#### **Get the Signal App**
Make sure you have the latest Signal app on your phone.  

<a href="https://signal.org/install/" style="display: inline-flex;">
 <img src="https://developers.mobilecoin.com/native_images/appstore.svg" width="135px" style="margin:10px;" /><img src="https://developers.mobilecoin.com/native_images/playstore.png" width="135px" style="margin:10px;" />
 </a>

* * * * *

Activate Payments
-----------------
Activating payments will let you send and receive MobileCoin.
1. Open the Signal app on your phone.
2. Tap Profile (in the top left) 
3. Tap Settings ⚙️ 
4. Tap Payments 💳 
5. Tap Activate Payments
6. Accept and Agree to the Terms

![](https://images.squarespace-cdn.com/content/v1/624b284acc6f4b3917c9d40d/7f1400e3-a06d-47b3-b6ce-bd2a5045ab62/gif.gif?format=750w)


 Get the Signal App
Make sure you have the latest Signal app on your phone.

Get your Wallet

![](https://raw.githubusercontent.com/mobilecoinofficial/developer-portal/main/images/digitalcash.png)

## Fast, Encrypted, Mobile Transactions

Almost 30 years ago knowledge gaps in how to use the Internet stymied the digital transformation and the advent of the World Wide Web. Most asked, "The world wide what"? Trust was a factor. Could you trust your money to online stores? Speed was another. Dial-up was agonizingly slow and laborious. A decade later, we embraced the Web, where Amazon and other digital companies grew like wildfire.

We see a similar scenario building in the digital transformation of cryptographic payments. Cryptocurrency currently is too slow for day-to-day transactions. It can take up to 60 minutes to conduct a transaction on Bitcoin. If you want to buy a cup of coffee, an hour's wait isn't going to cut it.

We can do better. If Bitcoin is digital gold, MobileCoin is digital cash. 

Gold is great for saving for a rainy day, cash is king when it comes to your everyday needs. What separates cash from gold? Speed, encryption, and usability. Gold is heavy, cash is light. Pulling a gold bar out at a coffee shop would be mighty risky, but cash is quick and well understood. Converting a gold bar into change would take a hammer, chisel, and a weighing station, but cash is easily divisible.

There is room on this earth for more than one type of asset, but your coffee shop needs digital cash.  

Transforming SmartPhones with Digital Cash
------------------------------------------

Digital cash must be fast and encrypted, which is why MobileCoin has invested so much time into making our technology easy to use. The first component is the [MobileCoin Blockchain](https://developers.mobilecoin.com/overview/explain-like-i'm-five/blockchain), which is a digital ledger that records financial information of financial transactions. The second component is [MobileCoin Fog](https://developers.mobilecoin.com/overview/explain-like-i'm-five/fog), a back-end service that allows users to quickly send, spend, and check the balance of their MOB via their smartphone.

    

Explain Like I'm Five (ELI5)
------------------------------------------
To help understand the importance of the MobileCoin technology, the ELI5 articles delivers four layers of increasingly more complex information geared toward describing the concepts to:

-   Five-year-old children who probably have never spent money in their entire short lives.

-   Grandparents who probably are not familiar with cryptocurrency, but have searched on Google, written checks, balanced their checkbooks, and transacted online through their local banks.

-   College first years who are familiar with digital cash, like Bitcoin, smartphones, and messaging apps, like Signal and WhatsApp.

-   Software engineers who have studied digital payment systems, blockchain databases, and cryptography.

### [Explain Like I'm Five: MobileCoin Blockchain](https://developers.mobilecoin.com/overview/explain-like-i'm-five/blockchain)
### [Explain Like I'm Five: MobileCoin Fog](https://developers.mobilecoin.com/overview/explain-like-i'm-five/fog)


Digital Cash


![](https://raw.githubusercontent.com/mobilecoinofficial/developer-portal/main/images/Blockchain.png)

[What is MobileCoin's Blockchain?]: #what-is-blockchain

Blockchain is a new technology that is decentralizing trade and allowing peer-to-peer transactions to occur, removing the intermediaries. How does MobileCoin use this innovation to allow two people to send digital cash using their smartphones?

### To a Five-Year Old Child:

Imagine you have a bag of puzzle pieces and you give a piece to each of your friends. If you all get together, you can solve the puzzle. However, if someone brings a piece from another puzzle, or you are missing a piece, the puzzle remains unsolved. Whenever someone in the world wants to buy something, you or one of your friends needs to place a new puzzle piece down.

### To a Grandparent:

Blockchain is like a counting mechanism, a ledger. It is similar to the invention of double-entry accounting, which is a bookkeeping method that has been used since the 1400s. Double-entry accounting involves recording each transaction in two accounts, resulting in a credit to one account and a debit to another. The resulting transaction must balance out. Blockchains make it harder to cheat by having many different copies of the ledger, each held by a different person who all come together to agree on the information in their ledgers. The technology ensures that the accounts always balance, and no one can cheat.

### To a First Year College Student:

The importance of blockchain is that it democratizes information. It allows people to trade one-on-one. Anyone can validate that the transactions are valid. Blockchain is keeping track of data in a way that blocks large corporations or big tech companies from tracking the user's data to sell. For example, Google, AWS, and Microsoft provide cloud services, but the users' data is the product, which the technology companies can sell. Blockchain can be used for multiple uses, not just finance. It is a trustworthy database that can be used for running video games, tracking physical goods, recording weather and/or sports scores, or as a supply chain.

The blockchain itself is an append-only sequence (ledger) of all transactions. It uses cryptography to encode all of the transactions, so no one can see what has happened. This also means that previous transactions cannot be changed because the cryptography reveals if someone has tried to manipulate the data. To create a new entry in the ledger, you take the existing ledger and use a mathematical equation to add information to the chain which ensures that each new entry is provably linked to all prior transactions. The math proves truth -- any inconsistencies reveal that someone has tampered with the ledger.

### To a Software Engineer:

Blockchain is a decentralized approach to keeping track of data. It can be a ledger, a log, or a history of important items. On a blockchain network, there are multiple types of participants: servers, nodes, miners (in the case of Bitcoin's blockchain network), and/or computers. Each one of the nodes receives a proposed transaction. If one of the nodes in a trusted group of peers has a different set of transactions than the rest of the nodes, the other servers correct the mistake through consensus. As the consensus mechanism reaches its conclusion, a new block is appended to the chain using a cryptographic proof known as a hash. Succinctly, this is why it is called a blockchain: it is a chain of blocks linked by cryptographic knowledge.

The MobileCoin Blockchain is a digital ledger that records financial information of financial transactions, the giving and receiving of funds. The design of the MobileCoin Blockchain ledger is based on the CryptoNote ledger encryption protocol, which obscures the identity of all users' transaction outputs (TxOuts) using one-time recipient addresses. The transaction is encrypted by Ring Confidential Transactions (RingCT), which hides the actual transaction value amid decoys, a larger set of possibly-spent transactions. The MobileCoin Blockchain is encrypted, which means that the TxOuts are constructed in such a way that users can only receive funds or know how much they have spent by using their private keys to view or spend the transaction. Explicitly: only the counterparties in a transaction are privy to its contents.

Each TxOut is annotated with a Merkle proof of inclusion, a secret committed message in a finite group of messages, in the MobileCoin Blockchain ledger. A Merkle proof of inclusion (or membership) can be validated without going to the ledger database and in constant time -- without revealing which output the user is spending. Additionally, MobileCoin's Blockchain improves on the baseline encryption offered by CryptoNote and RingCT by deleting input rings for every transaction before the new payment is appended to the public ledger. This provably destroys the transaction graph.

One erroneous assumption about blockchains is that it is being used for both the consensus mechanism, how the servers decide on what data to append to the blockchain, and the record of those decisions, that is, the result of the consensus. Technically, the blockchain is just the record of those decisions finalized in "blocks." However, a lot of people conflate the two.

The blockchain is the result of the consensus validation. Consensus occurs after a certain number of servers (peers) vote together that the outputs being sent from one person to another are legitimate thereby coming to "consensus" on the next valid block. If they all agree the transactions are legitimate, the peers accept the transaction, and they append the encrypted part of that transaction to the blockchain. Only the recipient has the private key to decrypt it.

MobileCoin's Blockchain differs from other blockchains. Other networks retain complete copies of all transactions, so new participants can validate the chain independently. Alternatively, MobileCoin uses MobileCoin Fog to offload the transactional data. Once a transaction has been validated, most of its data is discarded. Only the information necessary to make new transactions are saved in the MobileCoin Blockchain, such as key images and outputs. MobileCoin protects users from data leakage, location monitoring, and surveillance.

Using MobileCoin Fog (discussed next), MobileCoin has made the blockchain encrypted and secure for smartphone usage.


MobileCoin Blockchain

![](https://raw.githubusercontent.com/mobilecoinofficial/developer-portal/main/images/Fog.png)

[What is MobileCoin Fog?]: #what-is-fog

MobileCoin Fog is a new technology developed by MobileCoin, which is a service designed to support use of the MobileCoin payments network on mobile devices. MobileCoin Fog is designed so that MobileCoin and the messaging app's service operators have limited insight into users' payments. Most people understand what the Cloud is, a type of technology infrastructure that hosts an organization's network capabilities and resources in a public or private remote computing platform. Fog is similar in that it is cloud, but opaque. You cannot see what is going on inside a Fog service. It is encrypted end-to-end. How does MobileCoin use this technology to allow two people to send digital cash to each other using their smartphone?

### To a Five-Year Old Child:

Pretend that you have a glass jar of marbles. You are the owner of the jar. You can see who wants a marble and what marbles other kids pick out of the jar. But! What if Bobby wants to pick out a marble without you knowing which one it is? He wants it to be his secret only. Maybe, you add a bunch of cotton around all of the marbles. Bobby now can reach into the jar and pull out a marble without you knowing which one he pulled out. Even though you own the jar of marbles, Bobby can secretly remove a marble without you knowing which one it is. You know he is taking a marble, but that is all. That is what MobileCoin Fog does. It keeps Bobby's marble choice encrypted, so no one else knows, not even you, the owner of the jar, what marble he chose.

### To a Grandparent:

MobileCoin Fog is similar to encrypted information retrieval. What if you want to find out about RVing in Alaska? You search on Google for campsites. The Google team keeps track of your searches. All of a sudden, you start seeing ads for campers, camping gear, and camping insurance. Somebody at Google has shared your searches with advertisers. When you use MobileCoin to send payments through your smartphone, the information is encrypted and no one, not even the operators at Signal or any other messaging app that you are using, can see what you have spent or with whom. No one can track your spending habits. MobileCoin Fog makes this possible and practical on a mobile device, as well.

### To a First Year College Student:

Cryptocurrency is a form of online money where no trusted institution, like a bank or government, is responsible for the value or the stewardship of the currency. The issue with Bitcoin is that it is not encrypted. Anyone can track back your transactions to the beginning of the Bitcoin, harvest that data, and sell it to advertisers. It is also not super easy to use because you have to download the wallet software and understand the technology. And, finally, it is very slow. It can take anywhere from ten minutes to 60 minutes for a transaction to go through.

In cryptography, the ability to retrieve information from a server that you do not own without the operator of that server knowing what information you are trying to recover, is called encrypted information retrieval. Hiding the access pattern is extremely difficult to do. A technology, called oblivious RAM (ORAM), helps this happen. MobileCoin Fog is the first production-grade open-source implementation of ORAM that exists today.

In addition, MobileCoin has placed the ORAM data structures inside Intel's Software Guard eXtension (SGX) secure enclaves, which means reads and writes do not correlate transactions with users, even in the event of a side-channel exploit against SGX. Fog serves queries without revealing significant transaction information, and without compromising scalability.

Fog's query service provides an alternative to downloading the entire blockchain, which is critical for mobile devices. Users do not have to test every transaction using their cryptographic keys, which saves significant bandwidth and computations required for every new transaction. Fog does a form of processing of the blockchain, but does it for the users and without needing their private keys. Fog ingest, the server that houses the ORAM in the SGX enclave, looks at the blockchain as it gets updated and decrypts part of each transaction. Fog prepares this decrypted information for the user to retrieve at a later point, so that users can make queries to Fog about their transactions, and check their balances and send transactions to others. The smartphone can make an oblivious request against the oblivious database in Fog. And no one knows what you are spending your MOB on! It is encrypted, fast, and easy to use.

MobileCoin's cryptocurrency payment system runs on Signal, which is an encrypted messaging app. People used to use Pretty Good Privacy (PGP) to send encrypted messages via email. But, for the normal person, PGP was difficult to use. Signal developed a way to send an encrypted message without anyone having to think about the underlying cryptography. Similarly, MobileCoin has created a cryptocurrency that has an encrypted blockchain where you do not have to think about the underlying technology. In fact, when you use Signal, you do not send a cryptocurrency address. You literally just type in a phone number and hit send on your smartphone. Fog lets this happen.

### To a Software Engineer:

MobileCoin Fog is a solution to the scalability problem of encryption for cryptocurrency. The scalability problem is the following -- by design, no one can determine who owns a particular coin, without having the private keys of the owner. However, this forces all participants to download all the transactions and scan them with their private keys, which is prohibitive on mobile devices, and onerous for casual users. 

MobileCoin Fog is a solution to this problem, which:

-   Encrypt indexes the blockchain, so that your TxOut's have pseudorandom keys that only you can predict

-   Provides a way to search the blockchain for your pseudorandom keys

-   Provides a way to complete balance checks and build transactions, obviating the need to download the ledger completely.

Fog is dramatically more efficient than view-key scanning each transaction with each user's keys -- it does only a small amount of work per transaction and does not do work per user and per transaction, so that it can scale up to a billion users.

A single Fog server currently supports hundreds of queries per second across the entire MobileCoin ledger, and speed is expected to improve as we continue to optimize it.

Fog's search functionality is based on a nascent technology called Oblivious RAM. This technology has been studied for decades but not shipped in a real production web service until MobileCoin launched Fog. Fog also makes critical use of Intel SGX enclaves and works within the SGX threat model to ensure that the Fog service operators have no insight into your transactions. This aspect of Fog was inspired in part by the Signal Contact Discovery service.

Fog ensures that even in a threat model where MobileCoin operators and Signal operators are hacking into the operating systems of their machines and attempting to scour them for evidence, they are unable to determine the amount or the recipient of your transaction, without penetrating Intel SGX security guarantees.

Fog also has a forward secrecy property, so that if a vulnerability is found in SGX, it recovers gracefully after the patch. Crucially, users' private keys are never inside of Fog SGX enclaves, and they always remain on your mobile device.

Architecturally, Fog consists of four scalable microservices, and a database which stores a post-processed version of the blockchain (with the indexing information).

-   Fog Ingest:

This service is responsible for post-processing the blockchain and creating the indexes. The Fog Ingest SGX enclave maintains a private key, and emits the public key in an SGX-signed record called the Fog Report. When sending MOB to a Fog address, MobileCoin users obtain the report and encrypt part of the address (the view public key) for Fog Ingest, so that it can know who to tag the payment for. This ciphertext becomes part of the TxOut and goes into the blockchain when the TxOut is validated. Later, Fog Ingest picks it up, and the enclave is able to perform the indexing. The indexing works by creating a cryptographic PRNG for each user -- these PRNGs are stored in an Oblivious RAM inside of SGX. The seed to the PRNG is created by key exchange against the user's public key, and the key exchange message gets committed to the database. This ensures that the users can always reconstruct their RNGs as long as they have their private keys. TxOut's are tagged with successive outputs of the RNGs, and then committed to the database. After this, the Fog Ingest enclave deletes each TxOut's specific information, to create forward secrecy.

-   Fog View:

This service is responsible for helping users find their TxOut's based on the indexing performed by Fog Ingest. Fog View makes it possible for users to find key exchange messages so that they can build their RNGs. Fog View also hosts an oblivious RAM inside of an SGX enclave into which it loads all of the post-processed TxOut's. It then supports queries based on outputs of PRNGs, so that users can download exactly their TxOut's.

-   Fog Ledger:

This service is responsible for helping users perform other tasks that would otherwise require downloading the blockchain ledger. One such task is performing key-image checks, which resolves if a TxOut that you downloaded is already spent or not, and is a critical step in balance checking. Another such task is building Merkle proofs of membership for your TxOut, which is required to submit to consensus. This is also an SGX service and all queries like this are mediated by oblivious RAM, similar to Fog View.

