying received payments 
2. Constructing new payments 

![](/images/ecosystem_diagram_2.png)

## Identifying Received Payments

In order to check if they own any new transaction that appears in the ledger, a user must mathematically test each txo using their private keys. It is undesirable from a security standpoint to provision private keys to a remote server to monitor for received transactions, but it is impractical to perform the calculation for every new transaction on a smartphone because of the significant bandwidth and computation required

MobileCoin has developed an efficient system to help smartphone users locate their received transactions without having to test every transaction using their private keys. Each transaction output in the MobileCoin Ledger contains a discovery *hint* field. This field stores the recipient's public address, encrypted using a public key provided by MobileCoin Fog. The matching private key is stored exclusively inside a secure enclave. Each new transaction in the public ledger is processed within the secure enclave, and recognized transactions are organized for users who have registered their public address.

Additional data transformations are necessary to safely store persistent data across a scalable service infrastructure and significant care is applied to avoid leaking information through data-access side channels. The user's private keys remain on their smartphone at all times. This stands in contrast to existing *trusted query services* prevalent in other cryptocurrencies. When users provision a remote server with private keys, they are trusting that remote service's operators not to expose or share the private keys.

## Constructing New Payments

Users need access to the complete ledger in order to construct transaction input rings. It is undesirable for smartphone users to selectively download parts of the ledger from a remote server as needed, since this can potentially leak information about transaction ownership or the links between senders and recipients. The complete ledger may be many terabytes in size, which makes it impractical to download and store on a smartphone.

MobileCoin Fog allows smartphone users to selectively download ledger data using oblivious data access, meaning that the user can safely retrieve transactions or blocks from the ledger to build new payments without needing to store a complete copy of the blockchain. MobileCoin Cloud uses secure enclaves to implement oblivious data access with improved trust and efficiency.


The MobileCoin open-source software ecosystem introduces several innovations to the cryptocurrency community, including its Ledger, Consensus Protocol, Secure Enclaves, and Fog.

Overview


### Supply

MobileCoin's total current supply of coins is 250 million MOB.  The total supply is fixed, and you can see this in our open source code here: [total current supply of coins](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/transaction/core/src/constants.rs).  The live circulating supply is 
available here: [current circulating supply](https://mobilecoin.foundation/wp-json/mcfoundation/circulating-supply). 

[widget type='circulatingSupply']

The entire supply of MobileCoins was created in the very first block on the blockchain. MobileCoin uses 'Federated Byzantine Agreement' modeled on the the [Stellar Consensus Protocol](https://www.stellar.org/papers/stellar-consensus-protocol?locale=en). This sets MobileCoin apart from Bitcoin and other cryptocurrencies that use 'Proof-of-Work' a process that allows the bitcoin network to construct the ledger by making the process of recording transactions difficult, also known as 'bitcoin mining.' Mining requires a large amount of computing power and miners earn 'block rewards.' This encourages miners to invest in adding greater and greater computing resources to add more miners to the network. The more computers they put on the network, the more bitcoin they can receive. MobileCoin does not incentivize this type of behavior with block rewards.

MobileCoin is an encrypted cryptocurrency where amounts are hidden behind cryptographic constructions; therefore, it is not possible for observers to passively verify that the origin block contains 250 million MOB. Below you will find instructions on how to access and inspect the origin account.


### Verifying the Supply

You can verify the supply of MobileCoin using the Origin Block Account.

`Origin Block Account Entropy:\
aa9082086d4f341300d3ba08d41db566edc9fb61eec623870b80871681a589eb\
{\
"view_private_key":\
"d825a5c3aaef812d17feba5cf8f3019bcb0608c0a673200fa425e56eb1dc2d0b",\
"spend_private_key":\
"9e95df3801c4b6ab0be854377430e18528546be71335e2afb91f058b3013380f"\
}`

The MobileCoin ledger is denominated in pico MOB (pMOB), where 1 MOB = 10¹² pMOB.

This means the origin block should have 2.5 * 10²⁰ pMOB. You'll note that this exceeds the [maximum value of a u64](https://doc.rust-lang.org/std/primitive.u64.html#associatedconstant.MAX) (~1.8 * 10¹⁹), which is the maximum amount that can be stored in a MobileCoin Txo. For this reason, the origin block is split into 16 Txos, as opposed to a single Txo containing 250M MOB.

MobileCoin currently supports multiple wallet software implementations (see Forum discussion: [Desktop Wallets](https://community.mobilecoin.foundation/t/desktop-wallets/566)). We will describe how to verify the origin block using the Full-Service wallet.

### Verification Steps with Full-Service Desktop Wallet

1.  Download or build the latest MainNet-configured Full-Service binary. See the latest release, which has instructions for building.
2.  Run the MainNet-configured Full-Service binary. See the latest release for an example run command.
3.  Make an account with the origin entropy in a new terminal window via the [`import_account_from_legacy_root_entropy`](https://app.gitbook.com/@mobilecoin/s/full-service-api/accounts/account/import_account_from_legacy_root_entropy-deprecated) endpoint. See the [MobileCoin Key Derivation Upgrade: Migration to Mnemonics](https://medium.com/mobilecoin/mobilecoin-key-derivation-upgrade-migration-to-mnemonics-99a329a8b783) post to understand why root entropies are 'legacy' (i.e. no longer actively supported).\
    `curl -s localhost:9090/wallet \\
    -d '{\
    "method": "import_account_from_legacy_root_entropy",\
    "params": {\
    "entropy": "aa9082086d4f341300d3ba08d41db566edc9fb61eec623870b80871681a589eb",\
    "name": "Origin",\
    "next_subaddress_index": "2",\
    "first_block_index": "0"\
    },\
    "jsonrpc": "2.0",\
    "id": 1\
    }' \\
    -X POST -H 'Content-type: application/json' | jq`
4.  Note the `account_id` that is produced, and then check the balance via [`get_balance_for_account`](https://app.gitbook.com/@mobilecoin/s/full-service-api/accounts/balance/get_balance_for_account).\
    `curl -s localhost:9090/wallet \\
    -d '{\
    "method": "get_balance_for_account",\
    "params": {\
    "account_id": "<your-account-id-here>"\
    },\
    "jsonrpc": "2.0",\
    "id": 1\
    }' \\
    -X POST -H 'Content-type: application/json' | jq`\
    The account was already emptied, so `unspent_pmob = 0` (note that the `spent_pmob` value is nonsense caused by integer overflow). If you have lightning fingers and manage to check the balance fast enough (before more than the origin block has synced), you will see the balance is 250 million MOB.\
    `{\
    "method": "get_balance_for_account",\
    "result": {\
    "balance": {\
    "object": "balance",\
    "network_block_index": "10253",\
    "local_block_index": "1",\
    "account_block_index": "1",\
    "is_synced": false,\
    "unspent_pmob": "250000000000000000000",\
    "pending_pmob": "0",\
    "spent_pmob": "0",\
    "secreted_pmob": "0",\
    "orphaned_pmob": "0"\
    }\
    },\
    "error": null,\
    "jsonrpc": "2.0",\
    "id": 1\
    }`
5.  To dive in deeper, you can use the [`get_all_txos_for_account`](https://app.gitbook.com/@mobilecoin/s/full-service-api/transactions/txo/get_all_txos_for_account) endpoint to see which outputs were received, and which blocks they were spent in.\
    `curl -s localhost:9090/wallet \\
    -d '{\
    "method": "get_all_txos_for_account",\
    "params": {\
    "account_id": "<your-account-id-here>"\
    },\
    "jsonrpc": "2.0",\
    "id": 1\
    }' \\
    -X POST -H 'Content-type: application/json' | jq`\
    There are 19 outputs owned by the origin account, however only 16 are 'origin outputs' (with 15.625 mill MOB each). Outputs with `received_block_index = 0` were created in the origin block. The remaining 3 outputs correspond to either self-spends (sending MOB to yourself) or change outputs (left-over MOB from sending to other people).


Circulating Supply

Each transaction submitted to the MobileCoin network must pay a fee to the MobileCoin Foundation. The purpose of this fee is to prevent unlimited submission of transactions, which otherwise could be easily abused to degrade users' experience. The [minimum fee per transaction](https://github.com/mobilecoinfoundation/mobilecoin/blob/acd72e66832c1aa18dc630bcab610c11978af0dd/transaction/core/src/constants.rs) is 0.0004 MOB, and is always distributed to the following [address](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/consensus/enclave/impl/build.rs) (written in hexadecimal format):

`public view key:\
5222a1e9ae32d21c23114a5ce6bb39e0cb56aea350d4619d43b1207061b10346\
public spend key:\
26b507c63124a2f5e940b4fb89e4b2bb0a2078ed0c8e551ad59268b9646ec241`

MobileCoin launched with a hard-coded minimum fee of 0.01 MOB. When this constant was set, the value of MobileCoin was assumed to be slightly below 1 USD per coin, resulting in a per-transaction fee of under 0.01 USD (1c). This fee was too high to reasonably support the cannonical use-case---purchasing a cup of coffee---and we lowered the fee to $0.04 to bring it back in line with that use-case. 

There is currently a [proposal](https://github.com/mobilecoinfoundation/mcips/pull/1) for the minimum fee to be [configurable](https://github.com/mobilecoinfoundation/mobilecoin/pull/809) in the next version of MobileCoin's protocol. Changing the fee configuration would require a coordinated restart of all validator nodes in the network. 