-   Fog Report:

This service hosts the Fog Report -- it is accessible to all users, so that they can send transactions to Fog users.

### Summary

All together, these microservices are the basis of Signal's integration with MobileCoin, providing the best-in-class mobile payments experience, in terms of convenience, ease of use, speed, cost, and encryption.  For more information, check out: <https://mobilecoin.com/beta>.


MobileCoin Fog

In this article, we will walk through the life of a MobileCoin transaction and the various technologies that make it happen.  The first two parts of this series focus on the [MobileCoin blockchain](https://developers.mobilecoin.com/overview/explain-like-i'm-five/blockchain),  the encrypted record of transactions, and [MobileCoin Fog](https://developers.mobilecoin.com/overview/explain-like-i'm-five/fog), the back-end service that allows users to securely send, receive, and check the balance of their MOB via their smartphone in under 5 seconds. Now we're going to explain what's happening behind the scenes to construct and verify transactions in real time. 

First, let's look at what a regular cash/debit transaction looks like. Have you ever tried to spend $20 at the corner store and had the cashier put a mark on the bill? That process is designed to verify that your money isn't fake. Throughout the life of a dollar, there are many verification checkpoints. In the United States, the Federal Reserve prints bills with unique serial numbers and hard-to-counterfeit physical properties, including UV-light responsive ink, microscopic markings, and even the special paper that dollars are printed on. Once in circulation, money is deposited into banks, where customers can save or spend it. At every step of the way, transaction checkpoints verify that the dollar truly exists. Yet, all of these checkpoints depend on trust. What if the cashier doesn't trust their marker? All of a sudden, your money's no good. What if you sell something on eBay and someone complains to PayPal about your shipment, causing a refund? All of a sudden, your money is gone. In traditional finance, you need to trust the institutions handling your money.

With cryptocurrency, money exists in a publicly verified record as 'Unspent Transaction Outputs,' each with a unique serial number, and hard-to-counterfeit cryptographic properties. All transaction verifications happen in real-time within seconds. 

So how does MobileCoin enable this to happen so quickly between two smartphones? The principles are simple, even if the tech is wildly complex. Let's dive in.

The Life of a Transaction
=========================

To a Five-Year Old Child:
-------------------------

Imagine you are setting up your own lemonade stand with your younger brother. You ask your parents to provide the lemons and cups, and you make the lemonade, with only a little help from your sibling. Next you set up your stand on the sidewalk in front of your house. You make a sign: "One Cup of Lemonade for 50 cents." Your first customer appears. Alice walks by your lemonade stand and says she would like to purchase a cup of lemonade. You tell her the price is 50 cents. To your surprise, Alice hands you a bag of 50 pennies. As you count each penny quietly in your head, your younger brother watches and counts each penny loudly, to show everyone that he can count too. You lose your count, so you call your parents over to confirm the amount is correct. Alice waits patiently while both you and your parents count all 50 pennies, and you hand Alice a cup of fresh ice cold lemonade. The verification that the pennies were indeed a U.S. currency had to occur ahead of time before Alice could spend her pennies at your lemonade stand. Once the pennies are in the jar, you can no longer tell which pennies were from Alice, and which pennies were from other customers. You remember how many pennies you received, but you can't go back and count them again. 

To a Grandparent:
-----------------

MobileCoin is electronic cash, so instead of pennies or dollar bills, the transaction requires payment from someone using a "wallet" app on their smartphone. Let's say Bob wants to buy concert tickets from Alice for $20. He opens the [Signal](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate) messaging app on his phone, now with a built-in MobileCoin wallet. Bob goes to "Settings" to find "[Signal Payments](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate)" where he can check his balance. Bob has enough money in his MobileCoin wallet, so he finds Alice in his list of contacts, and sends $20 to Alice. Only instead of sending U.S. Dollars (USD), Bob sends Alice the equivalent of $20 in MobileCoin (MOB). Alice gets a notification on her phone, "Bob sent you $20 worth of MOB." Alice hands Bob the concert tickets (or sends them via email). Alice and Bob are the only two people who are able to see that this transaction was completed. 

Behind the scenes, this payment is broadcast from Bob's phone over the internet to the validator nodes on the MobileCoin blockchain network. Validator nodes are servers on the internet run by independent organizations. Every validator node in the network agrees on the details of the transaction, and the valid transaction is recorded with other transactions in a "block." The block is signed and sealed, with all the validators agreeing to store the block, forever. Inside this block is the transaction that proves Alice received the $20 of MOB from Bob. The block is added to the blockchain, and all the validators have a copy of all the blocks. The blocks cannot be altered by one validator, at least not without the other validators knowing. Bob's [Signal](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate) wallet is checking the blockchain to see that the payment went through, and as soon as it does, his phone updates with a message "Payment successful."  Bob's Signal wallet also sent a digital receipt to Alice with the proof that it was him that paid her. Alice's balance also updates on her phone, and she sees the notification on her phone. And all of this took mere seconds.

![](https://lh6.googleusercontent.com/a0_kGA7WErGBo4WJVhCq9Ir_74BWLsOigTdv105QJaUw9mHmahgOx7TunACJKrVSZd17R0KPdno_DD10ItJxYdWssysGtvwNa5xMZ1z329RK6mUz1SykyGA8wtmz6EjkI8THPYxrHfX6VdM8aw)

The life of a MOB transaction on a smartphone in a messaging app.

To a First Year College Student: 
---------------------------------

You already use payment apps like Venmo, PayPal or Cash App, and there are many apps that let you buy, sell, and send cryptocurrency. There are so many cryptocurrencies, and they all have fees to send money. Why would someone consider using a cryptocurrency for payments? Here are our top three reasons you should consider using MobileCoin.

The first reason? Payment apps, like Venmo and PayPal, have access to your payment habits, which they sell to advertisers who want to better target you with marketing campaigns. If you don't switch to private mode on Venmo, your Venmo payments are visible to everyone - and their mother. You might switch to private mode if you are donating money to religious or political organizations, buying medical prescriptions, on a date, or buying drinks at casinos. Even in private mode, Venmo has access to your financial information and can use it for offers, advertising, search results, or anything else covered in their terms & conditions. 

The second reason? You can take advantage of the best feature of cryptocurrency -- you can actually have self-custody of your money. Self-custody means you can buy, sell, store, or lend crypto-currency -- with MobileCoin's digital wallets. Payment apps like Venmo previously don't allow you to self-custody your wallet. You don't actually have access to the private keys to your money. 

The third reason? MobileCoin's digital wallet on messaging apps makes it easy to use cryptocurrency, while ensuring your MOB is secure. With cryptocurrency exchanges becoming ubiquitous around the world, including FTX, Binance, and BitFinex, you are able to buy MOB and transfer it to your digital wallet. And your crypto is safe, even if you lose your phone or change your phone number. For example, [Signal](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate) requires a PIN to regain access to your transactions where a QR Code is generated for each account. In addition, a 24-word recovery phrase, unique to you, enables you to unlock your data.

With MobileCoin's digital wallet, your transactions are completely private and secure. Using cryptography, your transaction payment history is kept private from the operators of MobileCoin and the messaging apps, like [Signal](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate), as well as any third-party organizations. A record exists that something occurred on the blockchain, but all of the participant information in the transaction and the amounts are encrypted. Only you and the person with whom you transacted knows what occurred.  When you look at other cryptocurrencies, the addresses and amounts of all transactions are publically available on their blockchain ledgers. This means once someone knows your address, all your transactions -- past and future -- are fully available for them to see. MobileCoin is a different kind of cryptocurrency than others because of its end-to-end encryption features. With MOB, all senders, receivers, and amounts are private, and the user is empowered to own their own data.

#### Getting a Digital Wallet is Easy

Bob already has the Signal app, a cross-platform centralized encrypted instant messaging service that lets him share text, voice messages, photos, videos, gifs, and files. Bob can send and receive payments in the Signal app. What if Alice doesn't have Signal installed on her phone? She can just download the app and [activate Payments in Signal](https://developers.mobilecoin.com/ecosystem/signal-payments).

When Alice creates her digital wallet, the cryptography behind the scenes creates a pair of private keys that she can use to view and spend her funds. These keys are her private credentials for interacting with her balance and they never leave her wallet and never appear on the blockchain. When she wants to receive MOB from Bob or someone else, her public address is generated from her private keys. This functionality occurs behind the scenes, which makes sending and receiving MOB so easy.

#### Concealing the Receiver and Sender

For Bob to send MOB, he needs to have already added cryptocurrency to his digital wallet. To add funds, Bob can send MOB to his wallet's public address from an Exchange. Bob must have an account set up on an Exchange that supports MobileCoin, then he can scan the QR code or copy his public wallet address and follow the Exchange's instructions to send money to his digital wallet.

We added a layer of security and privacy at this point in the life of a transaction called one-time addresses. This RingCT technology, which is an application layer protocol that combines ring signatures and Pedersen Commitments, allows Bob to generate a one-time address from Alice's public address. This is the value that will appear as the address of the output on the blockchain and reveals nothing about Alice's public or private credentials. Again, this happens behind the scenes. 

Another layer of security we added is Ring Signatures, which maintain the sender's (Bob's) privacy. About 11 different outputs are pulled from the ledger as decoys. They are all grouped together in a ring that Bob signs, which means he owns one of the outputs. Because we had to avoid double spending the same coin, we added a key image, or a unique tag, to the ring. If that key image has never appeared in the ledger before, then the real source of a ring signature transaction has never been spent before. 

#### Confidential Amounts Hide the Amount of the Transaction 

To conceal the amounts, we added a level of security called confidential amounts, or Pederson Commitments, which are a confidential way of representing a value. This confidentiality ensures the amount of the MOB is not listed on the blockchain. However, Alice can see the amount sent to her by applying her own private credentials. She can see that this particular coin is addressed to her and that the amount is $20 worth of MOB.

.

![](https://lh6.googleusercontent.com/IqKsJz4wyWn12TWUNfYBNC9B69emv21HnV-cfTsxSsHaTDa6VX46PM3JbJZJc46k0iVnX2FgzXvKtxVcV93LE5dAhknzj446pqsRyg7R6fu5P6Ad9tzxazKh6uXg-MzWDyUbTyddPWbgaaKtlQ)![](https://lh6.googleusercontent.com/RfbBDhNjmHUP0qyU4t-Ed8jIC4tM4I7MGFvjc5PptX_sG_ihiWr_Wmcz48gZbScRbvKrthqdTWr6vTcFiqApi_0eUUWIT70RHl5YytwtXTdHyEZq5AU6g9YwyrPheh_ldYrE-lCYrknLGKpWLA)

Arrows allow the user to switch between the cryptocurrency value of MOB and the related amount of U.S. dollars.

Once a transaction has been completed, the digital wallet displays the amount transacted, as well as notes on the transaction. Although the transaction just took under five seconds, layers of digital security occurred behind the scenes. The next section explains the cryptography included in the transaction, as well as the hardware levels of security that take place for the life of a transaction. 

To a Software Engineer: 
------------------------

At the core of a MobileCoin transaction is cryptography, from elliptic curves underpinning various means of encryption, to the hashing algorithms at the heart of the merkle tree data structure that provides the "chain" aspect of the blockchain.  In the ELI5 series, we previously covered the MobileCoin blockchain and MobileCoin Fog, which are the technologies we developed to reduce security risks and improve speed of transactions. In this article, we focus on cryptography, or more specifically, Elliptic Curve Cryptography (ECC), which generates security by using the mathematics of elliptic curves, as well as the benefits of secure enclave hardware for minimizing security leakage. 

Similar to the Rivest-Shamir-Adleman (RSA) algorithm, ECC, a type of mathematics that underpins a whole class of asymmetric algorithms, uses public and private keys that are mathematically linked to encrypt and decrypt information. This elliptic curve is a set of points that are defined by a math function, a starting point, multiple connections, and a fixed range. We implemented ECC because it generates smaller key sizes with the same advanced ability as RSA to maintain security, while using less "computing power," giving us an efficient option for mobile phones. For example, when RSA generates a key the size of 7680 bits, ECC generates a key the size of 384 bits, almost one-fifth the size.

Starting with the unspent transaction output (UTXO) model of cryptocurrency, we added additional layers to the transactions (as described earlier to the first-year college student) to build better privacy than other cryptocurrency models. Transactions in most other cryptocurrencies reveal the owners of inputs and outputs, as well as amounts. MobileCoin has privatized this information by including:

-   Ring Signature: Hides the input transactions in a group. The decoy transactions are all equally likely to be part of the transaction, so the sender is concealed.

-   RingCT One-Time Address: Hides the recipient.

-   RingCT Confidential Amount: Hides the amount.

#### Checks and Balances of Transaction Process in a Secure Enclave

To ensure the transactions are processed with the most privacy and security possible, we added another layer of security above and beyond the inputs and outputs. We moved the transaction process inside Intel's Software Guard eXtension (SGX) secure enclaves. Secure enclaves ensure confidence that the machine is running the correct code, through remote attestation, and security because the piece of code runs in a "black box" where even the operating system is unable to decipher what the code is doing. 

When Bob submits his transaction to the network, he submits it as an encrypted message into an SGX enclave within a node on the network. Only the SGX enclave can see the full contents of the transaction. And this is where the enclave validation occurs:

-   The enclave first verifies that all of the inputs used in the ring signatures exist in the ledger by applying membership proofs, or Merkle Proofs, to prove that the inputs were spent and exist in the ledger. 

-   The enclave proves that the amount of the value going in is the amount going out, even though the code cannot see the actual value. Bulletproofs, or range proofs, ensure that all amounts denote valid amounts of MobileCoin. 

-   The enclave checks a Ring Confidential Transaction signature, which serves to show that everything being spent was actually owned by the signer and that the value of the inputs equals the value of the outputs.

#### Redacting the Transaction for Additional Privacy and Efficiency

That's not all. We realized at MobileCoin that since the inputs, the proofs and the signatures were verified within the enclave, the additional information did not need to be saved. The enclave could remove the extraneous information, retaining only the key images, which uniquely identify the inputs, and the outputs, or coins, that were created by the transaction. The fee is also converted into a coin. At this point, the enclave emits a signed block, indicating it performed the checks correctly. In addition, by redacting the inputs in the rings that created the outputs, leakage is avoided, diminishing Chain analysis attacks. 

Because modern mobile phones cannot store an entire blockchain ledger locally, MobileCoin figured out a way to offload the balance checks to the MobileCoin Fog, as discussed previously. 

And that is the life of a transaction from one smartphone to another. 

If you want to experience the life of a transaction for yourself, now is the time to try it out -- easily and painlessly. For more information, check out our guide on [how to use MobileCoin](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate) within the [Signal app](https://developers.mobilecoin.com/overview/how-to-use-mobilecoin/activate).


In this article, we will walk through the life of a MobileCoin transaction and the various technologies that make it happen.  The first two parts of this series focus on the [MobileCoin blockchain](https://developers.mobilecoin.com/overview/explain-like-i'm-five/blockchain),  the encrypted record of transactions, and [MobileCoin Fog](https://developers.mobilecoin.com/overview/explain-like-i'm-five/fog), the back-end service that allows users to securely send, receive, and check the balance of their MOB via their smartphone in under 5 seconds. Now we're going to explain what's happening behind the scenes to construct and verify transactions in real time.

Life of a Transaction

Explain Like I'm Five

Buying MobileCoin in your web browser is as easy as following this guide to buy MobileCoin with the Fennec Wallet on the 4Swap Exchange. In this guide, we will show you how to get MobileCoin by first buying Bitcoin and then exchanging it for MobileCoin. You will learn how to use the Fennec wallet that works right in your browser.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 1: Buy Bitcoin to swap for MobileCoin.

 The easiest way is to buy Bitcoin is on an exchange like [FTX.us](http://FTX.us) or [Coinbase](http://coinbase.com).

To buy Bitcoin on [FTX](https://ftx.us/):

-   Register and go through the ID verification process. For more info and detailed steps to how to complete the ID verification process, check out [FTX's video](https://www.youtube.com/watch?v=am-oCJnZaug).
-   At the top of the FTX page, click WALLET to deposit some Bitcoin to exchange for MOB. You can use your credit card to purchase Bitcoin directly on FTX. Click the BUY BTC WITH CREDIT CARD button, and now you have Bitcoin in your wallet. For more details, here's an [explainer video](https://youtu.be/8Lnm-ij7Ga4?t=195).

To buy Bitcoin on [Coinbase.com](http://coinbase.com/):

-   Register and go through the ID verification process. For more info and detailed steps of how to set up a Coinbase account and buy Bitcoin, check out [Coinbase's tutorial](https://www.coinbase.com/learn/tips-and-tutorials/how-to-set-up-a-crypto-wallet).
-   Once you have set up your account, a green button will appear to add a payment method. Coinbase will likely make two small deposits to your bank account, which appear immediately. Login to your bank account and enter the two deposit amounts when prompted. Once you do this, the green button will change to say BUY CRYPTO.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 2:  Install the Fennec crypto wallet on your browser

You now need a wallet to hold your crypto. You can obtain a wallet by adding the Fennec desktop wallet extension to [Chrome supported browsers](https://chrome.google.com/webstore/detail/fennec/eincngenkhohbbfpkohipekcmnkfamjp) and [Firefox](https://addons.mozilla.org/en-US/firefox/addon/fox_fennec/).

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-9.43.04-AM-1024x395.png)\
After you add the extension, follow the instructions to set up an account. Make sure to backup the keystore to your computer when prompted or you could lose your crypto assets permanently. You also want to make sure you choose a strong password. Note: Passwords can't be reset, so you need to make sure you remember your password.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 3: Send Bitcoin to your Fennec wallet

Now go over to your Fennec wallet (click the orange fox icon in your extensions bar to pop out your wallet). On the home screen you will see buttons for Send, Receive, and Swap. Below that you will see a box with tabs for Assets and Activities. Use the search bar in this box to search for BTC and click ADD ASSET.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-11-29-at-6.09.28-PM-1024x760.png)

Once you have added Bitcoin as an asset you can go back and hit the RECEIVE button. Make sure the bar is showing BTC. You should see an address that looks like a QR code with a long string of letters and numbers and a small button to copy the address in the bottom right corner. That's your wallet address. Copy it.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-11-30-at-11.42.56-AM-1024x755.png)\
Go back to Coinbase in your browser. Click the big button in the upper right corner that says SEND/RECEIVE. Make sure the SEND tab is active. At the bottom of the popup choose Bitcoin for the type of coin. Enter the amount you would like to send to your wallet. Choose a very small amount for your first transaction to make sure that you are doing everything correctly. Paste the address that you copied from your Fennec wallet into the TO field. Hit CONTINUE.

The transfer of Bitcoin into your Fennec wallet may take some time (could take up to an hour). When confirmed, you should see in your Fennec wallet that you have Bitcoin.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-11.26.30-AM.png)

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 4: Swap your Bitcoin for MOB at 4swap

You can do the first part of this step while you're waiting for your Bitcoin to arrive into your Fennec wallet. [4swap.org](https://4swap.org/) is a decentralized exchange that currently lists MOB. Go to [4swap.org](https://4swap.org/) and click the big pink button that says USE 4SWAP.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-9.39.19-AM-1024x684.png)

Click CONNECT WALLET (another pink button).  Since you have already installed the Fennec wallet on your browser, 4swap should ask you automatically if you want to connect your Fennec wallet to 4swap. Click CONNECT FENNEC.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-9.40.00-AM-1024x218.png)

Once you have Bitcoin in your wallet and your wallet is connected to a decentralized exchange that trades in MOB (4swap), this last bit should be easy. Make sure the top line on 4swap says BTC (Bitcoin). Enter the amount of Bitcoin that you want to swap. Make sure the second line says MOB (MobileCoin). Once you enter the amount of Bitcoin that you want to swap, the MOB line should auto-populate with the correct exchange amount and the SWAP button should activate and become pink. Hit SWAP.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-09-14-at-11.27.43-AM-1024x393.png)

After a few seconds your MOB should appear in your Fennec wallet. Congrats! You now own MobileCoin!



### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg) Send your MOB from the Fennec browser wallet to your MobileCoin desktop wallet

This is a really easy process. But first you have to [download your MobileCoin desktop wallet and create an account.](https://mobilecoin.com/news/how-to-download-and-set-up-your-mobilecoin-desktop-wallet) Once you've got your MobileCoin desktop wallet installed, it's simply a process of sending and receiving money, which you've done before.

Open your Fennec desktop wallet and choose SEND.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image9-1024x752.png)

Choose ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image8.png).

Make sure the top line says MOB and choose SELECT FROM ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image22-1024x706.png)

Here you will need to add your MOB wallet address. Click the + to add a new address. Open your MobileCoin desktop wallet and enter your password to unlock your wallet. Once your wallet is open, you will see your address (it is the square filled with lots of blue, white, and green letters and numbers). Click on the address block to copy it.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image10-blur-867x1024.png)

Back in your Fennec wallet, paste your address into the address box on the bottom. Name your address something memorable. Click SAVE. Fennec will make your re-enter your password. After you do, you will see a green button pop up that says SAVED SUCCESSFULLY.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image27-blur-1024x1018.png)

Click on the address box. This will open the send screen. Click into the box that says MOB and enter the amount you want to send.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image17-1024x652.png)

Hit the big orange button that says SEND. You should see another green button pop up that says SEND SUCCESSFULLY! Your MOB should appear in your MobileCoin wallet within a few seconds. If you don't see it appear automatically, log out and log back in to your wallet.


Buying MobileCoin in your web browser is as easy as following this guide to buy MobileCoin with the Fennec Wallet on the 4Swap Exchange. In this guide, we will show you how to get MobileCoin by first buying Bitcoin and then exchanging it for MobileCoin. You will learn how to use the Fennec wallet that works right in your browser.

Buy MOB with Fennec Wallet

Buying MobileCoin is as easy as following this guide on how to use MixSwap and the Mixin mobile app. MixSwap is an aggregator for 3 decentralized exchanges that allow you to buy MobileCoin by "swapping" Bitcoin, USDT, and other currencies for MobileCoin. To swap with MixSwap, you need to use Mixin. Mixin is a mobile app with a built-in crypto wallet. Like Signal, Mixin supports messaging your contacts with end-to-end encryption and is built on the Signal protocol. 

Download Mixin Messenger
----------------------------

-   Google Play: <https://play.google.com/store/apps/details?id=one.mixin.messenger>

-   App Store: <https://apps.apple.com/us/app/mixin-messenger/id1322324266>

[Watch this video on YouTube on how to buy MobileCoin on Mixin.](https://www.youtube.com/watch?v=pE6d7Aa_kKM)

Send Bitcoin to your Mixin Wallet
---------------------------------

First, you need to get your wallet address in your Mixin app. Open the Mixin app then choose the square icon on the bottom left corner to access your wallet. Once you are in your wallet, tap on the line that says BTC (Bitcoin). This will take you to the Bitcoin send and receive page. Tap on RECEIVE. A popup will appear; tap GOT IT. Then tap COPY to copy your wallet address.

Connect the MixSWap Exchange
----------------------------

Tap on the search icon in the top right corner (the magnifying glass). Enter the number 7000103767 and tap SEARCH. This will locate a bot called MixSwap. You will know you have the right app because you will see a purple bird logo. Tap on the bot and add it to your app. Once you have the MixSwap bot installed, you can access the bot from your home screen in the app.

Swap Bitcoin for MobileCoin
---------------------------

Open the bot and tap the icon in the bottom right that looks like a little robot with antennae. This will open the exchange screen. Enter the amount of Bitcoin that you want to trade for MOB. The only tricky part here is that they do not tell you how much Bitcoin you have in your wallet, so you may need to toggle back to your wallet to see how much you have. Once you enter the Bitcoin amount, the corresponding MOB amount should auto-populate. Make sure that the receive category says MOB and tap EXCHANGE.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 1: Buy Bitcoin on a coin exchange

While there are a number of coin exchanges and thousands of cryptocurrencies, one of the easiest ways is to buy Bitcoin on a coin exchange like FTX.us or Coinbase.

To buy Bitcoin on [FTX](https://ftx.us/):

-   Register and go through the ID verification process. For more info and detailed steps to how to complete the ID verification process, check out [FTX's video](https://www.youtube.com/watch?v=am-oCJnZaug).
-   At the top of the FTX page, click WALLET to deposit some Bitcoin to exchange for MOB. You can use your credit card to purchase Bitcoin directly on FTX. Click the BUY BTC WITH CREDIT CARD button, and now you have Bitcoin in your wallet. For more details, here's an [explainer video](https://youtu.be/8Lnm-ij7Ga4?t=195).

To buy Bitcoin on [Coinbase.com](http://coinbase.com/):

-   Register and go through the ID verification process. For more info and detailed steps of how to set up a Coinbase account and buy Bitcoin, check out [Coinbase's tutorial](https://www.coinbase.com/learn/tips-and-tutorials/how-to-set-up-a-crypto-wallet).
-   Once you have set up your account, a green button will appear to add a payment method. Coinbase will likely make two small deposits to your bank account, which appear immediately. Login to your bank account and enter the two deposit amounts when prompted. Once you do this, the green button will change to say BUY CRYPTO.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 2: Download the [Mixin Messenger](https://mixin.one/messenger) app onto your phone

Mixin Messenger is available on both iOS and Android. Create an account. You will need to choose a 6 digit pin and enter it four times (they really don't want you to forget this pin).

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image23.png)

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 3: Transfer your Bitcoin to your Mixin Messenger wallet on your phone

First, you need to get your wallet address in your Mixin app. Open the Mixin app then choose the square icon on the bottom left corner to access your wallet.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image13-1.png)

Once you are in your wallet, click on the line that says BTC (Bitcoin). This will take you to the Bitcoin send and receive page. Click on RECEIVE.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image4-473x1024.png)

A popup will appear; click GOT IT. Then click COPY to copy your wallet address.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image7-blur-473x1024.png)

Now you need to go back to Coinbase. You can do this on a desktop or you can use their mobile app. If you are using the mobile app, please follow the instructions below. If using a desktop, you can find those instructions at the top of this post in the desktop section.

Login to your Coinbase app. At the bottom of the home screen you will see five icons. Click the one in the middle with the two arrows. This will open a popup where you can then choose the SEND option.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image19-473x1024.png)

This will take you to a screen that lists the different types of cryptocurrencies that you own. Click on BTC (Bitcoin). Enter the amount of Bitcoin that you want to send (in USD) and choose CONTINUE.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image29-473x1024.png)

It will ask you if you would like to access your contacts to send crypto to a friend. Choose NOT NOW. Then paste the address from your Mixin wallet into the TO field and choose PREVIEW SEND.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image5-1-473x1024.png)

Make sure everything looks correct and click SEND NOW. This transaction could take 30 minutes to an hour or more to show up in your Mixin wallet.

### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 4: Swap your Bitcoin for MOB in Mixin Wallet

There are two sub steps to this last step. First, go back to your Mixin app and click on the search icon in the top right corner (the magnifying glass). Enter the number 7000103767 and click SEARCH. This will locate a bot called MixSwap. You will know you have the right app because you will see a purple bird logo.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image24.png)

Click on the bot and add it to your app. Once you have the MixSwap bot installed, you can access the bot from your home screen in the app.

Once you are inside the bot, click the icon in the bottom right that looks like a little robot with antennae.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image18.png)

This will open the exchange screen. Enter the amount of Bitcoin that you want to trade for MOB. The only tricky part here is that they do not tell you how much Bitcoin you have in your wallet, so you may need to toggle back to your wallet to see how much you have. Once you enter the Bitcoin amount, the corresponding MOB amount should auto-populate. Make sure that the receive category says MOB and click EXCHANGE.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image14-1-473x1024.png)

You now own MobileCoin! 


### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg)Step 5: Move your MOB into your MobileCoin desktop wallet

First, quit and restart your MobileCoin desktop wallet TWICE to make sure it updates and is running the latest version. In your MobileCoin desktop wallet, tap the SEND/RECEIVE tab and then tap RECEIVE MOB. Tap the button in the top right corner of the address box to turn your address into a QR code.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/Screen-Shot-2021-11-30-at-12.39.52-PM-752x1024.png)

In Mixin Messenger on your phone, where all of your currencies are listed, tap on the MOB section. Tap SEND. It will ask if you want to send to a contact or an address. Choose ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/IMG_2018-473x1024.png)

On the address screen tap the PLUS sign in the top right corner to add your MobileCoin desktop wallet address. Name your wallet in the Label section. In the Address section tap the square on the right side to open the camera and then use your phone to scan the QR code on your MobileCoin desktop wallet on your computer. Once you scan the code it should populate in the address line. You may need to enter a memo on the last line to activate the Continue button. Tap CONTINUE and enter your pin.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/IMG_2020-473x1024.png)

You should then see your address listed on the Address page. Tap on the address and it will open to a screen where you can enter the amount you would like to send. Enter the amount and tap CONTINUE. Enter your pin again.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/IMG_2021-473x1024.png)

This completes your transaction! You should see your MOB show up in your MobileCoin desktop wallet momentarily. Be aware that sometimes you may need to restart your desktop wallet for the transaction to appear.


Buying MobileCoin is as easy as following this guide on how to use MixSwap and the Mixin mobile app. MixSwap is an aggregator for 3 decentralized exchanges that allow you to buy MobileCoin by "swapping" Bitcoin, USDT, and other currencies for MobileCoin. To swap with MixSwap, you need to use Mixin. Mixin is a mobile app with a built-in crypto wallet. Like Signal, Mixin supports messaging your contacts with end-to-end encryption and is built on the Signal protocol.

Buy MOB with Mixin Wallet

How to Buy MobileCoin

* * * * *

Got MOB?
----------------------------
You must have MobileCoin (MOB) before you can add it to your wallet. Here are step-by-step guides on buying MobileCoin on a decentralized exchange:
- [Buy in a web browser](/overview/how-to-buy-mobilecoin/fennec)
- [Buy on a mobile phone](/overview/how-to-buy-mobilecoin/mixin)
- [See more exchanges](/ecosystem)

* * * * *

Transfer in from an exchange
----------------------------
1.  Go to  Settings > Payments > Add Money.
2.  Tap Copy to copy the wallet address linked to your Signal account.
3.  Go to a supported exchange.
4.  Follow steps to send on your exchange, paste the wallet address linked to your Signal account and send.
5.  Return to Signal Settings > Payments.


Add Funds to your Wallet

MobileCoin can be sent between any two people with a mobile phone, anywhere in the world. Our partnership with the Signal Messenger app makes MobileCoin available to more than 100 million users across the globe. 

MobileCoin payments sent through Signal are fast, encrypted, and environmentally friendly. Your money arrives on time, every time.

* * * * *

Send Payments
-------------

THIS ACTION CAN NOT BE UNDONE. Be certain of where you are sending to.

1.  Go to Signal Settings > Payments > Send Payment.
2.  Select a contact that accepts payments.
3.  Enter the amount you want to send.
4.  Add a note and select the check mark.
5.  Tap Pay.
6.  Tap Confirm Payment.\
    Note: THIS ACTION CAN NOT BE UNDONE. Once you confirm, the funds will process.

or

1.  Go to the chat with your contact.
2.  Select the attachment icon and select Pay.
3.  Enter the amount you want to send.
4.  Add a note and select the check mark.
5.  Tap Pay.
6.  Tap Confirm Payment.\
    Note: THIS ACTION CAN NOT BE UNDONE. Once you confirm, the funds will process.


* * * * *

Transfer out to an exchange
---------------------------

THIS ACTION CAN NOT BE UNDONE. Be certain of where you are transferring to.

1.  Go to [Signal Settings](https://support.signal.org/hc/articles/360009091591) ![profile_avatar.png](https://support.signal.org/hc/article_attachments/360091706271/profile_avatar.png) > Payments > Menu > Transfer to exchange.
2.  Go to your exchange and view the wallet address.
3.  In Signal, scan or enter the wallet address from the exchange. For the address, look for the 26-35 string of numbers and letters most commonly below the QR code. 
4.  Tap Next.
5.  Tap Pay.
6.  Tap Confirm.\
    Note: THIS ACTION CAN NOT BE UNDONE.
    
* * * * *

Cancel or Undo Payment
----------------------

You can not cancel a payment once you have hit send. You can message your contact and ask them to send you a payment.