Each transaction submitted to the MobileCoin network must pay a fee to the MobileCoin Foundation. The purpose of this fee is to prevent unlimited submission of transactions, which otherwise could be easily abused to degrade users' experience. The [minimum fee per transaction](https://github.com/mobilecoinfoundation/mobilecoin/blob/acd72e66832c1aa18dc630bcab610c11978af0dd/transaction/core/src/constants.rs) is 0.0004 MOB, and is always distributed to the following [address](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/consensus/enclave/impl/build.rs) (written in hexadecimal format):

Transaction Fees


<img src="https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/08/smoke-header.png" width="400">

MobileCoin has a significantly smaller impact on our planet and uses far less energy compared to other cryptocurrencies. Here is why:

-   The driver of energy usage in major cryptocurrencies is the consensus mechanism known as "Proof of Work." On a computer, "Work" equates to CPU cycles, which cost energy, and "[Proof of Work](https://bitcoin.org/bitcoin.pdf)" incentivizes miners (people who volunteer their computers to spin through enormous numbers of those cycles), to verify transactions.
-   Estimates put Bitcoin power usage at 128,000,000,000 kWh per year*, which is similar to the entire energy consumption of the country of Argentina**. In comparison, you could power all of MobileCoin with the same energy to power a few households.
-   MobileCoin uses a network consensus model known as Federated Byzantine Agreement (FBA). Unlike mining (which uses Proof of Work), the energy to consense on MobileCoin transactions is nearly zero.

Alexander Rose, Executive Director of [The Long Now](http://longnow.org/), reflects on sustainability:

> "The inherent problem with previous cryptographic systems that require computers to burn energy doing math means that greed will always be at odds with energy usage, and therefore at odds with earth's climate. We want to make sure there are ways of doing secure and encrypted financial transactions without this level of Proof of Work."

With MobileCoin's blockchain design, we've pioneered a far more sustainable route to building the future of digital payments.

For more details and data on MobileCoin's energy usage, please read the technical explanation below.

. . .

Technical Explanation
---------------------

![](https://miro.medium.com/max/1400/1*pqhWTTuAEdfG5EIgDyBsmQ.png)

From University of Cambridge, Centre for Alternative Finance, https://cbeci.org/

### Background: Consensus Mechanisms

At its core, a cryptocurrency is a collection of transaction events. These are messages that say things like, "I will send 5 MOB to Carol." Users submit these messages to the decentralized network, and if nodes in that network think the messages are legitimate and valid, then the messages will be added to the collection of historical events.

However, decentralized networks don't have centralized arbiters of ultimate truth. Each node (i.e. network participant) is inclined to accept valid messages as they appear. If two legitimate messages are submitted to different nodes at the same time, but those messages contradict each other, then those nodes will be in conflict if they immediately accept the messages they see. For instance, if I only have 5 MOB and write the two messages "I will send 5 MOB to Bob" and "I will send 5 MOB to Carol," there is no way two nodes that obtain the messages can be in agreement.

This is a coordination problem. Nodes in different parts of the network will hear about messages (transactions) at different times. They need to coordinate with each other to prevent accidental disagreements.

Note that cryptocurrencies decide the "order of events" by recording transactions in "blockchains." A blockchain is a series of "blocks," where each block contains a collection of transactions. Blocks are appended to the chain one after the other.

### High Energy Usage in Proof of Work

In the [original proposal](https://bitcoin.org/bitcoin.pdf), Satoshi Nakamoto outlined a network coordination mechanism known as Proof of Work.

When nodes want to make new blocks, they must guess-and-check a difficult computation problem (they compute a hash function over and over until the output meets a difficult criteria). If blocks are produced rapidly, then the "difficulty" of the computation will rise (it will fall if blocks are produced too slowly). This means if a large amount of computational power is used, then the "cumulative difficulty" over successive blocks will also be large (it is easier to solve the computation problem with more computational power).

The blockchain with the highest cumulative difficulty is always assumed to be the "official" chain. Since the network is decentralized, it is still possible for nodes to temporarily create blocks that contradict each other. However, a node will always discard (or "orphan") blocks if it sees a chain with higher cumulative difficulty. Over time, the network is inclined to stay intact as all participants track the mathematically "official" chain.

Why would nodes bother wasting energy on Proof of Work? Simply, they are awarded for creating blocks. So-called "block rewards" are newly minted coins granted to block creators (transaction fees are also added to these rewards).

### Measuring Energy Consumption of Cryptocurrencies

#### Proof of Work

In Proof of Work systems, the energy cost of the network is easily estimated, because at equilibrium the marginal cost of adding/removing hash power is equal to the marginal gain/loss of revenue.

In other words, the amount of energy expended over a time-span in a Proof of Work system is approximately equal to the amount of energy (electricity) that can be purchased by block rewards over that time-span. In other systems, it's not so straightforward.

#### Proof of Stake

In Proof of Stake, a participant puts some amount of their own coins into an escrow wallet while they validate transactions and construct blocks. In each "unit of time" (e.g. 1 second), each stake-holder has a probability of making a new block proportional to the fraction of coins they own relative to the total number of coins that exist. Nodes are incentivized to construct blocks honestly, otherwise their staked coins will become worthless if falsification is discovered (similar to the concept of 'wasting energy' working on useless blocks in the Proof of Work model).

Proof of Stake requires far less energy than Proof of Work, because block construction only relies on the energy required to validate transactions and run the basic consensus mechanism.

Therefore, the energy usage for Proof of Stake networks is lower-bounded by the energy for the participants to sit idle. This [excellent article](https://medium.com/tqtezos/proof-of-work-vs-proof-of-stake-the-ecological-footprint-c58029faee44) on Tezos discusses energy use in their Proof of Stake network.

#### Federated Byzantine Agreement (FBA)

The Federated Byzantine Agreement model is categorically different from Proof of Work and Proof of Stake, where one node somewhere in the network creates each block. Instead, nodes using FBA collaborate to reach agreement on statements before those statements are considered "final" by any node. The [Stellar Consensus Protocol](https://www.stellar.org/papers/stellar-consensus-protocol?locale=en) (SCP) is a sophisticated protocol that implements FBA.

In SCP, many nodes collaborate to decide the contents of each block before the block is created. Doing so enables a faster, more efficient network, because it is not necessary to spend time resolving conflicts between different parts of the network (or waiting for those conflicts to be resolved).

Similar to Proof of Stake, the power consumption of an SCP network is lower-bounded by the energy of the participants to sit idle.

### MobileCoin Power Consumption: Back of the Envelope

In MobileCoin, the FBA participants are located in remote cloud services on Intel SGX-capable machines. If we dive into Microsoft Azure, a cloud provider used by operators on the MobileCoin network, we find they offer Intel SGX in their Confidential Compute platform through the [DC-series](https://docs.microsoft.com/en-us/azure/virtual-machines/dcv2-series).

In [How Can I Calculate CO2eq emissions for my Azure VM?](https://devblogs.microsoft.com/sustainable-software/how-can-i-calculate-co2eq-emissions-for-my-azure-vm/), we get an estimate of around 4.302 kWh for a 24 hour period on a standard machine. If we double this value, to give some breathing room, since we don't have data on a DC-series machine, then we have about 10 kWh per day, which gives us about 3,600 kWh per year, per server.

The current size of the network is around 10 nodes, so we can estimate around 36,000 kWh per year for the network, [which is on the order of a home](https://www.eia.gov/tools/faqs/faq.php?id=97&t=3), with estimates at 10,649 kWh per year per home. Even with many more nodes, the energy consumption of the MobileCoin network will still be on the order of a neighborhood as opposed to a country.

This estimate of the network size does not include "watcher nodes." Watcher nodes listen to validator nodes and record the blocks created by the consensus network (which is composed of validator nodes). Any user of MobileCoin can easily set up and run their own watcher node, so it isn't possible to estimate how many watchers are running now, or will be running in the future. However, it is reasonable to assume that in the long run there will be between 10x and 1000x as many watcher nodes as validator nodes. Watcher nodes should not require more power consumption than validator nodes.

In the long run, the MobileCoin network can be expected to use less energy than that of a small town with e.g. ~5,000 residents, even if MobileCoin becomes a global phenomenon.

. . .

By [Sara Drakeley](https://medium.com/@saradrakeley), [koe](https://medium.com/@koe000), and [Emily Huh](https://medium.com/@emilyhuh)

**University of Cambridge, Centre for Alternative Finance*: <https://cbeci.org/>

** Argentina energy consumption: <https://www.worlddata.info/america/argentina/energy-consumption.php>


Energy Usage

MobileCoin nodes must agree on the content of the blockchain for it to be useful as a record of accounts. Bad actors
will have a financial motive to misrepresent the ledger to enable fraud and counterfeiting. In distributed computing,
the challenge of reaching agreement in a group that cannot exclude malicious agents from participating is called the
Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement
Problem.

The MobileCoin Consensus Protocol solves the Byzantine Agreement Problem by requiring each user to specify a set of
peers that they trust, called a quorum. Quorums are based on the real-life trust relationships between individuals,
businesses, and other organizations that compose the MobileCoin Network. There is no central authority in the MobileCoin
Network. Users accept statements about the blockchain ledger when their quorum convinces them that these statements are
true. While the algorithmic design of MCP is based on the Stellar Consensus Protocol, the MobileCoin Network is not
interoperable with the Stellar payment network.

The MobileCoin Consensus Protocol avoids the environmentally-damaging mathematical “work” required by Proof-of-Work
(PoW) consensus protocols like Bitcoin and realizes a much higher transaction rate than the Bitcoin consensus protocol.
In contrast to Proof-of-Stake (PoS) consensus protocols, practical control of governance in MCP is ceded to the users
who are trusted the most by the extended MobileCoin community, rather than to the wealthiest users who control the
largest financial stakes.

MCP ensures that all operators agree on the sequence of valid payments that are completed. New transactions are grouped
in blocks and published approximately once every five seconds to the MobileCoin Ledger.

### Show Me the Code

* [Consensus Service](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/service): The implementation of the MobileCoin Consensus Protocol Service
* [SCP](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/scp): MobileCoin's implementation of the Stellar Consensus Protocol


MobileCoin nodes must agree on the content of the blockchain for it to be useful as a record of accounts. Bad actors
will have a financial motive to misrepresent the ledger to enable fraud and counterfeiting. In distributed computing,
the challenge of reaching agreement in a group that cannot exclude malicious agents from participating is called the
Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement
Problem.

Byzantine Agreement

In order for any payments network to function, it must be able to maintain a history of transactions. MobileCoin Ledger
describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a 
blockchain, in which each block contains transactions that include transaction outputs (txos) that might be spent in 
the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never 
been spent before. The underlying design is based on the privacy-preserving CryptoNote ledger protocol, which obscures 
the identity of all txo owners using one-time recipient addresses. The link between sender and recipient is protected 
through the use of input rings that guard the actually-spent txo in a large set of possibly-spent txos.

The monetary value of each txo is encrypted using the method of Ring Confidential Transactions (RingCT). RingCT is 
implemented using bulletproofs for improved performance. Only the receiver of the transaction can reveal the encrypted
monetary value and spend the new txos that are written to the ledger. The recipient’s cryptographic control over
spending ensures that all transactions in MobileCoin are irreversible, similar to cash transactions in the real world.

Each txo in the input ring of a transaction is annotated with a Merkle proof of inclusion in the MobileCoin Ledger
blockchain. This allows new transactions to be validated with fewer blockchain read operations, improving efficiency
and reducing information leaked to data-access side channels.

Additionally, MobileCoin Ledger dramatically improves on the baseline privacy offered by CryptoNote and RingCT by
requiring that the input rings for every transaction are deleted before the new payment is added to the public ledger.
Digital signatures are added to the ledger in place of the full transaction records to provide a basis for auditing.

### Show Me the Code

* [Ledger Crate](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/ledger): the implementation of the MobileCoin ledger using LMDB as the data store.
* [Transaction Crate](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/transaction/core): Implementation of MobileCoin transactions.

### Tech Talk: Transactions

For a walk through of how the MobileCoin Transaction Protocol works, see [MobileCoin Tech Talk #1: Transactions](https://www.youtube.com/watch?v=e9afDQ_M5CU)


In order for any payments network to function, it must be able to maintain a history of transactions. MobileCoin Ledger
describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a 
blockchain, in which each block contains transactions that include transaction outputs (txos) that might be spent in 
the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never 
been spent before. The underlying design is based on the privacy-preserving CryptoNote ledger protocol, which obscures 
the identity of all txo owners using one-time recipient addresses. The link between sender and recipient is protected 
through the use of input rings that guard the actually-spent txo in a large set of possibly-spent txos.

Transaction Protocol

The MobileCoin Consensus Validator is a vital part of a scalable service infrastructure that enables a smartphone to
manage an encrypted cryptocurrency with locally-stored cryptographic keys. A Consensus Validator node, which
runs Intel’s Software Guard eXtensions (SGX), is one type of node that runs in the MobileCoin ecosystem. The validator
node provides defense-in-depth improvements to encryption and trust.

## Running Your Own Consensus Validator Node

To learn more and run a validator node on the MobileCoin network, please review the runbook: [Consensus Validator Node Runbook](https://mobilecoin.gitbook.io/mobilecoin-consensus-fog/)

The key to operating a Consensus Validator Node is trust. It is your responsibilty to only include operators you _trust_ in your quorum set, and for other operators to only include your validator if they trust you. This is vital for the operation of the MobileCoin network.


The MobileCoin Consensus Validator is a vital part of a scalable service infrastructure that enables a smartphone to
manage an encrypted cryptocurrency with locally-stored cryptographic keys. A Consensus Validator node, which
runs Intel’s Software Guard eXtensions (SGX), is one type of node that runs in the MobileCoin ecosystem. The validator
node provides defense-in-depth improvements to encryption and trust.

Validators

Watcher nodes perform an essential role in the MobileCoin network by verifying the signatures that the full validator nodes attach to each block. In this way the watcher nodes continuously monitor the integrity of the decentralized MobileCoin network.

### Timestamps

Watchers can also be used to sync metadata from multiple Consensus Validator Nodes. For example, the Watcher can be used
in systems that require the timestamp from each node per block.

### Blockchain Explorer

The Watcher provides the backend for the [Blockchain Explorer](https://block-explorer.0--0.net/) (Beta), which serves 
the block signatures, timestamps, TXO data, and key_images per block.

### Show Me the Code

* [Watcher](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/watcher): Implementation of the watcher
* [mobilecoind](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/mobilecoind): Ledger-syncing daemon that can be run in "Watcher Mode"

Basic run command to sync block signatures from two nodes on the test network:

Create a `sources.toml` file, for example:

```source-toml
[[sources]]
tx_source_url = "https://s3-us-west-1.amazonaws.com/mobilecoin.chain/node1.test.mobilecoin.com/"
consensus_client_url = "mc://node1.test.mobilecoin.com/"

[[sources]]
tx_source_url = "https://s3-us-west-1.amazonaws.com/mobilecoin.chain/node2.test.mobilecoin.com/"
consensus_client_url = "mc://node2.test.mobilecoin.com/"
```

Run the watcher:

```source-shell
SGX_MODE=HW IAS_MODE=PROD MC_LOG=debug,hyper=error,want=error,reqwest=error,mio=error,rustls=error\
    cargo run -p mc-watcher --bin mc-watcher --\
    --sources-path sources.toml\
    --watcher-db /tmp/watcher-db
```

The watcher can also be incorporated into other programs, as in [`mobilecoind`](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/mobilecoind/README.md), where the watcher continuously syncs block signatures, and `mobilecoind` offers an interface to query block signatures for watched nodes through the mobilecoind API.

In order to check that the watcher is running, you can send a gRPC request to the health check endpoint:

```source-shell
grpcurl -proto ./util/grpc/proto/health_api.proto -plaintext localhost:3226 grpc.health.v1.Health/Check
```


Watcher nodes perform an essential role in the MobileCoin network by verifying the signatures that the full validator nodes attach to each block. In this way the watcher nodes continuously monitor the integrity of the decentralized MobileCoin network.

Watchers

Network

# Cryptocurrency designed to be used.

MobileCoin is an effort to develop a fast, private, and easy-to-use cryptocurrency that can be deployed in resource constrained environments to users who aren’t equipped to reliably maintain secret keys over a long period of time, all without giving up control of funds to a payment processing service. 

In the MobileCoin whitepaper, the project’s creators describe its mission: “MobileCoin is designed so that a mobile messaging application like Signal can integrate with a MobileCoin wallet,” the team described in its whitepaper.

# [Download the Whitepaper](https://mobilecoin.foundation/pdf/MobileCoin_White_Paper.pdf)

[widget type='pdfViewer' pdf='//mobilecoin.foundation/pdf/MobileCoin_White_Paper.pdf']



MobileCoin is an effort to develop a fast, private, and easy-to-use cryptocurrency that can be deployed in resource constrained environments to users who aren’t equipped to reliably maintain secret keys over a long period of time, all without giving up control of funds to a payment processing service.

MobileCoin's Mission

One of the most comprehensive conceptual and documents about MobileCoin is the [Mechanics of MobileCoin](https://raw.githubusercontent.com/UkoeHB/Mechanics-of-MobileCoin/master/Mechanics-of-MobileCoin-v0-0-39-preview-10-11.pdf). 
This document was written by [Koe](https://github.com/UkoeHB) to describe every aspect of the protocol and network from the ground up.


# [Download Whitepaper](https://raw.githubusercontent.com/UkoeHB/Mechanics-of-MobileCoin/master/Mechanics-of-MobileCoin-v0-0-39-preview-10-11.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/UkoeHB/Mechanics-of-MobileCoin/master/Mechanics-of-MobileCoin-v0-0-39-preview-10-11.pdf']



One of the most comprehensive conceptual and documents about MobileCoin is the [Mechanics of MobileCoin](https://raw.githubusercontent.com/UkoeHB/Mechanics-of-MobileCoin/master/Mechanics-of-MobileCoin-v0-0-39-preview-10-11.pdf). 
This document was written by [Koe](https://github.com/UkoeHB) to describe every aspect of the protocol and network from the ground up.

Mechanics of MobileCoin

## Securing Payments at Scale
This article covers our security strategy for building a safe and secure digital currency. We will discuss why decentralization is important, how Bitcoin offers digital gold, and why digital gold is not the digital cash needed for payments. Next, we'll discuss what CryptoNote offers for distributed ledgers, how the MobileCoin ledger further protects users, and how remote attestation can help prove that servers you don't control are running the right software. 

# [Download the Whitepaper](https://github.com/mobilecoinofficial/developer-portal/blob/main/info/defense-in-depth.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/defense-in-depth.pdf']



 Securing Payments at Scale
This article covers our security strategy for building a safe and secure digital currency. We will discuss why decentralization is important, how Bitcoin offers digital gold, and why digital gold is not the digital cash needed for payments. Next, we'll discuss what CryptoNote offers for distributed ledgers, how the MobileCoin ledger further protects users, and how remote attestation can help prove that servers you don't control are running the right software.

Defense in Depth

# Bitcoin: A Peer-to-Peer Electronic Cash System

Satoshi Nakamoto's original Bitcoin paper is recommended reading for anyone learning how MobileCoin works. With the introduction of the bitcoin whitepaper by Satoshi Nakamoto in 2009, the world got its first taste of an peer-to-peer electronic payment system with decentralized governance. Satoshi’s vision for Bitcoin was “an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.”  