If you hit Send, your payment will process. Turning your phone off or disabling your connection will not stop the payment if you have hit send.


MobileCoin can be sent between any two people with a mobile phone, anywhere in the world. Our partnership with the Signal Messenger app makes MobileCoin available to more than 100 million users across the globe.

Send Payments


Transaction details, including the payment amount and time of transaction, are part of the MobileCoin ledger and are unknown to Signal.
-   View transaction history and details in Signal Settings > Payments.
-   Tap a transaction to see its status and message. 
-   After there are a few transactions, tap See All, to view sent and received activity separately.



Transaction details, including the payment amount and time of transaction, are part of the MobileCoin ledger and are unknown to Signal.
-   View transaction history and details in Signal Settings  Payments.
-   Tap a transaction to see its status and message. 
-   After there are a few transactions, tap See All, to view sent and received activity separately.

View Transactions

Enable your Signal PIN
----------------------
A Signal PIN is used to recover the wallet linked to your Signal account if you lose your phone or install the Signal app on a new phone. The PIN is unknown to Signal and it can not be reset if you forget it. To activate your wallet, you must have a Signal PIN enabled in Profile > Settings > Account.

* * * * *

Restore wallet with your PIN
------------------------------

Your balance will automatically restore when you reinstall Signal if you confirm your Signal PIN. 


* * * * *

Uninstalled Signal
------------------
It's okay if you uninstalled your Signal. Just Reinstall it and recover your wallet with your PIN or 24 word passphrase.

-   If you remember your [Signal PIN](https://support.signal.org/hc/articles/360007059792), you can recover settings and the wallet linked to your Signal account.
-   If you do not know your Signal PIN, you can register and restore the wallet linked to your Signal account with the 24 word passphrase. [Follow the steps listed above](https://support.signal.org/hc/en-us/articles/360057625692-In-app-Payments#payments_wallet_restore_passphrase).

* * * * *

View wallet passphrase
----------------------

You can also restore your balance using a recovery phrase, which is a 24-word phrase unique to you. Write it down and store it in a safe place. You can view this list again after creating.

1.  Go to Signal Settings > Payments > Menu > View Recovery Phrase.
2.  Tap Start.
3.  Record the 24 words in order.
4.  Tap Next.
5.  Enter the two words that are requested.
6.  Tap Done.
7.  Recovery passphrase is saved the first time you complete this.\
    Note: There is a limit to your attempts.
    
* * * * *

Restore wallet with passphrase
------------------------------

Restore the wallet linked to your Signal account by using the recovery passphrase you previously recorded. Your recovery passphrase is a total of 24 words.

1.  Have your 24 words available.
2.  Go to [Signal Settings](https://support.signal.org/hc/articles/360009091591) ![profile_avatar.png](https://support.signal.org/hc/article_attachments/360091706271/profile_avatar.png) > Payments > Restore Payments Account.
3.  Tap Start.
4.  Enter a word.
5.  Select Next.
6.  Repeat until all 24 words are entered in order.
7.  Review the recovery phrase list.
8.  Tap Next to submit the passphrase.
9.  If the passphrase is not correct you will start again from the beginning. 




Enable your Signal PIN
----------------------
A Signal PIN is used to recover the wallet linked to your Signal account if you lose your phone or install the Signal app on a new phone. The PIN is unknown to Signal and it can not be reset if you forget it. To activate your wallet, you must have a Signal PIN enabled in Profile  Settings  Account.

Backup & Restore Wallet

![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_07-1-e1635381496489.png)

The MobileCoin desktop wallet is available for [Mac](https://get.mobilecoin.com/mac), [Ubuntu](https://get.mobilecoin.com/ubuntu), [Redhat](https://get.mobilecoin.com/redhat) and [Linux](https://get.mobilecoin.com/linux) operating systems.

MobileCoin Desktop Wallet Download Process For Mac

If you've already downloaded and set up your MobileCoin desktop wallet, [learn how to add funds here. ](https://mobilecoin.com/news/how-to-buy-mob-in-the-us)

1.  1\. Allow downloads from [mobilecoin.com](http://mobilecoin.com/).
2.  2\. Open the MobileCoin Wallet installer from your downloads folder.
3.  3\. Drag the Wallet icon into your Applications folder.
4.  4\. Double-click the MobileCoin Wallet app in your Applications folder.
5.  5\. Allow your Mac to open the app.

    ![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_07-1-859x1024.png)
6.  6\. Create a password for your Wallet and click the TERMS OF USE.
7.  7\. Read through TERMS OF USE carefully.
8.  8\. Once complete, click CLOSE TERMS OF USE to return to set up.
9.  9\. Check the box next to "I have read and accept the TERMS OF USE" and click CREATE WALLET.
10. 10\. Choose an Account Name if desired and click CREATE ACCOUNT.

    ![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_11-849x1024.png)
11. 11\. Click SHOW SECRET ENTROPY. Save your Secret Entropy in a secure location and click I HAVE SECURED MY ENTROPY.
12. 12\. Confirm that you have secured your entropy, or go back to view it again.![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_13-853x1024.png) 
13. 13\. Set a Transaction Pin and a minimum MobileCoin amount for pin-activated transfers.
14. 14\. Click SET PIN.\
    ![](https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/10/MobileCoin_Wallet_DesktopDownloadProcess_14-853x1024.png)

Welcome to MobileCoin Wallet! [Now you're ready to add some money to your wallet!](https://mobilecoin.com/news/how-to-buy-mob-in-the-us)


Setup a Desktop Wallet


### ![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2022/02/secure.svg) Move your MOB from the Fennec browser wallet to your MobileCoin desktop wallet

This is a really easy process. But first you have to download your MobileCoin desktop wallet and create an account. Once you've got your MobileCoin desktop wallet installed, it's simply a process of sending and receiving money, which you've done before.

Open your Fennec desktop wallet and choose SEND.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image9-1024x752.png)

Choose ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image8.png).

Make sure the top line says MOB and choose SELECT FROM ADDRESS.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image22-1024x706.png)

Here you will need to add your MOB wallet address. Click the + to add a new address. Open your MobileCoin desktop wallet and enter your password to unlock your wallet. Once your wallet is open, you will see your address (it is the square filled with lots of blue, white, and green letters and numbers). Click on the address block to copy it.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image10-blur-867x1024.png)

Back in your Fennec wallet, paste your address into the address box on the bottom. Name your address something memorable. Click SAVE. Fennec will make your re-enter your password. After you do, you will see a green button pop up that says SAVED SUCCESSFULLY.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image27-blur-1024x1018.png)

Click on the address box. This will open the send screen. Click into the box that says MOB and enter the amount you want to send.

![](https://mobilecoinstg.wpengine.com/wp-content/uploads/2021/10/image17-1024x652.png)

Hit the big orange button that says SEND. You should see another green button pop up that says SEND SUCCESSFULLY! Your MOB should appear in your MobileCoin wallet within a few seconds. If you don't see it appear automatically, log out and log back in to your wallet.


  Move your MOB from the Fennec browser wallet to your MobileCoin desktop wallet

Add Funds to Desktop


Deactivate Payments
-------------------

If you do not want to use the MobileCoin wallet in Signal, you can deactivate it. You will not be able to send or receive payments in Signal after you deactivate.

1.  Recommended: [View and copy the wallet passphrase before proceeding.](https://support.signal.org/hc/en-us/articles/360057625692-In-app-Payments#payments_wallet_view_passphrase)
2.  Go to [Signal Settings](https://support.signal.org/hc/articles/360009091591) ![profile_avatar.png](https://support.signal.org/hc/article_attachments/360091706271/profile_avatar.png) > Payments > Menu > Deactivate Payments.
3.  Recommended: Transfer a balance to use again.\
    Note: If you choose not to transfer, the balance will remain in your Signal account. 
4.  Tap Deactivate.



Deactivate

How to Use MobileCoin

<div class="lines-header">

<h1> the <strong>MobileCoin</strong> network</h1>

The MobileCoin open-source software ecosystem introduces several innovations to the cryptocurrency community, including:

<h3 style="color: #6aacd3">MobileCoin Ledger</h3>

a new encrypted blockchain built on a technology foundation that includes CryptoNote and Ring Confidential Transactions (RingCT)

<h3 style="color: #a7a7a8">MobileCoin Consensus Protocol</h3>

a high-performance solution to the Byzantine Agreement Problem that allows new payments to be rapidly confirmed

<h3 style="color: #85ccba">Secure Enclaves</h3>

trusted execution environments using Intel's Software Guard eXtensions (SGX) to provide defense-in-depth improvements to encryption and trust 

<h3 style="color: #95b4cf">MobileCoin Fog</h3>

a scalable service infrastructure that enables a smartphone to manage an encrypted cryptocurrency with locally-stored cryptographic keys

</div>

![](/images/ecosystem_diagram_1.png)

<h2 style="color: #6aacd3">MobileCoin Ledger</h2>

In order for any payments network to function, it must be able to maintain a history of transactions. MobileCoin Ledger describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a blockchain, in which each block contains transactions that include *transaction outputs (txos)* that might be spent in the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never been spent before. The underlying design is based on the encrypted CryptoNote ledger protocol, which obscures the identity of all txo owners using one-time recipient addresses. The link between sender and recipient is protected through the use of input rings that guard the actually-spent txo in a large set of possibly-spent txos.

The monetary value of each txo is encrypted using the method of Ring Confidential Transactions (RingCT). RingCT is implemented using bulletproofs for improved performance. Only the receiver of the transaction can reveal the encrypted monetary value and spend the new txos that are written to the ledger. The recipient's cryptographic control over spending ensures that all transactions in MobileCoin are irreversible, similar to cash transactions in the real world.

Each txo in the input ring of a transaction is annotated with a Merkle proof of inclusion in the MobileCoin Ledger blockchain. This allows new transactions to be validated with fewer blockchain read operations, improving efficiency and reducing information leaked to data-access side channels.

Additionally, the MobileCoin Ledger dramatically improves on the baseline security offered by CryptoNote and RingCT by requiring that the input rings for every transaction are deleted before the new payment is added to the public ledger. Digital signatures are added to the ledger in place of the full transaction records to provide a basis for auditing.  

<h2 style="color: #a7a7a8">MobileCoin Consensus Protocol</h2>

MobileCoin users must agree on the content of the blockchain for it to be useful as a record of accounts. Bad actors will have a financial motive to misrepresent the ledger to enable fraud and counterfeiting. In distributed computing, the challenge of reaching agreement in a group that can't exclude malicious agents from participating is called the Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement Problem.

The MobileCoin Consensus Protocol solves the Byzantine Agreement Problem by requiring each user to specify a set of peers that they trust, called a *quorum*. Quorums are based on the real-life trust relationships between individuals, businesses, and other organizations that compose the MobileCoin Network. There is no central authority in the MobileCoin Network. Users accept statements about the blockchain ledger when their quorum convinces them that these statements are true. While the algorithmic design of MCP is based on the Stellar Consensus Protocol, the MobileCoin Network is not interoperable with the Stellar payment network. 

The MobileCoin Consensus Protocol avoids the environmentally-damaging mathematical "work" required by Proof-of-Work (PoW) consensus protocols like Bitcoin and realizes a much higher transaction rate than the Bitcoin consensus protocol. In contrast to Proof-of-Stake (PoS) consensus protocols, practical control of governance in MCP is ceded to the users who are trusted the most by the extended MobileCoin community, rather than to the wealthiest users who control the largest financial stakes. 

MCP ensures that all operators agree on the sequence of valid payments that are completed. New transactions are grouped in blocks and published approximately once every five seconds to the MobileCoin Ledger.

<h2 style="color: #85ccba">Secure Enclaves</h2>

Recent advances in trusted computing make it possible to run software on a remote host without exposing sensitive data to that server's operator, even when she has complete control of the remote computer's operating system (i.e. root access). Originally designed for digital rights management, these *secure enclave* technologies behave like a black box that ensures confidentiality and integrity for its content.

The MobileCoin Network implements secure enclaves using Intel's Software Guard eXtensions (SGX) to process new transactions according to the MobileCoin Consensus Protocol. Any code that needs to observe the input rings of a new transaction executes inside the black box created by the SGX trusted execution environment. Remote attestation and end-to-end encryption are used to protect the communication channel between a user submitting a new transaction and the secure enclave running on the remote server. The operator of the remote server cannot access any data that the user submits to the secure enclave, and so cannot see the set of txos used in the transaction input ring.

Remote attestation and end-to-end encryption similarly protect the communication channels between secure enclaves running on different remote servers. When the SGX remote attestation system is functioning as Intel designed, it is not possible for any operator in the MobileCoin Network to observe the full content of transactions. Complete data is only shared between secure enclaves that safely delete the information that could otherwise be used to statistically associate payment senders to payment recipients. 

<h2>MobileCoin Fog</h2>

MobileCoin Fog is a scalable service infrastructure developed by MobileCoin to enable cryptocurrencies to be safely managed from a smartphone. Fog solves two major technical challenges of encrypted cryptocurrencies on mobile devices:
1. Identifying received payments 
2. Constructing new payments 

![](/images/ecosystem_diagram_2.png)

## Identifying Received Payments

In order to check if they own any new transaction that appears in the ledger, a user must mathematically test each txo using their private keys. It is undesirable from a security standpoint to provision private keys to a remote server to monitor for received transactions, but it is impractical to perform the calculation for every new transaction on a smartphone because of the significant bandwidth and computation required

MobileCoin has developed an efficient system to help smartphone users locate their received transactions without having to test every transaction using their private keys. Each transaction output in the MobileCoin Ledger contains a discovery *hint* field. This field stores the recipient's public address, encrypted using a public key provided by MobileCoin Fog. The matching private key is stored exclusively inside a secure enclave. Each new transaction in the public ledger is processed within the secure enclave, and recognized transactions are organized for users who have registered their public address.

Additional data transformations are necessary to safely store persistent data across a scalable service infrastructure and significant care is applied to avoid leaking information through data-access side channels. The user's private keys remain on their smartphone at all times. This stands in contrast to existing *trusted query services* prevalent in other cryptocurrencies. When users provision a remote server with private keys, they are trusting that remote service's operators not to expose or share the private keys.

## Constructing New Payments

Users need access to the complete ledger in order to construct transaction input rings. It is undesirable for smartphone users to selectively download parts of the ledger from a remote server as needed, since this can potentially leak information about transaction ownership or the links between senders and recipients. The complete ledger may be many terabytes in size, which makes it impractical to download and store on a smartphone.

MobileCoin Fog allows smartphone users to selectively download ledger data using oblivious data access, meaning that the user can safely retrieve transactions or blocks from the ledger to build new payments without needing to store a complete copy of the blockchain. MobileCoin Cloud uses secure enclaves to implement oblivious data access with improved trust and efficiency.


The MobileCoin open-source software ecosystem introduces several innovations to the cryptocurrency community, including its Ledger, Consensus Protocol, Secure Enclaves, and Fog.

Overview


### Supply

MobileCoin's total current supply of coins is 250 million MOB.  The total supply is fixed, and you can see this in our open source code here: [total current supply of coins](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/transaction/core/src/constants.rs).  The live circulating supply is 
available here: [current circulating supply](https://mobilecoin.foundation/wp-json/mcfoundation/circulating-supply). 

[widget type='circulatingSupply']

The entire supply of MobileCoins was created in the very first block on the blockchain. MobileCoin uses 'Federated Byzantine Agreement' modeled on the the [Stellar Consensus Protocol](https://www.stellar.org/papers/stellar-consensus-protocol?locale=en). This sets MobileCoin apart from Bitcoin and other cryptocurrencies that use 'Proof-of-Work' a process that allows the bitcoin network to construct the ledger by making the process of recording transactions difficult, also known as 'bitcoin mining.' Minig requires a large amount of computing power and miners earn 'block rewards.' This encourages miners to invest in adding greater and greater computing resources to add more miners to the network. The more computers they put ont he network, the more bitcoin they can receive. MobileCoin does not incentivize this type of behavior with block rewards.

MobileCoin is an encrypted cryptocurrency where amounts are hidden behind cryptographic constructions; therefore, it is not possible for observers to passively verify that the origin block contains 250 million MOB. Below you will find instructions on how to access and inspect the origin account.


### Verifying the Supply

You can verify the supply of MobileCoin using the Origin Block Account.