[widget type='pdfViewer' pdf='//github.com/mobilecoinofficial/developer-portal/raw/main/info/bitcoin.pdf']

Choose which translation of the paper you want to read:
-   **[English (Original)](https://bitcoin.org/bitcoin.pdf)**
-   [Հայերեն](https://bitcoin.org/files/bitcoin-paper/bitcoin_am.pdf)
-   [Bahasa Indonesia](https://bitcoin.org/files/bitcoin-paper/bitcoin_id.pdf)
-   [Català](https://bitcoin.org/files/bitcoin-paper/bitcoin_ca.pdf)
-   [Czech](https://bitcoin.org/files/bitcoin-paper/bitcoin_cz.pdf)
-   [Deutsch](https://bitcoin.org/files/bitcoin-paper/bitcoin_de.pdf)
-   [Español (España)](https://bitcoin.org/files/bitcoin-paper/bitcoin_es.pdf)
-   [Español (Latinoamericano)](https://bitcoin.org/files/bitcoin-paper/bitcoin_es_latam.pdf)
-   [Français](https://bitcoin.org/files/bitcoin-paper/bitcoin_fr.pdf)
-   [Italiano](https://bitcoin.org/files/bitcoin-paper/bitcoin_it.pdf)
-   [Lietuvių Kalba](https://bitcoin.org/files/bitcoin-paper/bitcoin_lt.pdf)
-   [Magyar Nyelv](https://bitcoin.org/files/bitcoin-paper/bitcoin_hu.pdf)
-   [Nederlands](https://bitcoin.org/files/bitcoin-paper/bitcoin_nl.pdf)
-   [Norsk (Bokmål)](https://bitcoin.org/files/bitcoin-paper/bitcoin_no.pdf)
-   [Polski](https://bitcoin.org/files/bitcoin-paper/bitcoin_pl.pdf)
-   [Português](https://bitcoin.org/files/bitcoin-paper/bitcoin_pt.pdf)
-   [Português Brasileiro](https://bitcoin.org/files/bitcoin-paper/bitcoin_pt_br.pdf)
-   [Română](https://bitcoin.org/files/bitcoin-paper/bitcoin_ro.pdf)
-   [Slovenščina](https://bitcoin.org/files/bitcoin-paper/bitcoin_sk.pdf)
-   [српски](https://bitcoin.org/files/bitcoin-paper/bitcoin_sr.pdf)
-   [Suomen kieli](https://bitcoin.org/files/bitcoin-paper/bitcoin_fi.pdf)
-   [Svenska](https://bitcoin.org/files/bitcoin-paper/bitcoin_se.pdf)
-   [Türkçe](https://bitcoin.org/files/bitcoin-paper/bitcoin_tr.pdf)
-   [ελληνικά](https://bitcoin.org/files/bitcoin-paper/bitcoin_gr.pdf)
-   [मानक हिन्दी](https://bitcoin.org/files/bitcoin-paper/bitcoin_hi.pdf)
-   [Русский](https://bitcoin.org/files/bitcoin-paper/bitcoin_ru.pdf)
-   [Tiếng Việt](https://bitcoin.org/files/bitcoin-paper/bitcoin_vi.pdf)
-   [Yкраїнська](https://bitcoin.org/files/bitcoin-paper/bitcoin_uk.pdf)
-   [한국어](https://bitcoin.org/files/bitcoin-paper/bitcoin_ko.pdf)
-   [日本語](https://bitcoin.org/files/bitcoin-paper/bitcoin_jp.pdf)
-   [ภาษาไทย](https://bitcoin.org/files/bitcoin-paper/bitcoin_th.pdf)
-   [简化字](https://bitcoin.org/files/bitcoin-paper/bitcoin_zh_cn.pdf)
-   [বাংলা](https://bitcoin.org/files/bitcoin-paper/bitcoin_bn.pdf)
-   [Estonian](https://bitcoin.org/files/bitcoin-paper/bitcoin_et.pdf)
-   [Albanian](https://bitcoin.org/files/bitcoin-paper/bitcoin_al.pdf)
-   [Croatian](https://bitcoin.org/files/bitcoin-paper/bitcoin_hr.pdf)
-   [Braille](https://bitcoin.org/files/bitcoin-paper/bitcoin-braille.pdf)
-   [Nepali](https://bitcoin.org/files/bitcoin-paper/bitcoin_np.pdf)
-   [Basque](https://bitcoin.org/files/bitcoin-paper/bitcoin_basque.pdf)



Satoshi Nakamoto's original Bitcoin paper is recommended reading for anyone learning how MobileCoin works. With the introduction of the bitcoin whitepaper by Satoshi Nakamoto in 2009, the world got its first taste of an peer-to-peer electronic payment system with decentralized governance. Satoshi’s vision for Bitcoin was “an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.”

Bitcoin

In order for any payments network to function, it must be able to maintain a history of transactions. The MobileCoin Ledger stores payment records in a public ledger. The ledger is implemented as a blockchain, in which each block contains transactions that include transaction outputs (txos). Each transaction also includes a proof that all value spent in the transaction has never been spent before. The underlying design is based on the privacy-preserving CryptoNote ledger protocol, which obscures the identity of all txo owners using one-time recipient addresses. 

In 2012, Nicolas van Saberhagen, an unknown anonymous author, published the CryptoNote whitepaper describing a new distributed ledger protocol called CryptoNote. At its core, CryptoNote is an attempt to improve on the design of Bitcoin to create an encrypted ledger.

## Ring Signatures
Ring signatures had existed for nearly a decade and a half prior to CryptoNote. The link between sender and recipient is protected through the use of input rings that guard the actually-spent txo in a large set of possibly-spent txos. Ring signatures make it harder to statistically analyze the network by changing the direct links between buyers and sellers used in Bitcoin into probabilistic links between sets of possible buyers and sellers. Every transaction has a set of possible ancestors which makes tracking payments in the public ledger much more difficult. 

## One-time addresses
CryptoNote's one-time addresses allow payments to be received using numerical aliases that are indistinguishable from random numbers for everyone except the intended recipient. Essentially, every transaction in Bitcoin publicly shares the recipient's pseudonymous address, while CryptoNote ledgers publish the recipient's address in an encrypted format that protects user data.

# [Download the Whitepaper](https://github.com/mobilecoinofficial/developer-portal/blob/main/info/cryptonote.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/cryptonote.pdf']


In order for any payments network to function, it must be able to maintain a history of transactions. The MobileCoin Ledger stores payment records in a public ledger. The ledger is implemented as a blockchain, in which each block contains transactions that include transaction outputs (txos). Each transaction also includes a proof that all value spent in the transaction has never been spent before. The underlying design is based on the privacy-preserving CryptoNote ledger protocol, which obscures the identity of all txo owners using one-time recipient addresses.

CryptoNote

CryptoNote ledgers are significantly more secure than Bitcoin, but they still leave the amount of each transaction in plain sight. On the MobileCoin ledger, the monetary value of each txo is encrypted using the method of Ring Confidential Transactions (RingCT) published in 2016 by Shen Noether.

RingCT protects the amount exchanged in each transaction using cryptography. Rather than publish the value that is exchanged, RingCT transactions include a mathematical proof that the transaction is balanced, meaning that the recipient didn’t receive more money than the sender spent. 

Only the receiver of the transaction can reveal the encrypted monetary value and spend the new txos that are written to the ledger. The recipient’s cryptographic control over spending ensures that all transactions in MobileCoin are irreversible, similar to cash transactions in the real world.

# [Download the Whitepaper](https://raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/ringct.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/ringct.pdf']


CryptoNote ledgers are significantly more secure than Bitcoin, but they still leave the amount of each transaction in plain sight. On the MobileCoin ledger, the monetary value of each txo is encrypted using the method of Ring Confidential Transactions (RingCT) published in 2016 by Shen Noether.

Ring Confidential Transactions

# Bitter to Better — How to Make Bitcoin a Better Currency

The first peer-reviewed article about Bitcoin written by Simon Barber and the team at the University of California, Berkeley, is a great reflection on how Bitcoin was successful, but lacks the anonymity required for digital cash. They perform an in-depth investigation to understand what made Bitcoin so successful, analyze the biggest problems issues of Bitcoin, and propose suitable techniques to make Bitcoin better.

# [Download the Whitepaper](https://github.com/mobilecoinofficial/developer-portal/blob/main/info/bittertobetter.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/bittertobetter.pdf']


The first peer-reviewed article about Bitcoin written by Simon Barber and the team at the University of California, Berkeley, is a great reflection on how Bitcoin was successful, but lacks the anonymity required for digital cash. They perform an in-depth investigation to understand what made Bitcoin so successful, analyze the biggest problems issues of Bitcoin, and propose suitable techniques to make Bitcoin better.

Bitter to Better


Ring CT is implemented using bulletproofs for improved performance. MobileCoin uses [Bulletproofs](https://github.com/dalek-cryptography/bulletproofs) in client transaction construction to obscure the transaction input and output amounts, while proving in zero-knowledge that the ledger will remain balanced. 

Bulletproofs is an efficient (fast) algorithmic approach introduced by Bünz in 2017 that has greatly improved performance. It is now possible to use transactions with protected amounts without reducing the throughput of the payments network. 

Mobilecoin uses the [Dalek](https://github.com/dalek-cryptography/bulletproofs) library which is the fastest [Bulletproofs][bp_website] implementation ever, featuring single and aggregated range proofs, strongly-typed multiparty computation, and a programmable constraint system API for proving arbitrary statements. 

The Dalek library implements Bulletproofs using [Ristretto][ristretto], using the `ristretto255` implementation in
[`curve25519-dalek`][curve25519_dalek]. When using the parallel formulas in the curve25519-dalek AVX2 backend, it can verify 64-bit rangeproofs approximately twice as fast as the original libsecp256k1-based Bulletproofs implementation.

Please see [this GitHub](https://github.com/mobilecoinfoundation/bulletproofs/) for more details.




The fastest Bulletproofs implementation ever, featuring single and aggregated range proofs, strongly-typed multiparty computation, and a programmable constraint system API for proving arbitrary statements (under development).

Bulletproofs

Read the Whitepapers

MobileCoin's defense-in-depth for protecting user data starts by establishing a very high baseline using established technologies like ring signatures, one-time addresses, and RingCT. On top of this foundation we've added secure enclaves and careful information management to securely delete the last traces of identifying information left behind by Cryptonote in our redacted public ledger. Node operators or malicious attackers who compromise a node can't access user keys or user data.

MobileCoin's software is composed of 7 defensive layers, each providing increased security:
- Layer 1: Open-Source
- Layer 2: Decentralized Governance
- Layer 3: CryptoNote
- Layer 4: Confidential Transactions
- Layer 5: MobileCoin Ledger
- Layer 6: MobileCoin Consensus Protocol
- Layer 7: Secure Enclaves and Remote Attestation


MobileCoin's defense-in-depth for protecting user data starts by establishing a very high baseline using established technologies like ring signatures, one-time addresses, and RingCT. On top of this foundation we've added secure enclaves and careful information management to securely delete the last traces of identifying information left behind by Cryptonote in our redacted public ledger. Node operators or malicious attackers who compromise a node can't access user keys or user data.

Commerce on the Internet has come to rely almost exclusively on centralized financial institutions serving as trusted third parties to process electronic payments. Centralized payment networks are convenient, but they offer few data protection guarantees, meaning that users are exposed to security risks and abuse by intermediaries. 

With the introduction of the bitcoin whitepaper by Satoshi Nakamoto in 2009, the world got its first taste of an peer-to-peer electronic payment system with decentralized governance. Satoshi’s vision for Bitcoin was “an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.”  

The MobileCoin Foundation coordinates and encourages a global community of developers working together to co-create the simplest possible encrypted payments network. The MobileCoin Foundation maintains the reference implementation of MobileCoin's (the cryptocurrency's) protocol, along with the 'service-layer' technology known as [Fog](https://github.com/mobilecoinfoundation/fog) that facilitates efficient use of MobileCoin in resource-constrained environments like mobile devices, without loss of privacy.

MobileCoin's blockchain is a distributed system, and no individual or organization has control over the entire network, including the MobileCoin Foundation. Validator node operators and core developers also have an important influence on the blockchain. 

**"Validators"** are the owners and operators of validator nodes that run the Mobilecoin blockchain. Transactions on the network are confirmed by consensus by nodes known as validators. The validator nodes in the network must be running compatible versions of software. Node operators rely on software developers (usually hosted on Github) to provide them with the software they choose to run.

**"Core Developers"** of the MobileCoin blockchain work on the software that implement that protocol. Developers have processes that are supposed to assure the quality of the software they release, and submit changes to the software through the MobileCoin Improvement Proposals. Changes to the software proposed by a developer must be approved by the MobileCoin Foundation's Technical Committee.


Commerce on the Internet has come to rely almost exclusively on centralized financial institutions serving as trusted third parties to process electronic payments. Centralized payment networks are convenient, but they offer few data protection guarantees, meaning that users are exposed to security risks and abuse by intermediaries.

Decentralized Governance

In order for any payments network to function, it must be able to maintain a history of transactions. The MobileCoin Ledger describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a  blockchain, in which each block contains transactions that include transaction outputs (txos) that might be spent in the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never been spent before. 

The underlying design is based on the privacy-preserving CryptoNote ledger protocol, which obscures 
the identity of all txo owners using one-time recipient addresses. In 2012, Nicolas van Saberhagen, an unknown anonymous author, published the CryptoNote whitepaper describing a new distributed ledger protocol called CryptoNote. At its core, CryptoNote is an attempt to improve on the design of Bitcoin to create an encrypted ledger.

## Ring Signatures
Ring signatures had existed for nearly a decade and a half prior to CryptoNote. The link between sender and recipient is protected through the use of input rings that guard the actually-spent txo in a large set of possibly-spent txos. Ring signatures make it harder to statistically analyze the network by changing the direct links between buyers and sellers used in Bitcoin into probabilistic links between sets of possible buyers and sellers. Every transaction has a set of possible ancestors which makes tracking payments in the public ledger much more difficult. 

## One-time addresses
CryptoNote's one-time addresses allow payments to be received using numerical aliases that are indistinguishable from random numbers for everyone except the intended recipient. Essentially, every transaction in Bitcoin publicly shares the recipient's pseudonymous address, while CryptoNote ledgers publish the recipient's address in an encrypted format that protects user data.

### Show Me the Code

* [Ledger Crate](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/ledger): the implementation of the MobileCoin ledger using LMDB as the data store.
* [Transaction Crate](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/transaction/core): Implementation of MobileCoin transactions.

### Tech Talk: Transactions

For a walk through of how the MobileCoin Transaction Protocol works, see [MobileCoin Tech Talk #1: Transactions](https://www.youtube.com/watch?v=e9afDQ_M5CU)


In order for any payments network to function, it must be able to maintain a history of transactions. The MobileCoin Ledger describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a  blockchain, in which each block contains transactions that include transaction outputs (txos) that might be spent in the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never been spent before.

CryptoNote ledgers are significantly more secure than Bitcoin, but they still leave the amount of each transaction in plain sight. 

On the MobileCoin ledger, the monetary value of each txo is encrypted using the method of Ring Confidential Transactions (RingCT) published in 2016 by Shen Noether and Adam Mackenzie from the Monero Research Lab.

RingCT protects the amount exchanged in each transaction using cryptography. Rather than publish the value that is exchanged, RingCT transactions include a mathematical proof that the transaction is balanced, meaning that the recipient didn't receive more money than the sender spent. However, this originally required a computationally intensive proof. 

Only the receiver of the transaction can reveal the encrypted monetary value and spend the new txos that are written to the ledger. The recipient’s cryptographic control over spending ensures that all transactions in MobileCoin are irreversible, similar to cash transactions in the real world.

# [Download the Whitepaper](https://raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/ringct.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/ringct.pdf']


CryptoNote ledgers are significantly more secure than Bitcoin, but they still leave the amount of each transaction in plain sight.


Ring CT is implemented using bulletproofs for improved performance. MobileCoin uses [Bulletproofs](https://github.com/dalek-cryptography/bulletproofs) in client transaction construction to obscure the transaction input and output amounts, while proving in zero-knowledge that the ledger will remain balanced. 

Bulletproofs is an efficient (fast) algorithmic approach introduced by Bünz in 2017 that has greatly improved performance. It is now possible to use transactions with protected amounts without reducing the throughput of the payments network. 

Mobilecoin uses the [Dalek](https://github.com/dalek-cryptography/bulletproofs) library which is the fastest [Bulletproofs][bp_website] implementation ever, featuring single and aggregated range proofs, strongly-typed multiparty computation, and a programmable constraint system API for proving arbitrary statements. 

The Dalek library implements Bulletproofs using [Ristretto][ristretto], using the `ristretto255` implementation in
[`curve25519-dalek`][curve25519_dalek]. When using the parallel formulas in the curve25519-dalek AVX2 backend, it can verify 64-bit rangeproofs approximately twice as fast as the original libsecp256k1-based Bulletproofs implementation.

Please see [this GitHub](https://github.com/mobilecoinfoundation/bulletproofs/) for more details.


MobileCoin Ledger takes transactions built with CryptoNote signatures and RingCT and adds two new improvements: membership proofs for transaction inputs and redacted transaction records. 

When a transaction is prepared by a user, it contains a ring signature with a double-spend proof. What’s a double-spend proof? One of the many ground-breaking elements of Satoshi’s Bitcoin electronic payment system was that it solved the long-standing “double-spend” problem that plagued cashless spending. Through the implementation of time-stamped transactions that are unanimously verified by a distributed network of validators, it was no longer possible for a person to spend the same funds twice. 

In addition to the double-spend proof, the MobileCoin Ledger’s ring signature also contains the proofs-of-membership for transaction inputs. Membership proofs allow the transaction to be validated without requiring disk access to the corresponding entries in the ledger. This closes a potential access-pattern side channel that could allow a malicious actor to observe the particular set of inputs used to construct the transaction. When a valid transaction is ready to be published in the MobileCoin ledger, the membership proofs are deleted and only the double-spend proof and the new transaction output are added to the public record. These "redacted transactions" make it difficult to link and deanonymize users through analysis of the public blockchain.

Redacted transactions also necessarily imply that the public blockchain entries do not contain enough information for the complete transaction history to be revalidated in an audit. Our solution is to provide two separate mechanisms for audit support. All blocks are signed as they are published by the code that performs the validation and redaction for publication.


MobileCoin Ledger takes transactions built with CryptoNote signatures and RingCT and adds two new improvements: membership proofs for transaction inputs and redacted transaction records.

MobileCoin Ledger

In distributed computing, the challenge of reaching agreement in a group that cannot exclude malicious agents from participating is called the Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement
Problem.

All cryptocurrencies rely on a distributed network of equivalent nodes to cooperatively agree on the validity and ordering of transactions. MobileCoin has developed a high-performance, byzantine fault tolerant protocol for distributed agreement called the MobileCoin Consensus Protocol (MCP), based on the "federated byzantine agreement" described by David Mazieres. 

The redacted transactions that are written to the public MobileCoin hide the links between buyers and sellers that are used in CryptoNote, but the complete transactions still need to be validated and checked for attempted double spending and counterfeiting.

Rather than agreeing on sets of transactions, validator nodes agree on the cryptographic hash of encrypted sets of transactions. This allows the consensus algorithm to operate independently of the MobileCoin Ledger protocol validation code so that the potential attack surface is minimized.

The MobileCoin Consensus Protocol solves the Byzantine Agreement Problem by requiring each validator node to specify a set of peers that they trust, called a quorum. Quorums are based on the real-life trust relationships between individuals,
businesses, and other organizations that compose the MobileCoin Network.  Each node operator independently controls their own quorom configuration of trusted set of peers. Sensitive data, even in an encrypted form, is never shared beyond the web of trust defined by these quorums.

There is no central authority in the MobileCoin Network. Users accept statements about the blockchain ledger when their quorum convinces them that these statements are true. While the algorithmic design of MCP is based on the Stellar Consensus Protocol, the MobileCoin Network is not
interoperable with the Stellar payment network.

The MobileCoin Consensus Protocol avoids the environmentally-damaging mathematical “work” required by Proof-of-Work (PoW) consensus protocols like Bitcoin and realizes a much higher transaction rate than the Bitcoin consensus protocol.
In contrast to Proof-of-Stake (PoS) consensus protocols, practical control of governance in MCP is ceded to the users who are trusted the most by the extended MobileCoin community, rather than to the wealthiest users who control the
largest financial stakes.

MCP ensures that all operators agree on the sequence of valid payments that are completed. New transactions are grouped
in blocks and published approximately once every five seconds to the MobileCoin Ledger.