`Origin Block Account Entropy:\
aa9082086d4f341300d3ba08d41db566edc9fb61eec623870b80871681a589eb\
{\
"view_private_key":\
"d825a5c3aaef812d17feba5cf8f3019bcb0608c0a673200fa425e56eb1dc2d0b",\
"spend_private_key":\
"9e95df3801c4b6ab0be854377430e18528546be71335e2afb91f058b3013380f"\
}`

The MobileCoin ledger is denominated in pico MOB (pMOB), where 1 MOB = 10¹² pMOB.

This means the origin block should have 2.5 * 10²⁰ pMOB. You'll note that this exceeds the [maximum value of a u64](https://doc.rust-lang.org/std/primitive.u64.html#associatedconstant.MAX) (~1.8 * 10¹⁹), which is the maximum amount that can be stored in a MobileCoin Txo. For this reason, the origin block is split into 16 Txos, as opposed to a single Txo containing 250M MOB.

MobileCoin currently supports multiple wallet software implementations (see Forum discussion: [Desktop Wallets](https://community.mobilecoin.foundation/t/desktop-wallets/566)). We will describe how to verify the origin block using the Full-Service wallet.

### Verification Steps with Full-Service Desktop Wallet

1.  Download or build the latest MainNet-configured Full-Service binary. See the latest release, which has instructions for building.
2.  Run the MainNet-configured Full-Service binary. See the latest release for an example run command.
3.  Make an account with the origin entropy in a new terminal window via the [`import_account_from_legacy_root_entropy`](https://app.gitbook.com/@mobilecoin/s/full-service-api/accounts/account/import_account_from_legacy_root_entropy-deprecated) endpoint. See the [MobileCoin Key Derivation Upgrade: Migration to Mnemonics](https://medium.com/mobilecoin/mobilecoin-key-derivation-upgrade-migration-to-mnemonics-99a329a8b783) post to understand why root entropies are 'legacy' (i.e. no longer actively supported).\
    `curl -s localhost:9090/wallet \\
    -d '{\
    "method": "import_account_from_legacy_root_entropy",\
    "params": {\
    "entropy": "aa9082086d4f341300d3ba08d41db566edc9fb61eec623870b80871681a589eb",\
    "name": "Origin",\
    "next_subaddress_index": "2",\
    "first_block_index": "0"\
    },\
    "jsonrpc": "2.0",\
    "id": 1\
    }' \\
    -X POST -H 'Content-type: application/json' | jq`
4.  Note the `account_id` that is produced, and then check the balance via [`get_balance_for_account`](https://app.gitbook.com/@mobilecoin/s/full-service-api/accounts/balance/get_balance_for_account).\
    `curl -s localhost:9090/wallet \\
    -d '{\
    "method": "get_balance_for_account",\
    "params": {\
    "account_id": "<your-account-id-here>"\
    },\
    "jsonrpc": "2.0",\
    "id": 1\
    }' \\
    -X POST -H 'Content-type: application/json' | jq`\
    The account was already emptied, so `unspent_pmob = 0` (note that the `spent_pmob` value is nonsense caused by integer overflow). If you have lightning fingers and manage to check the balance fast enough (before more than the origin block has synced), you will see the balance is 250 million MOB.\
    `{\
    "method": "get_balance_for_account",\
    "result": {\
    "balance": {\
    "object": "balance",\
    "network_block_index": "10253",\
    "local_block_index": "1",\
    "account_block_index": "1",\
    "is_synced": false,\
    "unspent_pmob": "250000000000000000000",\
    "pending_pmob": "0",\
    "spent_pmob": "0",\
    "secreted_pmob": "0",\
    "orphaned_pmob": "0"\
    }\
    },\
    "error": null,\
    "jsonrpc": "2.0",\
    "id": 1\
    }`
5.  To dive in deeper, you can use the [`get_all_txos_for_account`](https://app.gitbook.com/@mobilecoin/s/full-service-api/transactions/txo/get_all_txos_for_account) endpoint to see which outputs were received, and which blocks they were spent in.\
    `curl -s localhost:9090/wallet \\
    -d '{\
    "method": "get_all_txos_for_account",\
    "params": {\
    "account_id": "<your-account-id-here>"\
    },\
    "jsonrpc": "2.0",\
    "id": 1\
    }' \\
    -X POST -H 'Content-type: application/json' | jq`\
    There are 19 outputs owned by the origin account, however only 16 are 'origin outputs' (with 15.625 mill MOB each). Outputs with `received_block_index = 0` were created in the origin block. The remaining 3 outputs correspond to either self-spends (sending MOB to yourself) or change outputs (left-over MOB from sending to other people).


Circulating Supply

Each transaction submitted to the MobileCoin network must pay a fee to the MobileCoin Foundation. The purpose of this fee is to prevent unlimited submission of transactions, which otherwise could be easily abused to degrade users' experience. The [minimum fee per transaction](https://github.com/mobilecoinfoundation/mobilecoin/blob/acd72e66832c1aa18dc630bcab610c11978af0dd/transaction/core/src/constants.rs) is 0.0004 MOB, and is always distributed to the following [address](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/consensus/enclave/impl/build.rs) (written in hexadecimal format):

`public view key:\
5222a1e9ae32d21c23114a5ce6bb39e0cb56aea350d4619d43b1207061b10346\
public spend key:\
26b507c63124a2f5e940b4fb89e4b2bb0a2078ed0c8e551ad59268b9646ec241`

MobileCoin launched with a hard-coded minimum fee of 0.01 MOB. When this constant was set, the value of MobileCoin was assumed to be slightly below 1 USD per coin, resulting in a per-transaction fee of under 0.01 USD (1c). This fee was too high to reasonably support the cannonical use-case---purchasing a cup of coffee---and we lowered the fee to $0.04 to bring it back in line with that use-case. 

There is currently a [proposal](https://github.com/mobilecoinfoundation/mcips/pull/1) for the minimum fee to be [configurable](https://github.com/mobilecoinfoundation/mobilecoin/pull/809) in the next version of MobileCoin's protocol. Changing the fee configuration would require a coordinated restart of all validator nodes in the network. 


Each transaction submitted to the MobileCoin network must pay a fee to the MobileCoin Foundation. The purpose of this fee is to prevent unlimited submission of transactions, which otherwise could be easily abused to degrade users' experience. The [minimum fee per transaction](https://github.com/mobilecoinfoundation/mobilecoin/blob/acd72e66832c1aa18dc630bcab610c11978af0dd/transaction/core/src/constants.rs) is 0.0004 MOB, and is always distributed to the following [address](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/consensus/enclave/impl/build.rs) (written in hexadecimal format):

Transaction Fees


<img src="https://mobilecoinwp.wpengine.com/wp-content/uploads/2021/08/smoke-header.png" width="400">

MobileCoin has a significantly smaller impact on our planet and uses far less energy compared to other cryptocurrencies. Here is why:

-   The driver of energy usage in major cryptocurrencies is the consensus mechanism known as "Proof of Work." On a computer, "Work" equates to CPU cycles, which cost energy, and "[Proof of Work](https://bitcoin.org/bitcoin.pdf)" incentivizes miners (people who volunteer their computers to spin through enormous numbers of those cycles), to verify transactions.
-   Estimates put Bitcoin power usage at 128,000,000,000 kWh per year*, which is similar to the entire energy consumption of the country of Argentina**. In comparison, you could power all of MobileCoin with the same energy to power a few households.
-   MobileCoin uses a network consensus model known as Federated Byzantine Agreement (FBA). Unlike mining (which uses Proof of Work), the energy to consense on MobileCoin transactions is nearly zero.

Alexander Rose, Executive Director of [The Long Now](http://longnow.org/), reflects on sustainability:

> "The inherent problem with previous cryptographic systems that require computers to burn energy doing math means that greed will always be at odds with energy usage, and therefore at odds with earth's climate. We want to make sure there are ways of doing secure and encrypted financial transactions without this level of Proof of Work."

With MobileCoin's blockchain design, we've pioneered a far more sustainable route to building the future of digital payments.

For more details and data on MobileCoin's energy usage, please read the technical explanation below.

. . .

Technical Explanation
---------------------

![](https://miro.medium.com/max/1400/1*pqhWTTuAEdfG5EIgDyBsmQ.png)

From University of Cambridge, Centre for Alternative Finance, https://cbeci.org/

### Background: Consensus Mechanisms

At its core, a cryptocurrency is a collection of transaction events. These are messages that say things like, "I will send 5 MOB to Carol." Users submit these messages to the decentralized network, and if nodes in that network think the messages are legitimate and valid, then the messages will be added to the collection of historical events.

However, decentralized networks don't have centralized arbiters of ultimate truth. Each node (i.e. network participant) is inclined to accept valid messages as they appear. If two legitimate messages are submitted to different nodes at the same time, but those messages contradict each other, then those nodes will be in conflict if they immediately accept the messages they see. For instance, if I only have 5 MOB and write the two messages "I will send 5 MOB to Bob" and "I will send 5 MOB to Carol," there is no way two nodes that obtain the messages can be in agreement.

This is a coordination problem. Nodes in different parts of the network will hear about messages (transactions) at different times. They need to coordinate with each other to prevent accidental disagreements.

Note that cryptocurrencies decide the "order of events" by recording transactions in "blockchains." A blockchain is a series of "blocks," where each block contains a collection of transactions. Blocks are appended to the chain one after the other.

### High Energy Usage in Proof of Work

In the [original proposal](https://bitcoin.org/bitcoin.pdf), Satoshi Nakamoto outlined a network coordination mechanism known as Proof of Work.

When nodes want to make new blocks, they must guess-and-check a difficult computation problem (they compute a hash function over and over until the output meets a difficult criteria). If blocks are produced rapidly, then the "difficulty" of the computation will rise (it will fall if blocks are produced too slowly). This means if a large amount of computational power is used, then the "cumulative difficulty" over successive blocks will also be large (it is easier to solve the computation problem with more computational power).

The blockchain with the highest cumulative difficulty is always assumed to be the "official" chain. Since the network is decentralized, it is still possible for nodes to temporarily create blocks that contradict each other. However, a node will always discard (or "orphan") blocks if it sees a chain with higher cumulative difficulty. Over time, the network is inclined to stay intact as all participants track the mathematically "official" chain.

Why would nodes bother wasting energy on Proof of Work? Simply, they are awarded for creating blocks. So-called "block rewards" are newly minted coins granted to block creators (transaction fees are also added to these rewards).

### Measuring Energy Consumption of Cryptocurrencies

#### Proof of Work

In Proof of Work systems, the energy cost of the network is easily estimated, because at equilibrium the marginal cost of adding/removing hash power is equal to the marginal gain/loss of revenue.

In other words, the amount of energy expended over a time-span in a Proof of Work system is approximately equal to the amount of energy (electricity) that can be purchased by block rewards over that time-span. In other systems, it's not so straightforward.

#### Proof of Stake

In Proof of Stake, a participant puts some amount of their own coins into an escrow wallet while they validate transactions and construct blocks. In each "unit of time" (e.g. 1 second), each stake-holder has a probability of making a new block proportional to the fraction of coins they own relative to the total number of coins that exist. Nodes are incentivized to construct blocks honestly, otherwise their staked coins will become worthless if falsification is discovered (similar to the concept of 'wasting energy' working on useless blocks in the Proof of Work model).

Proof of Stake requires far less energy than Proof of Work, because block construction only relies on the energy required to validate transactions and run the basic consensus mechanism.

Therefore, the energy usage for Proof of Stake networks is lower-bounded by the energy for the participants to sit idle. This [excellent article](https://medium.com/tqtezos/proof-of-work-vs-proof-of-stake-the-ecological-footprint-c58029faee44) on Tezos discusses energy use in their Proof of Stake network.

#### Federated Byzantine Agreement (FBA)

The Federated Byzantine Agreement model is categorically different from Proof of Work and Proof of Stake, where one node somewhere in the network creates each block. Instead, nodes using FBA collaborate to reach agreement on statements before those statements are considered "final" by any node. The [Stellar Consensus Protocol](https://www.stellar.org/papers/stellar-consensus-protocol?locale=en) (SCP) is a sophisticated protocol that implements FBA.

In SCP, many nodes collaborate to decide the contents of each block before the block is created. Doing so enables a faster, more efficient network, because it is not necessary to spend time resolving conflicts between different parts of the network (or waiting for those conflicts to be resolved).

Similar to Proof of Stake, the power consumption of an SCP network is lower-bounded by the energy of the participants to sit idle.

### MobileCoin Power Consumption: Back of the Envelope

In MobileCoin, the FBA participants are located in remote cloud services on Intel SGX-capable machines. If we dive into Microsoft Azure, a cloud provider used by operators on the MobileCoin network, we find they offer Intel SGX in their Confidential Compute platform through the [DC-series](https://docs.microsoft.com/en-us/azure/virtual-machines/dcv2-series).

In [How Can I Calculate CO2eq emissions for my Azure VM?](https://devblogs.microsoft.com/sustainable-software/how-can-i-calculate-co2eq-emissions-for-my-azure-vm/), we get an estimate of around 4.302 kWh for a 24 hour period on a standard machine. If we double this value, to give some breathing room, since we don't have data on a DC-series machine, then we have about 10 kWh per day, which gives us about 3,600 kWh per year, per server.

The current size of the network is around 10 nodes, so we can estimate around 36,000 kWh per year for the network, [which is on the order of a home](https://www.eia.gov/tools/faqs/faq.php?id=97&t=3), with estimates at 10,649 kWh per year per home. Even with many more nodes, the energy consumption of the MobileCoin network will still be on the order of a neighborhood as opposed to a country.

This estimate of the network size does not include "watcher nodes." Watcher nodes listen to validator nodes and record the blocks created by the consensus network (which is composed of validator nodes). Any user of MobileCoin can easily set up and run their own watcher node, so it isn't possible to estimate how many watchers are running now, or will be running in the future. However, it is reasonable to assume that in the long run there will be between 10x and 1000x as many watcher nodes as validator nodes. Watcher nodes should not require more power consumption than validator nodes.

In the long run, the MobileCoin network can be expected to use less energy than that of a small town with e.g. ~5,000 residents, even if MobileCoin becomes a global phenomenon.

. . .

By [Sara Drakeley](https://medium.com/@saradrakeley), [koe](https://medium.com/@koe000), and [Emily Huh](https://medium.com/@emilyhuh)

**University of Cambridge, Centre for Alternative Finance*: <https://cbeci.org/>

** Argentina energy consumption: <https://www.worlddata.info/america/argentina/energy-consumption.php>


Energy Usage

MobileCoin users must agree on the content of the blockchain for it to be useful as a record of accounts. Bad actors
will have a financial motive to misrepresent the ledger to enable fraud and counterfeiting. In distributed computing,
the challenge of reaching agreement in a group that cannot exclude malicious agents from participating is called the
Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement
Problem.

The MobileCoin Consensus Protocol solves the Byzantine Agreement Problem by requiring each user to specify a set of
peers that they trust, called a quorum. Quorums are based on the real-life trust relationships between individuals,
businesses, and other organizations that compose the MobileCoin Network. There is no central authority in the MobileCoin
Network. Users accept statements about the blockchain ledger when their quorum convinces them that these statements are
true. While the algorithmic design of MCP is based on the Stellar Consensus Protocol, the MobileCoin Network is not
interoperable with the Stellar payment network.

The MobileCoin Consensus Protocol avoids the environmentally-damaging mathematical “work” required by Proof-of-Work
(PoW) consensus protocols like Bitcoin and realizes a much higher transaction rate than the Bitcoin consensus protocol.
In contrast to Proof-of-Stake (PoS) consensus protocols, practical control of governance in MCP is ceded to the users
who are trusted the most by the extended MobileCoin community, rather than to the wealthiest users who control the
largest financial stakes.

MCP ensures that all operators agree on the sequence of valid payments that are completed. New transactions are grouped
in blocks and published approximately once every five seconds to the MobileCoin Ledger.

### Show Me the Code

* [Consensus Service](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/service): The implementation of the MobileCoin Consensus Protocol Service
* [SCP](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/scp): MobileCoin's implementation of the Stellar Consensus Protocol


MobileCoin users must agree on the content of the blockchain for it to be useful as a record of accounts. Bad actors
will have a financial motive to misrepresent the ledger to enable fraud and counterfeiting. In distributed computing,
the challenge of reaching agreement in a group that cannot exclude malicious agents from participating is called the
Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement
Problem.