### Show Me the Code

* [Consensus Service](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/service): The implementation of the MobileCoin Consensus Protocol Service
* [SCP](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/scp): MobileCoin's implementation of the Stellar Consensus Protocol


In distributed computing, the challenge of reaching agreement in a group that cannot exclude malicious agents from participating is called the Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement
Problem.

At least some of the code running on the nodes that participate in consensus protocol must be able to view the complete transactions. However, the operators of these nodes don't need to see this data themselves. MobileCoin confines the sensitive transaction data and all of the code that operates on it in a "secure enclave", bringing the latest advancements in confidential computing to cryptocurrency. Secure Enclaves are a region of memory which provide encrypted code execution. 

A secure enclave provides strong guarantees about the confidentiality and integrity of the software actions being performed inside. Using a secure enclave, we can conceal the complete transactions even from the operators of the nodes that participate in the MobileCoin consensus protocol.

MobileCoin implements secure enclaves using Intel's Software Guard eXtensions (SGX) technology. To understand how SGX improves the confidentiality of user data on-chain, please see our Tech Talk: [Why we use SGX for MobileCoin](https://www.youtube.com/watch?v=Hwf_Q31woLo).


At least some of the code running on the nodes that participate in consensus protocol must be able to view the complete transactions. However, the operators of these nodes don't need to see this data themselves. MobileCoin confines the sensitive transaction data and all of the code that operates on it in a "secure enclave", bringing the latest advancements in confidential computing to cryptocurrency. Secure Enclaves are a region of memory which provide encrypted code execution.

Secure Enclaves

In addition to secure enclaves, Intel SGX is used by MobileCoin as a "remote attestation" system that can be used to prove that code that claims to be running in a secure enclave is running in a secure enclave. This also proves the code is run on real hardware rather than a simulator.  Put simply, remote attestation gives us more confidence that a remote computer is running the right software, right now. This makes it much harder for operators to cheat in our system, and basically impossible for an operator to deny responsibility if they are ever caught cheating.

Consensus Validator Nodes in the MobileCoin network must use a Intel SGX secure enclave to validate transactions and produce each next block in the  ledger. When each Consensus Validator Node starts up, it initiates an attested connection with its peers. If they  are not running the exact same enclave code, the Enclave Measurements will not match, and the connection will be refused. Similarly, when clients submit a transaction to the network, they ask for the Attestation Evidence from the 
Consensus Validators, and only proceed with an attested connection if the Measurements are what they expect.

In short, the MobileCoin network becomes a network of blind oracles who simply agree on a set of encrypted strings. No information about who is transacting with whom, or for how much is revealed, even to the operators of the nodes that validate the transactions.

To understand how SGX improves the integrity of MobileCoin's Federated Byzantine Agreement Consensus Protocol, please see our Tech Talk: [Why we use SGX for MobileCoin](https://www.youtube.com/watch?v=Hwf_Q31woLo).

### Show Me the Code

* [Attestation](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/attest/core): MobileCoin's attestation implementation
* [SGX](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/sgx): A lightweight `no_std` Rust environment for use inside an SGX enclave.
* [Consensus Enclave](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/enclave): MobileCoin's Consensus Enclave implementation and API


In addition to secure enclaves, Intel SGX is used by MobileCoin as a "remote attestation" system that can be used to prove that code that claims to be running in a secure enclave is running in a secure enclave. This also proves the code is run on real hardware rather than a simulator.  Put simply, remote attestation gives us more confidence that a remote computer is running the right software, right now. This makes it much harder for operators to cheat in our system, and basically impossible for an operator to deny responsibility if they are ever caught cheating.

Remote Attestation


Oblivious RAM is a class of data structures designed to avoid information leaks over memory access pattern side-channels, introduced in [Goldreich '96].

Tree-based ORAM was introduced in a seminal paper [Shi, Chan, Stefanov, Li '11]. Tree-based ORAM algorithms arrange their data in a complete balanced binary tree, and are the first and only class of algorithms to have good (poly-log) worst-case performance.

The first oblivious RAM algorithm that attracted significant interest from practicioners was Path ORAM [Shi, Stefanov, Li '13]. Circuit ORAM appeared in [Wang, Chan, Shi '16].

ORAM can in principle be used in several ways, and many papers in ORAM consider several of the application modes:

* A user can use it to interact with (untrusted) cloud storage and make use of storage without leaking access patterns.
* It can be implemented in hardware in the "secure processor" setting, such that the "ORAM controller / client" is implemented in silicon, and the main memory corresponds to the "server".
* It can be implemented in software in a "secure enclave", such that the "ORAM controller / client" is the enclave, and the main memory corresponds to the "server".
* It can be implemented in a compiler pass that transforms arbitrary code into code that leaks nothing via its memory access patterns, but runs more slowly.

In MobileCoin Fog, we are focused on the SGX-based approach, which was first described in the ZeroTrace paper [Sasy, Gorbunuv, Fletcher '17].

### What is Oblivious/Constant Time?

A great exposition from Intel appears in [Guidelines for Mitigating Timing Side Channels Against Cryptographic Implementations](https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/secure-coding/mitigate-timing-side-channel-crypto-implementation.html).

> Most traditional side channels—regardless of technique—can be mitigated by applying all three of the following general "constant time"[2] principles, listed here at a high level. We discuss details and examples of these principles later.
> 
> * Ensure runtime is independent of secret values.
> * Ensure code access patterns[3] are independent of secret values.
> * Ensure data access patterns[4] are independent of secret values.
> 
> [2] Use of the term “constant time” is a legacy term that is ingrained in literature and used here for consistency. In modern processors, the time to execute a given set of instructions may vary depending on many factors. The key is to ensure that none of these factors are related to the manipulation of secret data values. Modern algorithm research uses the more inclusive term "data oblivious algorithm." [3] A program's code access pattern is the order and address of instructions that it executes. [4] A program's data access pattern is the order and address of memory operands that it loads and stores.

These crates provide functions and data structures that have the "data-oblivious" property.

A function is completely constant-time / data-oblivious if for any two sets of arguments you might pass it, the code and data access patterns are:

the same, or
identically distributed, or
distributed according to distributions that are computationally indistinguishable.
For example, the implementations of the CMov trait in the aligned-cmov crate are completely constant-time, because the code and data access patterns are exactly the same no matter what the inputs are.

The implementation of access in PathORAM is completely constant-time, because the code and data access patterns are identically distributed regardless of what memory position is accessed.

In some more complex cases, a function may be oblivious with respect to some of its inputs, but not all of them. We follow the convention that those functions are labelled with vartime in their name, and explain to what extent if any they are oblivious in documentation. Sometimes such functions are completely oblivious with respect to some of the arguments but not all of them. Examples include vartime_write in the ObliviousMap trait.

In some cases, it is obvious that the function will not be oblivious. For example the ORAM and ObliviousMap creator functions take a capacity as an argument. Increasing the capacity will require using more memory, so we are not oblivious with respect to that parameter. We nevertheless don't call the function vartime_create.

As another example, the access function in PathORAM implementation takes a closure to which the accessed data is passed. This closure includes a function pointer -- if two different closures are passed, the code access patterns will be different. Additionally, if the code in the closure is not itself constant-time with respect to the query then we won't be constant-time. We don't bother documenting this since it should be clear to the user of the API.

### Show Me the Code

* [mc-oblivious](https://github.com/mobilecoinofficial/mc-oblivious): MobileCoin implementation of Oblivious RAM inside Intel SGX enclaves


Oblivious RAM is a class of data structures designed to avoid information leaks over memory access pattern side-channels, introduced in [Goldreich '96].

Oblivious RAM


MobileCoin Fog is a suite of services that enable use of MobileCoin payments in resource-constrained
environments, particularly, mobile devices. This threat model explains the security invariants of the system
for the following audiences:

* Users of MobileCoin Fog
* Developers integrating the MobileCoin SDK into their wallet software
* Parties interested in running a MobileCoin Fog deployment
* Security researchers and auditors curious about the system, or actively attempting to break the system

We employ the "user-first" approach of [Invariant-Centric Threat Modeling](https://github.com/defuse/ictm) in this document.

Below, we describe the hypothetical adversaries of the system, followed by the security invariants provided by the
system in the face of each adversary. We also identify specific non-goals in order to express the bounds of what the
system specifically cannot do.

# Terms

For the reader's ease, we have chosen simpler terms for some of the elements of MobileCoin. In particular,
in the literature, a transaction produces "transaction outputs," in this document, the term
"payment record" is used instead.  For example, when a transaction is submitted
successfully, (encrypted) "payment records" are added to the blockchain, and these
payment records are returned to the appropriate users privately via Fog.

When discussing information an adversary *may* possess, we use the following terms when discussing
the adversary's level of uncertainty about the information:

* *no information*: An adversary has *no information* about something. For example in the case of who
sent a transaction, if an adversary has total uncertainty about the recipient, it then is equally likely
given all their information for the recipient to have been any of the users.

* *some information*: An adversary has *some information* about who sent a transaction; they have less
than total uncertainty about this. For example, take the claim, "It must have been one of the people who
submitted a transaction to one of several blocks." The number of people on a list like this is typically
less than the total number of users. In this document, we only use the term *some information* when an
adversary has *at most* "block-level granularity" about a piece of data.

# Adversaries

### Baseline Adversary (Oscar)

The "baseline" adversary doesn't have access to Fog, to consensus service machines,
or to users' phones, but can still monitor (but not tamper with) IP-level traffic between all services and
users, and knows the IP address of every user.

### Infrastructure-surveilling Adversary (Eve)

Eve has the capabilities of Oscar, and additionally:

* Can monitor all Fog service machines and one MobileCoin consensus service machine participating in quorum, observing all working memory of these machines as they operate.
* Cannot compromise the confidentiality or integrity of SGX enclaves, nor that of RDRAND, nor the SGX remote attestation process.
* Can monitor the memory access patterns of any running enclave in the system, even if they cannot read the memory.
* Does not have access to the user's phone and cannot run malicious code there.