Byzantine Agreement

In order for any payments network to function, it must be able to maintain a history of transactions. MobileCoin Ledger
describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a 
blockchain, in which each block contains transactions that include transaction outputs (txos) that might be spent in 
the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never 
been spent before. The underlying design is based on the privacy-preserving CryptoNote ledger protocol, which obscures 
the identity of all txo owners using one-time recipient addresses. The link between sender and recipient is protected 
through the use of input rings that guard the actually-spent txo in a large set of possibly-spent txos.

The monetary value of each txo is encrypted using the method of Ring Confidential Transactions (RingCT). RingCT is 
implemented using bulletproofs for improved performance. Only the receiver of the transaction can reveal the encrypted
monetary value and spend the new txos that are written to the ledger. The recipient’s cryptographic control over
spending ensures that all transactions in MobileCoin are irreversible, similar to cash transactions in the real world.

Each txo in the input ring of a transaction is annotated with a Merkle proof of inclusion in the MobileCoin Ledger
blockchain. This allows new transactions to be validated with fewer blockchain read operations, improving efficiency
and reducing information leaked to data-access side channels.

Additionally, MobileCoin Ledger dramatically improves on the baseline privacy offered by CryptoNote and RingCT by
requiring that the input rings for every transaction are deleted before the new payment is added to the public ledger.
Digital signatures are added to the ledger in place of the full transaction records to provide a basis for auditing.

### Show Me the Code

* [Ledger Crate](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/ledger): the implementation of the MobileCoin ledger using LMDB as the data store.
* [Transaction Crate](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/transaction/core): Implementation of MobileCoin transactions.

### Tech Talk: Transactions

For a walk through of how the MobileCoin Transaction Protocol works, see [MobileCoin Tech Talk #1: Transactions](https://www.youtube.com/watch?v=e9afDQ_M5CU)


In order for any payments network to function, it must be able to maintain a history of transactions. MobileCoin Ledger
describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a 
blockchain, in which each block contains transactions that include transaction outputs (txos) that might be spent in 
the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never 
been spent before. The underlying design is based on the privacy-preserving CryptoNote ledger protocol, which obscures 
the identity of all txo owners using one-time recipient addresses. The link between sender and recipient is protected 
through the use of input rings that guard the actually-spent txo in a large set of possibly-spent txos.

Transaction Protocol

The MobileCoin Consensus Validator is a vital part of a scalable service infrastructure that enables a smartphone to
manage an encrypted cryptocurrency with locally-stored cryptographic keys. A Consensus Validator node, which
runs Intel’s Software Guard eXtensions (SGX), is one type of node that runs in the MobileCoin ecosystem. The validator
node provides defense-in-depth improvements to encryption and trust.

## Running Your Own Consensus Validator Node

To learn more and run a validator node on the MobileCoin network, please review the runbook: [Consensus Validator Node Runbook](https://mobilecoin.gitbook.io/mobilecoin-consensus-fog/)

The key to operating a Consensus Validator Node is trust. It is your responsibilty to only include operators you _trust_ in your quorum set, and for other operators to only include your validator if they trust you. This is vital for the operation of the MobileCoin network.


The MobileCoin Consensus Validator is a vital part of a scalable service infrastructure that enables a smartphone to
manage an encrypted cryptocurrency with locally-stored cryptographic keys. A Consensus Validator node, which
runs Intel’s Software Guard eXtensions (SGX), is one type of node that runs in the MobileCoin ecosystem. The validator
node provides defense-in-depth improvements to encryption and trust.

Validators

Watcher nodes perform an essential role in the MobileCoin network by verifying the signatures that the full validator nodes attach to each block. In this way the watcher nodes continuously monitor the integrity of the decentralized MobileCoin network.

### Timestamps

Watchers can also be used to sync metadata from multiple Consensus Validator Nodes. For example, the Watcher can be used
in systems that require the timestamp from each node per block.

### Blockchain Explorer

The Watcher provides the backend for the [Blockchain Explorer](https://block-explorer.0--0.net/) (Beta), which serves 
the block signatures, timestamps, TXO data, and key_images per block.

### Show Me the Code

* [Watcher](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/watcher): Implementation of the watcher
* [mobilecoind](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/mobilecoind): Ledger-syncing daemon that can be run in "Watcher Mode"

Basic run command to sync block signatures from two nodes on the test network:

Create a `sources.toml` file, for example:

```source-toml
[[sources]]
tx_source_url = "https://s3-us-west-1.amazonaws.com/mobilecoin.chain/node1.test.mobilecoin.com/"
consensus_client_url = "mc://node1.test.mobilecoin.com/"

[[sources]]
tx_source_url = "https://s3-us-west-1.amazonaws.com/mobilecoin.chain/node2.test.mobilecoin.com/"
consensus_client_url = "mc://node2.test.mobilecoin.com/"
```

```source-shell
SGX_MODE=HW IAS_MODE=PROD MC_LOG=debug,hyper=error,want=error,reqwest=error,mio=error,rustls=error\
    cargo run -p mc-watcher --bin mc-watcher --\
    --sources-path sources.toml\
    --watcher-db /tmp/watcher-db
```

The watcher can also be incorporated into other programs, as in [`mobilecoind`](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/mobilecoind/README.md), where the watcher continuously syncs block signatures, and `mobilecoind` offers an interface to query block signatures for watched nodes through the mobilecoind API.

In order to check that the watcher is running, you can send a gRPC request to the health check endpoint:

```source-shell
grpcurl -proto ./util/grpc/proto/health_api.proto -plaintext localhost:3226 grpc.health.v1.Health/Check
```


Watcher nodes perform an essential role in the MobileCoin network by verifying the signatures that the full validator nodes attach to each block. In this way the watcher nodes continuously monitor the integrity of the decentralized MobileCoin network.

Watchers

Network

# Cryptocurrency designed to be used.

MobileCoin is an effort to develop a fast, private, and easy-to-use cryptocurrency that can be deployed in resource constrained environments to users who aren’t equipped to reliably maintain secret keys over a long period of time, all without giving up control of funds to a payment processing service. 

In the MobileCoin whitepaper, the project’s creators describe its mission: “MobileCoin is designed so that a mobile messaging application like Signal can integrate with a MobileCoin wallet,” the team described in its whitepaper.

# [Download the Whitepaper](https://mobilecoin.foundation/pdf/MobileCoin_White_Paper.pdf)

[widget type='pdfViewer' pdf='//mobilecoin.foundation/pdf/MobileCoin_White_Paper.pdf']



MobileCoin is an effort to develop a fast, private, and easy-to-use cryptocurrency that can be deployed in resource constrained environments to users who aren’t equipped to reliably maintain secret keys over a long period of time, all without giving up control of funds to a payment processing service.

MobileCoin's Mission

One of the most comprehensive conceptual and documents about MobileCoin is the [Mechanics of MobileCoin](https://raw.githubusercontent.com/UkoeHB/Mechanics-of-MobileCoin/master/Mechanics-of-MobileCoin-v0-0-39-preview-10-11.pdf). 
This document was written by [Koe](https://github.com/UkoeHB) to describe every aspect of the protocol and network from the ground up.


# [Download Whitepaper](https://raw.githubusercontent.com/UkoeHB/Mechanics-of-MobileCoin/master/Mechanics-of-MobileCoin-v0-0-39-preview-10-11.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/UkoeHB/Mechanics-of-MobileCoin/master/Mechanics-of-MobileCoin-v0-0-39-preview-10-11.pdf']



One of the most comprehensive conceptual and documents about MobileCoin is the [Mechanics of MobileCoin](https://raw.githubusercontent.com/UkoeHB/Mechanics-of-MobileCoin/master/Mechanics-of-MobileCoin-v0-0-39-preview-10-11.pdf). 
This document was written by [Koe](https://github.com/UkoeHB) to describe every aspect of the protocol and network from the ground up.

Mechanics of MobileCoin

## Securing Payments at Scale
This article covers our security strategy for building a safe and secure digital currency. We will discuss why decentralization is important, how Bitcoin offers digital gold, and why digital gold is not the digital cash needed for payments. Next, we'll discuss what CryptoNote offers for distributed ledgers, how the MobileCoin ledger further protects users, and how remote attestation can help prove that servers you don't control are running the right software. 

# [Download the Whitepaper](https://github.com/mobilecoinofficial/developer-portal/blob/main/info/defense-in-depth.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/defense-in-depth.pdf']



 Securing Payments at Scale
This article covers our security strategy for building a safe and secure digital currency. We will discuss why decentralization is important, how Bitcoin offers digital gold, and why digital gold is not the digital cash needed for payments. Next, we'll discuss what CryptoNote offers for distributed ledgers, how the MobileCoin ledger further protects users, and how remote attestation can help prove that servers you don't control are running the right software.

Defense in Depth

# Bitcoin: A Peer-to-Peer Electronic Cash System

Satoshi Nakamoto's original Bitcoin paper is recommended reading for anyone learning how MobileCoin works. With the introduction of the bitcoin whitepaper by Satoshi Nakamoto in 2009, the world got its first taste of an peer-to-peer electronic payment system with decentralized governance. Satoshi’s vision for Bitcoin was “an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.”  

[widget type='pdfViewer' pdf='//github.com/mobilecoinofficial/developer-portal/raw/main/info/bitcoin.pdf']

Choose which translation of the paper you want to read:
-   **[English (Original)](https://bitcoin.org/bitcoin.pdf)**
-   [Հայերեն](https://bitcoin.org/files/bitcoin-paper/bitcoin_am.pdf)
-   [Bahasa Indonesia](https://bitcoin.org/files/bitcoin-paper/bitcoin_id.pdf)
-   [Català](https://bitcoin.org/files/bitcoin-paper/bitcoin_ca.pdf)
-   [Czech](https://bitcoin.org/files/bitcoin-paper/bitcoin_cz.pdf)
-   [Deutsch](https://bitcoin.org/files/bitcoin-paper/bitcoin_de.pdf)
-   [Español (España)](https://bitcoin.org/files/bitcoin-paper/bitcoin_es.pdf)
-   [Español (Latinoamericano)](https://bitcoin.org/files/bitcoin-paper/bitcoin_es_latam.pdf)
-   [Français](https://bitcoin.org/files/bitcoin-paper/bitcoin_fr.pdf)
-   [Italiano](https://bitcoin.org/files/bitcoin-paper/bitcoin_it.pdf)
-   [Lietuvių Kalba](https://bitcoin.org/files/bitcoin-paper/bitcoin_lt.pdf)
-   [Magyar Nyelv](https://bitcoin.org/files/bitcoin-paper/bitcoin_hu.pdf)
-   [Nederlands](https://bitcoin.org/files/bitcoin-paper/bitcoin_nl.pdf)
-   [Norsk (Bokmål)](https://bitcoin.org/files/bitcoin-paper/bitcoin_no.pdf)
-   [Polski](https://bitcoin.org/files/bitcoin-paper/bitcoin_pl.pdf)
-   [Português](https://bitcoin.org/files/bitcoin-paper/bitcoin_pt.pdf)
-   [Português Brasileiro](https://bitcoin.org/files/bitcoin-paper/bitcoin_pt_br.pdf)
-   [Română](https://bitcoin.org/files/bitcoin-paper/bitcoin_ro.pdf)
-   [Slovenščina](https://bitcoin.org/files/bitcoin-paper/bitcoin_sk.pdf)
-   [српски](https://bitcoin.org/files/bitcoin-paper/bitcoin_sr.pdf)
-   [Suomen kieli](https://bitcoin.org/files/bitcoin-paper/bitcoin_fi.pdf)
-   [Svenska](https://bitcoin.org/files/bitcoin-paper/bitcoin_se.pdf)
-   [Türkçe](https://bitcoin.org/files/bitcoin-paper/bitcoin_tr.pdf)
-   [ελληνικά](https://bitcoin.org/files/bitcoin-paper/bitcoin_gr.pdf)
-   [मानक हिन्दी](https://bitcoin.org/files/bitcoin-paper/bitcoin_hi.pdf)
-   [Русский](https://bitcoin.org/files/bitcoin-paper/bitcoin_ru.pdf)
-   [Tiếng Việt](https://bitcoin.org/files/bitcoin-paper/bitcoin_vi.pdf)
-   [Yкраїнська](https://bitcoin.org/files/bitcoin-paper/bitcoin_uk.pdf)
-   [한국어](https://bitcoin.org/files/bitcoin-paper/bitcoin_ko.pdf)
-   [日本語](https://bitcoin.org/files/bitcoin-paper/bitcoin_jp.pdf)
-   [ภาษาไทย](https://bitcoin.org/files/bitcoin-paper/bitcoin_th.pdf)
-   [简化字](https://bitcoin.org/files/bitcoin-paper/bitcoin_zh_cn.pdf)
-   [বাংলা](https://bitcoin.org/files/bitcoin-paper/bitcoin_bn.pdf)
-   [Estonian](https://bitcoin.org/files/bitcoin-paper/bitcoin_et.pdf)
-   [Albanian](https://bitcoin.org/files/bitcoin-paper/bitcoin_al.pdf)
-   [Croatian](https://bitcoin.org/files/bitcoin-paper/bitcoin_hr.pdf)
-   [Braille](https://bitcoin.org/files/bitcoin-paper/bitcoin-braille.pdf)
-   [Nepali](https://bitcoin.org/files/bitcoin-paper/bitcoin_np.pdf)
-   [Basque](https://bitcoin.org/files/bitcoin-paper/bitcoin_basque.pdf)



Satoshi Nakamoto's original Bitcoin paper is recommended reading for anyone learning how MobileCoin works. With the introduction of the bitcoin whitepaper by Satoshi Nakamoto in 2009, the world got its first taste of an peer-to-peer electronic payment system with decentralized governance. Satoshi’s vision for Bitcoin was “an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.”

Bitcoin

In 2012, Nicolas van Saberhagen, an unknown anonymous author, published the CryptoNote whitepaper describing a new distributed ledger protocol called CryptoNote. At its core, CryptoNote is an attempt to improve on the design of Bitcoin to create an encrypted ledger.

CryptoNote introduced two innovations: ring signatures and one-time addresses. Ring signatures make it harder to statistically analyze the network by changing the direct links between buyers and sellers used in Bitcoin into probabilistic links between sets of possible buyers and sellers. Every transaction has a set of possible ancestors which makes tracking payments in the public ledger much more difficult. Cryptonote’s one-time addresses allow payments to be received using numerical aliases that are indistinguishable from random numbers for everyone except the intended recipient. Essentially, every transaction in Bitcoin publicly shares the recipient’s pseudonymous address, while CryptoNote ledgers publish the recipient’s address in an encrypted format that protects user data.

# [Download the Whitepaper](https://github.com/mobilecoinofficial/developer-portal/blob/main/info/cryptonote.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/cryptonote.pdf']


In 2012, Nicolas van Saberhagen, an unknown anonymous author, published the CryptoNote whitepaper describing a new distributed ledger protocol called CryptoNote. At its core, CryptoNote is an attempt to improve on the design of Bitcoin to create an encrypted ledger.

CryptoNote


CryptoNote ledgers are significantly more secure than Bitcoin, but they still leave the amount of each transaction in plain sight. One potential solution was published in 2016 by Shen Noether, called Ring Confidential Transactions (RingCT). RingCT protects the amount exchanged in each transaction using cryptography. Rather than publish the value that is exchanged, RingCT transactions include a mathematical proof that the transaction is balanced, meaning that the recipient didn’t receive more money than the sender spent. This originally required a computationally intensive proof, but a more efficient algorithmic approach called Bulletproofs was introduced by Bünz et al. in 2017 that has greatly improved performance. It is now possible to use transactions with protected amounts without reducing the throughput of the payments network.

# [Download the Whitepaper](https://raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/ringct.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/ringct.pdf']


CryptoNote ledgers are significantly more secure than Bitcoin, but they still leave the amount of each transaction in plain sight. One potential solution was published in 2016 by Shen Noether, called Ring Confidential Transactions (RingCT). RingCT protects the amount exchanged in each transaction using cryptography. Rather than publish the value that is exchanged, RingCT transactions include a mathematical proof that the transaction is balanced, meaning that the recipient didn’t receive more money than the sender spent. This originally required a computationally intensive proof, but a more efficient algorithmic approach called Bulletproofs was introduced by Bünz et al. in 2017 that has greatly improved performance. It is now possible to use transactions with protected amounts without reducing the throughput of the payments network.

Ring Confidential Transactions

# Bitter to Better — How to Make Bitcoin a Better Currency

The first peer-reviewed article about Bitcoin written by Simon Barber and the team at the University of California, Berkeley, is a great reflection on how Bitcoin was successful, but lacks the anonymity required for digital cash. They perform an in-depth investigation to understand what made Bitcoin so successful, analyze the biggest problems issues of Bitcoin, and propose suitable techniques to make Bitcoin better.

# [Download the Whitepaper](https://github.com/mobilecoinofficial/developer-portal/blob/main/info/bittertobetter.pdf)

[widget type='pdfViewer' pdf='//raw.githubusercontent.com/mobilecoinofficial/developer-portal/master/info/bittertobetter.pdf']


The first peer-reviewed article about Bitcoin written by Simon Barber and the team at the University of California, Berkeley, is a great reflection on how Bitcoin was successful, but lacks the anonymity required for digital cash. They perform an in-depth investigation to understand what made Bitcoin so successful, analyze the biggest problems issues of Bitcoin, and propose suitable techniques to make Bitcoin better.

Make Bitcoin Better

Read the Whitepapers

MobileCoin's defense-in-depth for protecting user data starts by establishing a very high baseline using established technologies like ring signatures, one-time addresses, and RingCT. On top of this foundation we've added secure enclaves and careful information management to securely delete the last traces of identifying information left behind by Cryptonote in our redacted public ledger. Node operators or malicious attackers who compromise a node can't access user keys or user data.

MobileCoin's software is composed of 7 defensive layers, each providing increased security:
- Layer 1: Open-Source
- Layer 2: Decentralized Governance
- Layer 3: CryptoNote
- Layer 4: Confidential Transactions
- Layer 5: MobileCoin Ledger
- Layer 6: MobileCoin Consensus Protocol
- Layer 7: Secure Enclaves and Remote Attestation


MobileCoin's defense-in-depth for protecting user data starts by establishing a very high baseline using established technologies like ring signatures, one-time addresses, and RingCT. On top of this foundation we've added secure enclaves and careful information management to securely delete the last traces of identifying information left behind by Cryptonote in our redacted public ledger. Node operators or malicious attackers who compromise a node can't access user keys or user data.

Open-source technology is publicly auditable. To build trusted systems, we must start with making our code public. In doing so, we support the community in verifying that the intention of our design matches our implementation. We can build secure software in a world where anyone can audit our technology, which is why we are committed to keeping our payments protocol open-source, now and forever.

MobileCoin is a security-focused cryptocurrency [launched](https://mobilecoinfoundation.medium.com/mobilecoin-main-net-8e355d82c726) on December 7th, 2020. Its initial [code base](https://github.com/mobilecoinfoundation/mobilecoin) was developed by MobileCoin Inc. and published by the [MobileCoin Foundation](https://mobilecoin.foundation/) with an open-source license (GPLv3).

There are two GitHubs for Mobilecoin:
- [MobileCoin Foundation GitHub](https://github.com/mobilecoinfoundation/) - this GitHub contains all the code relevant to the blockchain, consensus, and fog projects. It is managed by the Foundation and follows the improvement proposal process.
- [MobileCoin Official GitHub](https://github.com/mobilecoinofficial/) - this GitHub contains all the wallets, bots, and integrations. It is managed by the core-dev team and 

All of our audits are made publicly accessible after careful review:
- [MobileCoin Audit](https://github.com/trailofbits/publications/blob/master/reviews/Mobilecoin.pdf)
- [BFT Audit](https://github.com/trailofbits/publications/blob/master/reviews/MobileCoinBFT.pdf)
- [Fog Audit](https://github.com/trailofbits/publications/blob/master/reviews/MobilecoinFog.pdf)


Open-source technology is publicly auditable. To build trusted systems, we must start with making our code public. In doing so, we support the community in verifying that the intention of our design matches our implementation. We can build secure software in a world where anyone can audit our technology, which is why we are committed to keeping our payments protocol open-source, now and forever.

Open-Source Code

Commerce on the Internet has come to rely almost exclusively on centralized financial institutions serving as trusted third parties to process electronic payments. Centralized payment networks are convenient, but they offer few data protection guarantees, meaning that users are exposed to security risks and abuse by intermediaries. 

With the introduction of the bitcoin whitepaper by Satoshi Nakamoto in 2009, the world got its first taste of an peer-to-peer electronic payment system with decentralized governance. Satoshi’s vision for Bitcoin was “an electronic payment system based on cryptographic proof instead of trust, allowing any two willing parties to transact directly with each other without the need for a trusted third party.”  

The MobileCoin Foundation coordinates and encourages a global community of developers working together to co-create the simplest possible encrypted payments network. The MobileCoin Foundation maintains the reference implementation of MobileCoin's (the cryptocurrency's) protocol, along with the 'service-layer' technology known as [Fog](https://github.com/mobilecoinfoundation/fog) that facilitates efficient use of MobileCoin in resource-constrained environments like mobile devices, without loss of privacy.

MobileCoin's blockchain is a distributed system, and no individual or organization has control over the entire network, including the MobileCoin Foundation. Validator node operators and core developers also have an important influence on the blockchain. 

**"Validators"** are the owners and operators of validator nodes that run the Mobilecoin blockchain. Transactions on the network are confirmed by consensus by nodes known as validators. The validator nodes in the network must be running compatible versions of software. Node operators rely on software developers (usually hosted on Github) to provide them with the software they choose to run.

**"Core Developers"** of the MobileCoin blockchain work on the software that implement that protocol. Developers have processes that are supposed to assure the quality of the software they release, and submit changes to the software through the MobileCoin Improvement Proposals. Changes to the software proposed by a developer must be approved by the MobileCoin Foundation's Technical Committee.


Commerce on the Internet has come to rely almost exclusively on centralized financial institutions serving as trusted third parties to process electronic payments. Centralized payment networks are convenient, but they offer few data protection guarantees, meaning that users are exposed to security risks and abuse by intermediaries.

Decentralized Governance

In order for any payments network to function, it must be able to maintain a history of transactions. The MobileCoin Ledger
describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a 
blockchain, in which each block contains transactions that include transaction outputs (txos) that might be spent in 
the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never 
been spent before. 

The underlying design is based on the privacy-preserving CryptoNote ledger protocol, which obscures 
the identity of all txo owners using one-time recipient addresses. In 2012, Nicolas van Saberhagen, an unknown anonymous author, published the CryptoNote whitepaper describing a new distributed ledger protocol called CryptoNote. At its core, CryptoNote is an attempt to improve on the design of Bitcoin to create an encrypted ledger.

CryptoNote introduced two innovations: ring signatures and one-time addresses. 

The link between sender and recipient is protected through the use of input rings that guard the actually-spent txo in a large set of possibly-spent txos. Ring signatures make it harder to statistically analyze the network by changing the direct links between buyers and sellers used in Bitcoin into probabilistic links between sets of possible buyers and sellers. Every transaction has a set of possible ancestors which makes tracking payments in the public ledger much more difficult. 

CryptoNote's one-time addresses allow payments to be received using numerical aliases that are indistinguishable from random numbers for everyone except the intended recipient. Essentially, every transaction in Bitcoin publicly shares the recipient's pseudonymous address, while CryptoNote ledgers publish the recipient's address in an encrypted format that protects user data.


### Show Me the Code

* [Ledger Crate](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/ledger): the implementation of the MobileCoin ledger using LMDB as the data store.
* [Transaction Crate](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/transaction/core): Implementation of MobileCoin transactions.

### Tech Talk: Transactions

For a walk through of how the MobileCoin Transaction Protocol works, see [MobileCoin Tech Talk #1: Transactions](https://www.youtube.com/watch?v=e9afDQ_M5CU)


In order for any payments network to function, it must be able to maintain a history of transactions. The MobileCoin Ledger
describes how the MobileCoin Network stores payment records in a public ledger. The ledger is implemented as a 
blockchain, in which each block contains transactions that include transaction outputs (txos) that might be spent in 
the future by their owners. Each transaction also includes a proof that all value spent in the transaction has never 
been spent before.

CryptoNote ledgers are significantly more secure than Bitcoin, but they still leave the amount of each transaction in plain sight. 

On the MobileCoin ledger, the monetary value of each txo is encrypted using the method of Ring Confidential Transactions (RingCT). Only the receiver of the transaction can reveal the encrypted monetary value and spend the new txos that are written to the ledger. The recipient’s cryptographic control over spending ensures that all transactions in MobileCoin are irreversible, similar to cash transactions in the real world.

The Ring Confidential Transactions (RingCT) was published in 2016 by Shen Noether. RingCT protects the amount exchanged in each transaction using cryptography. Rather than publish the value that is exchanged, RingCT transactions include a mathematical proof that the transaction is balanced, meaning that the recipient didn't receive more money than the sender spent. However, this originally required a computationally intensive proof.

RingCT is implemented using bulletproofs for improved performance. Bulletproofs is an efficient (fast) algorithmic approach introduced by Bünz in 2017 that has greatly improved performance. It is now possible to use transactions with protected amounts without reducing the throughput of the payments network. 

Mobilecoin uses the[Dalek](https://github.com/dalek-cryptography/bulletproofs) library which is the fastest [Bulletproofs][bp_website] implementation ever, featuring single and aggregated range proofs, strongly-typed multiparty computation, and a programmable constraint system API for proving arbitrary statements (under development). The Dalek library implements Bulletproofs using [Ristretto][ristretto], using the `ristretto255` implementation in
[`curve25519-dalek`][curve25519_dalek]. 

Please see [this document](https://github.com/mobilecoinfoundation/bulletproofs/blob/main/README.md) for more details.


The fastest Bulletproofs implementation ever, featuring single and aggregated range proofs, strongly-typed multiparty computation, and a programmable constraint system API for proving arbitrary statements (under development).

Confidential Transactions

MobileCoin Ledger takes transactions built with CryptoNote signatures and RingCT and adds two new improvements: membership proofs for transaction inputs and redacted transaction records. 

When a transaction is prepared by a user, it contains a ring signature with a double-spend proof. What’s a double-spend proof? One of the many ground-breaking elements of Satoshi’s Bitcoin electronic payment system was that it solved the long-standing “double-spend” problem that plagued cashless spending. Through the implementation of time-stamped transactions that are unanimously verified by a distributed network of validators, it was no longer possible for a person to spend the same funds twice. 

In addition to the double-spend proof, the MobileCoin Ledger’s ring signature also contains the proofs-of-membership for transaction inputs. Membership proofs allow the transaction to be validated without requiring disk access to the corresponding entries in the ledger. This closes a potential access-pattern side channel that could allow a malicious actor to observe the particular set of inputs used to construct the transaction. When a valid transaction is ready to be published in the MobileCoin ledger, the membership proofs are deleted and only the double-spend proof and the new transaction output are added to the public record. These "redacted transactions" make it difficult to link and deanonymize users through analysis of the public blockchain.

Redacted transactions also necessarily imply that the public blockchain entries do not contain enough information for the complete transaction history to be revalidated in an audit. Our solution is to provide two separate mechanisms for audit support. All blocks are signed as they are published by the code that performs the validation and redaction for publication.


MobileCoin Ledger takes transactions built with CryptoNote signatures and RingCT and adds two new improvements: membership proofs for transaction inputs and redacted transaction records.

MobileCoin Ledger

In distributed computing, the challenge of reaching agreement in a group that cannot exclude malicious agents from participating is called the Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement
Problem.

All cryptocurrencies rely on a distributed network of equivalent nodes to cooperatively agree on the validity and ordering of transactions. MobileCoin has developed a high-performance, byzantine fault tolerant protocol for distributed agreement called the MobileCoin Consensus Protocol (MCP), based on the "federated byzantine agreement" described by David Mazieres. 

The redacted transactions that are written to the public MobileCoin hide the links between buyers and sellers that are used in CryptoNote, but the complete transactions still need to be validated and checked for attempted double spending and counterfeiting.

Rather than agreeing on sets of transactions, validator nodes agree on the cryptographic hash of encrypted sets of transactions. This allows the consensus algorithm to operate independently of the MobileCoin Ledger protocol validation code so that the potential attack surface is minimized.

The MobileCoin Consensus Protocol solves the Byzantine Agreement Problem by requiring each validator node to specify a set of peers that they trust, called a quorum. Quorums are based on the real-life trust relationships between individuals,
businesses, and other organizations that compose the MobileCoin Network.  Each node operator independently controls their own quorom configuration of trusted set of peers. Sensitive data, even in an encrypted form, is never shared beyond the web of trust defined by these quorums.

There is no central authority in the MobileCoin Network. Users accept statements about the blockchain ledger when their quorum convinces them that these statements are true. While the algorithmic design of MCP is based on the Stellar Consensus Protocol, the MobileCoin Network is not
interoperable with the Stellar payment network.

The MobileCoin Consensus Protocol avoids the environmentally-damaging mathematical “work” required by Proof-of-Work (PoW) consensus protocols like Bitcoin and realizes a much higher transaction rate than the Bitcoin consensus protocol.
In contrast to Proof-of-Stake (PoS) consensus protocols, practical control of governance in MCP is ceded to the users who are trusted the most by the extended MobileCoin community, rather than to the wealthiest users who control the
largest financial stakes.

MCP ensures that all operators agree on the sequence of valid payments that are completed. New transactions are grouped
in blocks and published approximately once every five seconds to the MobileCoin Ledger.

### Show Me the Code

* [Consensus Service](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/service): The implementation of the MobileCoin Consensus Protocol Service
* [SCP](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/scp): MobileCoin's implementation of the Stellar Consensus Protocol


In distributed computing, the challenge of reaching agreement in a group that cannot exclude malicious agents from participating is called the Byzantine Agreement Problem. All cryptocurrency payment networks must include code that solves the Byzantine Agreement
Problem.

At least some of the code running on the nodes that participate in consensus protocol must be able to view the complete transactions. However, the operators of these nodes don't need to see this data themselves. MobileCoin confines the sensitive transaction data and all of the code that operates on it in a "secure enclave", bringing the latest advancements in confidential computing to cryptocurrency. Secure Enclaves are a region of memory which provide encrypted code execution. 

A secure enclave provides strong guarantees about the confidentiality and integrity of the software actions being performed inside. Using a secure enclave, we can conceal the complete transactions even from the operators of the nodes that participate in the MobileCoin consensus protocol.

MobileCoin implements secure enclaves using Intel's Software Guard eXtensions (SGX) technology. To understand how SGX improves the confidentiality of user data on-chain, please see our Tech Talk: [Why we use SGX for MobileCoin](https://www.youtube.com/watch?v=Hwf_Q31woLo).


At least some of the code running on the nodes that participate in consensus protocol must be able to view the complete transactions. However, the operators of these nodes don't need to see this data themselves. MobileCoin confines the sensitive transaction data and all of the code that operates on it in a "secure enclave", bringing the latest advancements in confidential computing to cryptocurrency. Secure Enclaves are a region of memory which provide encrypted code execution.

Secure Enclaves

In addition to secure enclaves, Intel SGX is used by MobileCoin as a "remote attestation" system that can be used to prove that code that claims to be running in a secure enclave is running in a secure enclave. This also proves the code is run on real hardware rather than a simulator.  Put simply, remote attestation gives us more confidence that a remote computer is running the right software, right now. This makes it much harder for operators to cheat in our system, and basically impossible for an operator to deny responsibility if they are ever caught cheating.

Consensus Validator Nodes in the MobileCoin network must use a Intel SGX secure enclave to validate transactions and produce each next block in the  ledger. When each Consensus Validator Node starts up, it initiates an attested connection with its peers. If they  are not running the exact same enclave code, the Enclave Measurements will not match, and the connection will be refused. Similarly, when clients submit a transaction to the network, they ask for the Attestation Evidence from the 
Consensus Validators, and only proceed with an attested connection if the Measurements are what they expect.

In short, the MobileCoin network becomes a network of blind oracles who simply agree on a set of encrypted strings. No information about who is transacting with whom, or for how much is revealed, even to the operators of the nodes that validate the transactions.