### Infrastructure-compromising Adversary (Mallory)

Mallory has the capabilities of Eve, and additionally:

* Has root access on Fog service machines and one MobileCoin consensus service machine participating in quorum,
  and can observe and tamper with all working memory and operations of these machines.

### SGX-compromising Adversary with root on Fog Infrastructure (Darth)

Darth has the capabilities of Mallory, and additionally:

* Can compromise either SGX itself, or the SGX remote attestation process.

### SGX-compromising Adversary without root on Fog Infrastructure (Trudy)

Trudy has the capabilities of Oscar, and additionally:

* Has the capability to compromise SGX, but does not have root access on any infrastructure machines.

# Security Invariants

### Baseline Adversary (Oscar)

Oscar cannot:

* Cause arbitrary code to run on the user's device.
* Learn any of the users' private keys.
* Learn any of the users' public addresses.
* Steal the user's funds.
* Make the user send funds without permission.
* Make the user send funds to someone other than who they intended.
* Cause the user's funds to become unavailable for use.
* Cause funds sent to a recipient to disappear from the sender's wallet but be unavailable for use by the recipient.
* Cause a user to associate the wrong public address with another user.
* Learn the amount of any user's transaction.
* Learn any user's balance.

Oscar can:

* See when a user submits a transaction to the consensus node.
* See when the submission is successful or unsuccessful.
* See in which block a particular successful transaction landed, and all of the payment records in that block.
* See when a user checks their balance, and the bandwidth and number of requests during a particular balance check operation.

Thus, Oscar has *some information* about the identity of the sender of any particular payment record.

Fog provides the following invariants protecting the recipient of a payment record from Oscar:

* When a user performs a balance check and retrieves zero or one payment records from Fog, the adversary has *no information* about which of these is the case.
* When a user performs a balance check retrieving more than one payment record, the adversary cannot determine the number of payment records to within a factor of two.
  * For example, if you received 6 payments, it is equally likely from the adversary's point of view that you received 5, 6, 7, or 8 payments, given the data they can see.
  * In particular, if a user reinstalls their wallet and downloads all their historical transactions via Fog, this adversary learns the number of total payment records to within a factor of two.

These are consequences of the design goals of MobileCoin Fog. Fog is designed to support *low-bandwidth*
users on a mobile device; it is designed so that users only download their own transactions, and not the entire
blockchain. This means that an adversary capable of traffic analysis can see when a user downloads many payment
records as opposed to a few. Fog is designed to make it difficult to distinguish when you download zero or one
payment records; even when you download many payment records, it's hard to determine the exact
number of up to a factor of two. However, this adversary does get *some information*.

A user seeking stronger protection guarantees should consider running a desktop wallet, with
the caveat that one must sync the entire blockchain in order to check one's balance.

If a baseline adversary has *some information* about which blocks your payment records came from, then they have
*some information* about the sender, because they have *some information* about who submitted the transaction that
created any particular payment record.

### Infrastructure-surveilling Adversary (Eve)

Eve:

* Eve can see which IP created which payment record. (Oscar only has *some information* about this.)
  (This is the current threat model for MoblieCoin consensus server.)

* Otherwise, Eve obeys the SAME set of invariants as described for Oscar, with the following modifications:
  * Eve can observe the ring elements used to construct a user's outgoing transaction at the time of construction.

(Note: In a future release, we plan to improve the system so that these modifications are not necessary, and Eve
has no additional information beyond the baseline adversary.)

### Infrastructure-compromising Adversary (Mallory)

Mallory cannot:

* Cause arbitrary code to run on the user's device.
* Learn any of the user's private keys.
* Learn any of the user's public addresses.
* Steal the user's funds.
* Make the user send funds without permission.
* Make the user send funds to someone other than who they intended.
* Cause the user's funds to become unavailable for use.
  * Though the user may need to use a desktop wallet to find their funds.
* Cause a user to associate the wrong public address with another user.
* Learn the amount of any transaction.
* Learn any user's balance.
* Steal private keys from any of the enclaves.
* Exercise the fog-ingest, fog-ledger, or fog-view enclaves in any way that reveals additional non-trivial information
  about the amount or recipient of a transaction.
* Infer *anything* about the sender or recipient of a payment, that Eve cannot also infer.

Mallory can:

* Do anything Eve could.
* Cause the Fog service to become unavailable.
* Destroy encrypted payment records in Fog database, making it impossible for a user to successfully perform a balance check via Fog.
* Create fake encrypted payment records, which are not part of the blockchain, which users will download and treat as real, but which can't be used to make successful transactions.
* Cause users to display incorrect balances.
* Cause users to build invalid transactions.
  * Mallory cannot cause the users to submit transactions, but if they submit transactions, they may be invalid if they were built with invalid data.
* Tamper with the Fog reports, causing users not to receive their payment records via Fog.
  * If the sender encrypts for the wrong Fog ingress key, fog-ingest will not pick up the payment record.
  * The recipient would have to slow-scan the ledger instead to find the payment record.
* Cause the users to download large amounts of uninteresting data on their phone.

### SGX-compromising Adversary with root on Fog Infrastructure (Darth)

Darth cannot:

* Cause arbitrary code to run on the user's device.
* Learn any of the user's private keys.
* Steal the user's funds.
* Make the user send funds when they didn't want to.
* Make the user send funds to someone other than who they intended.
* Cause the user's funds to become unavailable for use.
* Cause a user to associate the wrong public address with another user.
* Learn the amount of any user's transaction.
* Learn any user's balance.

Darth can:

* Do anything Mallory could.
* Learn many view-public keys, which appear in the public addresses of Fog users.
* Learn the recipient of any payment record sent to a Fog user:
  * By attacking fog-ingest enclave in one of several ways, or by attacking fog-view enclave.
  * Darth can learn who the sender of a payment record was, just as Mallory can.
* Learn how many and in which blocks a Fog user received payments, if they perform full-wallet recovery
  * By attacking fog-view enclave.

The system has a forward-secrecy property:

* If SGX is patched and Fog enclaves are rebuilt and redeployed, Darth-level adversaries no longer have any additional information,
  and are degraded to the Mallory-level for transactions and interactions that occur after that point. This does not require
  the users to change their private keys, but may require them to update their app in order to trust the new enclave.

### SGX-compromising Adversary without root on Fog infrastructure (Trudy)

Trudy has the same set of invariants as Oscar, even if they have the ability
to conduct DNS-poisoning attacks and cause the user to talk to a malicious Fog report server.

These invariants carry over because of the design of the Fog authority signature chain, which leads
all the way back to the users' public addresses.

If Trudy signs their Fog reports with a different authority key, then the user will fail
to obtain valid Fog reports and be unable to submit transactions, rather than disclose the recipient
of those transactions to the adversary.


MobileCoin Fog is a suite of services that enable use of MobileCoin payments in resource-constrained environments, particularly, mobile devices.

Fog Threat Model

Security

MobileCoin is a security-focused cryptocurrency [launched](https://mobilecoinfoundation.medium.com/mobilecoin-main-net-8e355d82c726) on December 7th, 2020. Its initial [code base](https://github.com/mobilecoinfoundation/mobilecoin) was developed by MobileCoin Inc. and published by the [MobileCoin Foundation](https://mobilecoin.foundation/) with an open-source license (GPLv3).

MobileCoin Inc. was founded in 2017 by Josh Goldbard & Shane Glynn. It is a venture-backed company based in San Francisco, CA. 

The MobileCoin Foundation coordinates and encourages a global community of developers working together to co-create the simplest possible encrypted payments network. The MobileCoin Foundation maintains the reference implementation of MobileCoin's (the cryptocurrency's) protocol, along with the 'service-layer' technology known as [Fog](https://github.com/mobilecoinfoundation/fog) that facilitates efficient use of MobileCoin in resource-constrained environments like mobile devices, without loss of privacy. 

MobileCoin's blockchain is a distributed system, and no individual or organization has control over the entire network, including the MobileCoin Foundation. Validator node operators and core developers also have an important influence on the blockchain. 

Validators are the owners and operators of validator nodes that run the Mobilecoin blockchain. Transactions on the network are confirmed by consensus by nodes known as validators. The validator nodes in the network must be running compatible versions of software. Node operators rely on software developers (usually hosted on Github) to provide them with the software they choose to run.

Core Developers of the MobileCoin blockchain work on the software that implement that protocol. Developers have processes that are supposed to assure the quality of the software they release, and submit changes to the software through the MobileCoin Improvement Proposals. Changes to the software proposed by a developer must be approved by the MobileCoin Foundation's Technical Committee. 

Committees
----------

### Technical Advisory Committee

-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Konstantin Richter (Chair)
-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Sara Drakeley Hall
-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Michael Rodriguez

### Policy Advisory Committee

-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Tony Lai (Chair)
-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Tiffiniy Cheng
-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Faisal Saeed AlMutar



MobileCoin is a security-focused cryptocurrency [launched](https://mobilecoinfoundation.medium.com/mobilecoin-main-net-8e355d82c726) on December 7th, 2020. Its initial [code base](https://github.com/mobilecoinfoundation/mobilecoin) was developed by MobileCoin Inc. and published by the [MobileCoin Foundation](https://mobilecoin.foundation/) with an open-source license (GPLv3).

MobileCoin Foundation

MobileCoin Consensus is built on trust relationships between individuals and organizations who are running MobileCoin Consensus Validator nodes.

Determining which nodes are listed as Foundation Trusted Nodes is challenging -- and involves a criteria selection that includes:

-   Based on the organization's track record and that of its leaders and backers, does it appear that the organization truly has the best interests of the public and protecting privacy at heart?
-   Have any concerns been raised about the organization's behavior as a Trusted Node, and if so, have further discussions satisfactorily resolved these concerns?
-   Is the organization free of any Conflicts of Interest that would undermine its ability to operate as a Trusted Node?

Each Node Operator determines which entities to trust and includes those entities' nodes in their quorum set definition. We hope other node operators will follow suit and choose to share their trusted node lists. Several members of the MobileCoin Foundation are running MobileCoin Consensus Validators in MainNet; these are available for peering. Below is a non-exhaustive list:

* * * * *

##### Organization

Blockdaemon

##### Node Address

mcp://blockdaemon.mobilecoin.bdnodes.net:8443

##### Message Signer Public Key

MCowBQYDK2VwAyEA_wMkv3-3MluopGsqtnZx4rbqzPR2axi7bCiqWWnOq0Q=

##### Ledger Archive Location

https://bd-mobilecoin-ledger.s3.amazonaws.com/blockdaemon.mobilecoin.bdnodes.net/

##### Accepting Consensus and Watcher Peers on Port

8443

##### Accepting Client Transactions on Port

443

* * * * *

##### Organization

The Long Now Foundation

##### Node Address

mcp://thelongnowfoundation.mobilecoin.bdnodes.net:8443

##### Message Signer Public Key

MCowBQYDK2VwAyEAXd4Xyfv0OizkLKB_Jb7HM_KDjd1mMgbF34MStLqd1WY=

##### Ledger Archive Location

https://bd-mobilecoin-ledger.s3.amazonaws.com/thelongnowfoundation.mobilecoin.bdnodes.net/

##### Accepting Consensus and Watcher Peers on Port

--

##### Accepting Client Transactions on Port

--

* * * * *

##### Organization

MobileCoin Worldwide

##### Node Address

mcp://peer1.prod.mobilecoinww.com:443

##### Message Signer Public Key

MCowBQYDK2VwAyEAwxHjdoRQBF9Ozp8lE0wq9pppyP48nKphcQ0GeEb4zYg=

##### Ledger Archive Location

https://ledger.mobilecoinww.com/node1.prod.mobilecoinww.com

##### Accepting Consensus and Watcher Peers on Port

433

##### Accepting Client Transactions on Port

433

* * * * *

##### Organization

MobileCoin Worldwide

##### Node Address

mcp://peer2.prod.mobilecoinww.com:443

##### Message Signer Public Key

MCowBQYDK2VwAyEAMtTj21PtiL-FQW3YbKZXfcfnFztHlVhnbvwvaiWDFuE=

##### Ledger Archive Location

https://ledger.mobilecoinww.com/node2.prod.mobilecoinww.com

##### Accepting Consensus and Watcher Peers on Port

433

##### Accepting Client Transactions on Port

433


MobileCoin Consensus is built on trust relationships between individuals and organizations who are running MobileCoin Consensus Validator nodes.

Trusted Nodes

Please see [this document](https://github.com/mobilecoinfoundation/technical-committee/blob/master/CHARTER.md) for details.


Technical Committee Charter

Governance


1.  ### What is MobileCoin and why was it created?

    MobileCoin is an encrypted-focused cryptocurrency designed for use in everyday transactions. MobileCoin addresses 4 fundamental issues: Security, Transaction Speed, Energy Consumption, and Optimization for Mobile devices. No one except for the sender and receiver can see the details of the transaction. The public blockchain is encrypted to ensure security. MobileCoin is an unrivaled cryptocurrency designed to be fast and secure enough to be used for mobile transactions.

2.  ### Why is MobileCoin used in messaging apps?

    We believe in fast, secure, and easy to use payments on mobile devices. MobileCoin is currently available for use with [one of the world’s most secure messaging apps](http://signal.org/). By design, it’s easy to link a MobileCoin wallet to your phone so you can start sending funds to friends and family, receive funds from them, keep track of your balance, and review your transaction history with a simple interface. Since the goal is to [keep your data in your hands](https://signal.org/blog/update-on-beta-testing-payments), MobileCoin’s [design](https://github.com/mobilecoinfoundation/mobilecoin) means no third party has access to your balance, full transaction history, or funds. You can also transfer your funds at any time if you want to switch to another app or service.

3.  ### How did MobileCoin Inc. start?

    MobileCoin Inc. was founded in 2017 by Josh Goldbard & Shane Glynn. It is a venture-backed company based in San Francisco, CA. The MobileCoin Protocol was [open-sourced](https://github.com/mobilecoinfoundation/mobilecoin) by the MobileCoin Foundation in 2020. The network went live on [December 7, 2020](https://mobilecoinfoundation.medium.com/mobilecoin-main-net-8e355d82c726).

4.  ### What is MobileCoin used for?

    MobileCoin is currently being used for payments in some of the world’s most secure messaging apps. MobileCoin is mobile-first and also works on desktop, offering both the speed and security expected for a payment system.

5.  ### Why does the world need another cryptocurrency?

    MobileCoin could be the foundation for an accessible, secure, and sustainable payments system for the world to use. The best way to create this technology is via a new cryptocurrency and encrypted blockchain. Currently, there is no cryptocurrency that is designed to offer both the security and speed expected for payments. The MobileCoin Foundation provides governance for the MobileCoin Protocol in order to help solve for the most important aspects of any modern payment system: Security, Transaction Speed, Energy Consumption, and Optimization for Mobile. Think of a simple, secure currency utility, like PayPal but encrypted.

6.  ### What is MobileCoin’s energy consumption compared to other cryptocurrencies?

    While other blockchains take as much energy to run an entire country, you could power all of transactions on the MobileCoin Protocol with the same energy needed to power a few households. Since MobileCoin technology uses the Federated Byzantine Agreement instead of Proof of Work, node servers are mostly idle – they only wake up to do work when there is work to do, saving enormously on energy consumption. And now, thanks to the MobileCoin community, MobileCoin is the [first carbon negative cryptocurrency](https://medium.com/mobilecoin/mobilecoin-is-the-worlds-first-carbon-negative-cryptocurrency-54570fce10dc).

7.  ### How do you use MobileCoin?

    Check out this [helpful blog post](https://mobilecoinfoundation.medium.com/how-to-get-mobilecoin-into-your-signal-wallet-for-uk-beta-users-2e847ccbca5b) with video and written explanation. Here are our how to guides for [downloading our desktop wallet](https://mobilecoin.com/news/how-to-download-and-set-up-your-mobilecoin-desktop-wallet) and [purchasing MOB](https://mobilecoin.com/news/how-to-buy-mob-in-the-us).

8.  ### Are you worried that bad behavior will happen with the use of encrypted cryptocurrency?

    People and entities misuse all types of financial platforms and instruments. Outside the US, MobileCoin can be purchased at [www.buymobilecoin.com](https://www.buymobilecoin.com/), which applies best practices of financial institutions around the world to prevent bad actors from obtaining MobileCoin. Any third-party entities that buy, sell, or trade MobileCoin apply their own standards and practices to vet persons or entities trying to purchase MobileCoin.
    
9. ### What is the impact of an Intel SGX compromise on encryption for transactions?

    Secure enclaves can provide improved integrity and confidentiality while functioning as intended. Like most complex new technologies, we should anticipate that design flaws will inevitably be discovered. Several side channel attacks against secrets protected by Intel SGX have been published, and subsequently patched or otherwise mitigated. MobileCoin is designed to provide "defense in depth" in the event of an attack based on a secure enclave exploit. MobileCoin transactions use CryptoNote technology to ensure that, even in the clear, the recipient is concealed with a one-time address, the sender is concealed in a ring signature, and the amounts are concealed with Ring Confidential Transactions (RingCT).

    In the event of an Intel SGX compromise, the attacker's view of the ledger inside the enclave would still be protected by both ring signatures and one-time addresses, and amounts would remain concealed with RingCT. These encryption mechanisms leave open the possibility of statistical attacks that rely on tracing the inputs in ring signatures to determine probabilistic relationships between transactions. This attack is only applicable to transactions made during the time that the secure enclave exploit is known, but not patched. Once the Intel SGX vulnerability is discovered and addressed, statistical attacks are no longer possible, therefore forward secrecy is preserved.

10. ### Can I run a validator node without Intel SGX?

    You can run the consensus-service using Intel SGX in simulation mode, however you will not be able to participate in consensus with other validator nodes. Your software measurement will be different from hardware-enabled Intel SGX peers and remote attestation will fail.

11. ### Can I run a watcher node without Intel SGX?

    Yes, you can operate a watcher node and validate block signatures by running the mobilecoind daemon, which does not require Intel SGX.

12. ###  Where is the code for mobile devices?

    Please see [fog](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/fog), [android-bindings](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/android-bindings), and [libmobilecoin](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/libmobilecoin), to see how the balance checking and transaction building process works on mobile devices that don't sync the ledger.

    Please see also the MobileCoin [Android](https://github.com/mobilecoinofficial/android-sdk/) and [iOS](https://github.com/mobilecoinofficial/MobileCoin-Swift) SDKs, which can be integrated into your app to enable MobileCoin payments.

13. ### Will I need to put my keys on a remote server to scan the blockchain for incoming transactions?

    Keys will never leave your mobile device. For more details on how this works, please see the [MobileCoin Fog README](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/fog).

14. ### Is Fog decentralized?

    Fog is a scalable service that helps users find their transactions, conduct balance checks, and build new transactions. Fog does so without requiring a local copy of the blockchain and without revealing a user's activities or giving away their private keys.

    Fog is intended to be run by app providers to provide their users with a safe and positive mobile experience. Users need only trust the integrity of SGX, and not the service provider.

    Fog is thus not a single, decentralized network, but can be deployed as needed by each party willing to offer this service. Fog can be treated as critical infrastructure for an app, and can be scaled to meet each party's needs.

15. ### What is the hint field? Can I put anything in there?

    The purpose of the hint field is to send an encrypted message to the Fog ingest enclave, which it finds when it post-processes the blockchain. A conforming client puts only an mc-crypto-box ciphertext of a specific size there. For non-fog transactions, a ciphertext encrypted for a random public key should be put there. Putting something in the hint field which is distinguishable from this may degrade security.

16. ### How do I get support?

   For troubleshooting help and other questions, please visit our [community forum](https://community.mobilecoin.foundation/).

   You may also open a technical support ticket via [email](mailto://support@mobilecoin.foundation)


Open-Source Code

What's your email?