To understand how SGX improves the integrity of MobileCoin's Federated Byzantine Agreement Consensus Protocol, please see our Tech Talk: [Why we use SGX for MobileCoin](https://www.youtube.com/watch?v=Hwf_Q31woLo).

### Show Me the Code

* [Attestation](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/attest/core): MobileCoin's attestation implementation
* [SGX](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/sgx): A lightweight `no_std` Rust environment for use inside an SGX enclave.
* [Consensus Enclave](https://github.com/mobilecoinfoundation/mobilecoin/tree/master/consensus/enclave): MobileCoin's Consensus Enclave implementation and API


In addition to secure enclaves, Intel SGX is used by MobileCoin as a "remote attestation" system that can be used to prove that code that claims to be running in a secure enclave is running in a secure enclave. This also proves the code is run on real hardware rather than a simulator.  Put simply, remote attestation gives us more confidence that a remote computer is running the right software, right now. This makes it much harder for operators to cheat in our system, and basically impossible for an operator to deny responsibility if they are ever caught cheating.

Remote Attestation


Oblivious RAM is a class of data structures designed to avoid information leaks over memory access pattern side-channels, introduced in [Goldreich '96].

Tree-based ORAM was introduced in a seminal paper [Shi, Chan, Stefanov, Li '11]. Tree-based ORAM algorithms arrange their data in a complete balanced binary tree, and are the first and only class of algorithms to have good (poly-log) worst-case performance.

The first oblivious RAM algorithm that attracted significant interest from practicioners was Path ORAM [Shi, Stefanov, Li '13]. Circuit ORAM appeared in [Wang, Chan, Shi '16].

ORAM can in principle be used in several ways, and many papers in ORAM consider several of the application modes:

* A user can use it to interact with (untrusted) cloud storage and make use of storage without leaking access patterns.
* It can be implemented in hardware in the "secure processor" setting, such that the "ORAM controller / client" is implemented in silicon, and the main memory corresponds to the "server".
* It can be implemented in software in a "secure enclave", such that the "ORAM controller / client" is the enclave, and the main memory corresponds to the "server".
* It can be implemented in a compiler pass that transforms arbitrary code into code that leaks nothing via its memory access patterns, but runs more slowly.

In MobileCoin Fog, we are focused on the SGX-based approach, which was first described in the ZeroTrace paper [Sasy, Gorbunuv, Fletcher '17].

### What is Oblivious/Constant Time?

A great exposition from Intel appears in [Guidelines for Mitigating Timing Side Channels Against Cryptographic Implementations](https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/secure-coding/mitigate-timing-side-channel-crypto-implementation.html).

> Most traditional side channels—regardless of technique—can be mitigated by applying all three of the following general "constant time"[2] principles, listed here at a high level. We discuss details and examples of these principles later.
> 
> * Ensure runtime is independent of secret values.
> * Ensure code access patterns[3] are independent of secret values.
> * Ensure data access patterns[4] are independent of secret values.
> 
> [2] Use of the term “constant time” is a legacy term that is ingrained in literature and used here for consistency. In modern processors, the time to execute a given set of instructions may vary depending on many factors. The key is to ensure that none of these factors are related to the manipulation of secret data values. Modern algorithm research uses the more inclusive term "data oblivious algorithm." [3] A program's code access pattern is the order and address of instructions that it executes. [4] A program's data access pattern is the order and address of memory operands that it loads and stores.

These crates provide functions and data structures that have the "data-oblivious" property.

A function is completely constant-time / data-oblivious if for any two sets of arguments you might pass it, the code and data access patterns are:

the same, or
identically distributed, or
distributed according to distributions that are computationally indistinguishable.
For example, the implementations of the CMov trait in the aligned-cmov crate are completely constant-time, because the code and data access patterns are exactly the same no matter what the inputs are.

The implementation of access in PathORAM is completely constant-time, because the code and data access patterns are identically distributed regardless of what memory position is accessed.

In some more complex cases, a function may be oblivious with respect to some of its inputs, but not all of them. We follow the convention that those functions are labelled with vartime in their name, and explain to what extent if any they are oblivious in documentation. Sometimes such functions are completely oblivious with respect to some of the arguments but not all of them. Examples include vartime_write in the ObliviousMap trait.

In some cases, it is obvious that the function will not be oblivious. For example the ORAM and ObliviousMap creator functions take a capacity as an argument. Increasing the capacity will require using more memory, so we are not oblivious with respect to that parameter. We nevertheless don't call the function vartime_create.

As another example, the access function in PathORAM implementation takes a closure to which the accessed data is passed. This closure includes a function pointer -- if two different closures are passed, the code access patterns will be different. Additionally, if the code in the closure is not itself constant-time with respect to the query then we won't be constant-time. We don't bother documenting this since it should be clear to the user of the API.

### Show Me the Code

* [mc-oblivious](https://github.com/mobilecoinofficial/mc-oblivious): MobileCoin implementation of Oblivious RAM inside Intel SGX enclaves


Oblivious RAM is a class of data structures designed to avoid information leaks over memory access pattern side-channels, introduced in [Goldreich '96].

Oblivious RAM


MobileCoin Fog is a suite of services that enable use of MobileCoin payments in resource-constrained
environments, particularly, mobile devices. This threat model explains the security invariants of the system
for the following audiences:

* Users of MobileCoin Fog
* Developers integrating the MobileCoin SDK into their wallet software
* Parties interested in running a MobileCoin Fog deployment
* Security researchers and auditors curious about the system, or actively attempting to break the system

We employ the "user-first" approach of [Invariant-Centric Threat Modeling](https://github.com/defuse/ictm) in this document.

Below, we describe the hypothetical adversaries of the system, followed by the security invariants provided by the
system in the face of each adversary. We also identify specific non-goals in order to express the bounds of what the
system specifically cannot do.

# Terms

For the reader's ease, we have chosen simpler terms for some of the elements of MobileCoin. In particular,
in the literature, a transaction produces "transaction outputs," in this document, the term
"payment record" is used instead.  For example, when a transaction is submitted
successfully, (encrypted) "payment records" are added to the blockchain, and these
payment records are returned to the appropriate users privately via Fog.

When discussing information an adversary *may* possess, we use the following terms when discussing
the adversary's level of uncertainty about the information:

* *no information*: An adversary has *no information* about something. For example in the case of who
sent a transaction, if an adversary has total uncertainty about the recipient, it then is equally likely
given all their information for the recipient to have been any of the users.

* *some information*: An adversary has *some information* about who sent a transaction; they have less
than total uncertainty about this. For example, take the claim, "It must have been one of the people who
submitted a transaction to one of several blocks." The number of people on a list like this is typically
less than the total number of users. In this document, we only use the term *some information* when an
adversary has *at most* "block-level granularity" about a piece of data.

# Adversaries

### Baseline Adversary (Oscar)

The "baseline" adversary doesn't have access to Fog, to consensus service machines,
or to users' phones, but can still monitor (but not tamper with) IP-level traffic between all services and
users, and knows the IP address of every user.

### Infrastructure-surveilling Adversary (Eve)

Eve has the capabilities of Oscar, and additionally:

* Can monitor all Fog service machines and one MobileCoin consensus service machine participating in quorum, observing all working memory of these machines as they operate.
* Cannot compromise the confidentiality or integrity of SGX enclaves, nor that of RDRAND, nor the SGX remote attestation process.
* Can monitor the memory access patterns of any running enclave in the system, even if they cannot read the memory.
* Does not have access to the user's phone and cannot run malicious code there.

### Infrastructure-compromising Adversary (Mallory)

Mallory has the capabilities of Eve, and additionally:

* Has root access on Fog service machines and one MobileCoin consensus service machine participating in quorum,
  and can observe and tamper with all working memory and operations of these machines.

### SGX-compromising Adversary with root on Fog Infrastructure (Darth)

Darth has the capabilities of Mallory, and additionally:

* Can compromise either SGX itself, or the SGX remote attestation process.

### SGX-compromising Adversary without root on Fog Infrastructure (Trudy)

Trudy has the capabilities of Oscar, and additionally:

* Has the capability to compromise SGX, but does not have root access on any infrastructure machines.

# Security Invariants

### Baseline Adversary (Oscar)

Oscar cannot:

* Cause arbitrary code to run on the user's device.
* Learn any of the users' private keys.
* Learn any of the users' public addresses.
* Steal the user's funds.
* Make the user send funds without permission.
* Make the user send funds to someone other than who they intended.
* Cause the user's funds to become unavailable for use.
* Cause funds sent to a recipient to disappear from the sender's wallet but be unavailable for use by the recipient.
* Cause a user to associate the wrong public address with another user.
* Learn the amount of any user's transaction.
* Learn any user's balance.

Oscar can:

* See when a user submits a transaction to the consensus node.
* See when the submission is successful or unsuccessful.
* See in which block a particular successful transaction landed, and all of the payment records in that block.
* See when a user checks their balance, and the bandwidth and number of requests during a particular balance check operation.

Thus, Oscar has *some information* about the identity of the sender of any particular payment record.

Fog provides the following invariants protecting the recipient of a payment record from Oscar:

* When a user performs a balance check and retrieves zero or one payment records from Fog, the adversary has *no information* about which of these is the case.
* When a user performs a balance check retrieving more than one payment record, the adversary cannot determine the number of payment records to within a factor of two.
  * For example, if you received 6 payments, it is equally likely from the adversary's point of view that you received 5, 6, 7, or 8 payments, given the data they can see.
  * In particular, if a user reinstalls their wallet and downloads all their historical transactions via Fog, this adversary learns the number of total payment records to within a factor of two.

These are consequences of the design goals of MobileCoin Fog. Fog is designed to support *low-bandwidth*
users on a mobile device; it is designed so that users only download their own transactions, and not the entire
blockchain. This means that an adversary capable of traffic analysis can see when a user downloads many payment
records as opposed to a few. Fog is designed to make it difficult to distinguish when you download zero or one
payment records; even when you download many payment records, it's hard to determine the exact
number of up to a factor of two. However, this adversary does get *some information*.

A user seeking stronger protection guarantees should consider running a desktop wallet, with
the caveat that one must sync the entire blockchain in order to check one's balance.

If a baseline adversary has *some information* about which blocks your payment records came from, then they have
*some information* about the sender, because they have *some information* about who submitted the transaction that
created any particular payment record.

### Infrastructure-surveilling Adversary (Eve)

Eve:

* Eve can see which IP created which payment record. (Oscar only has *some information* about this.)
  (This is the current threat model for MoblieCoin consensus server.)

* Otherwise, Eve obeys the SAME set of invariants as described for Oscar, with the following modifications:
  * Eve can observe the ring elements used to construct a user's outgoing transaction at the time of construction.

(Note: In a future release, we plan to improve the system so that these modifications are not necessary, and Eve
has no additional information beyond the baseline adversary.)

### Infrastructure-compromising Adversary (Mallory)

Mallory cannot:

* Cause arbitrary code to run on the user's device.
* Learn any of the user's private keys.
* Learn any of the user's public addresses.
* Steal the user's funds.
* Make the user send funds without permission.
* Make the user send funds to someone other than who they intended.
* Cause the user's funds to become unavailable for use.
  * Though the user may need to use a desktop wallet to find their funds.
* Cause a user to associate the wrong public address with another user.
* Learn the amount of any transaction.
* Learn any user's balance.
* Steal private keys from any of the enclaves.
* Exercise the fog-ingest, fog-ledger, or fog-view enclaves in any way that reveals additional non-trivial information
  about the amount or recipient of a transaction.
* Infer *anything* about the sender or recipient of a payment, that Eve cannot also infer.

Mallory can:

* Do anything Eve could.
* Cause the Fog service to become unavailable.
* Destroy encrypted payment records in Fog database, making it impossible for a user to successfully perform a balance check via Fog.
* Create fake encrypted payment records, which are not part of the blockchain, which users will download and treat as real, but which can't be used to make successful transactions.
* Cause users to display incorrect balances.
* Cause users to build invalid transactions.
  * Mallory cannot cause the users to submit transactions, but if they submit transactions, they may be invalid if they were built with invalid data.
* Tamper with the Fog reports, causing users not to receive their payment records via Fog.
  * If the sender encrypts for the wrong Fog ingress key, fog-ingest will not pick up the payment record.
  * The recipient would have to slow-scan the ledger instead to find the payment record.
* Cause the users to download large amounts of uninteresting data on their phone.

### SGX-compromising Adversary with root on Fog Infrastructure (Darth)

Darth cannot:

* Cause arbitrary code to run on the user's device.
* Learn any of the user's private keys.
* Steal the user's funds.
* Make the user send funds when they didn't want to.
* Make the user send funds to someone other than who they intended.
* Cause the user's funds to become unavailable for use.
* Cause a user to associate the wrong public address with another user.
* Learn the amount of any user's transaction.
* Learn any user's balance.

Darth can:

* Do anything Mallory could.
* Learn many view-public keys, which appear in the public addresses of Fog users.
* Learn the recipient of any payment record sent to a Fog user:
  * By attacking fog-ingest enclave in one of several ways, or by attacking fog-view enclave.
  * Darth can learn who the sender of a payment record was, just as Mallory can.
* Learn how many and in which blocks a Fog user received payments, if they perform full-wallet recovery
  * By attacking fog-view enclave.

The system has a forward-secrecy property:

* If SGX is patched and Fog enclaves are rebuilt and redeployed, Darth-level adversaries no longer have any additional information,
  and are degraded to the Mallory-level for transactions and interactions that occur after that point. This does not require
  the users to change their private keys, but may require them to update their app in order to trust the new enclave.

### SGX-compromising Adversary without root on Fog infrastructure (Trudy)

Trudy has the same set of invariants as Oscar, even if they have the ability
to conduct DNS-poisoning attacks and cause the user to talk to a malicious Fog report server.

These invariants carry over because of the design of the Fog authority signature chain, which leads
all the way back to the users' public addresses.

If Trudy signs their Fog reports with a different authority key, then the user will fail
to obtain valid Fog reports and be unable to submit transactions, rather than disclose the recipient
of those transactions to the adversary.


MobileCoin Fog is a suite of services that enable use of MobileCoin payments in resource-constrained environments, particularly, mobile devices.

Fog Threat Model

Security

MobileCoin is a security-focused cryptocurrency [launched](https://mobilecoinfoundation.medium.com/mobilecoin-main-net-8e355d82c726) on December 7th, 2020. Its initial [code base](https://github.com/mobilecoinfoundation/mobilecoin) was developed by MobileCoin Inc. and published by the [MobileCoin Foundation](https://mobilecoin.foundation/) with an open-source license (GPLv3).

MobileCoin Inc. was founded in 2017 by Josh Goldbard & Shane Glynn. It is a venture-backed company based in San Francisco, CA. 

The MobileCoin Foundation coordinates and encourages a global community of developers working together to co-create the simplest possible encrypted payments network. The MobileCoin Foundation maintains the reference implementation of MobileCoin's (the cryptocurrency's) protocol, along with the 'service-layer' technology known as [Fog](https://github.com/mobilecoinfoundation/fog) that facilitates efficient use of MobileCoin in resource-constrained environments like mobile devices, without loss of privacy. 

MobileCoin's blockchain is a distributed system, and no individual or organization has control over the entire network, including the MobileCoin Foundation. Validator node operators and core developers also have an important influence on the blockchain. 

Validators are the owners and operators of validator nodes that run the Mobilecoin blockchain. Transactions on the network are confirmed by consensus by nodes known as validators. The validator nodes in the network must be running compatible versions of software. Node operators rely on software developers (usually hosted on Github) to provide them with the software they choose to run.

Core Developers of the MobileCoin blockchain work on the software that implement that protocol. Developers have processes that are supposed to assure the quality of the software they release, and submit changes to the software through the MobileCoin Improvement Proposals. Changes to the software proposed by a developer must be approved by the MobileCoin Foundation's Technical Committee. 

Committees
----------

### Technical Advisory Committee

-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Konstantin Richter (Chair)
-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Sara Drakeley Hall
-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Michael Rodriguez

### Policy Advisory Committee

-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Tony Lai (Chair)
-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Tiffiniy Cheng
-   ![](https://mobilecoin.foundation/wp-content/themes/mobilecoin-foundation/src/img/person_icon.png)Faisal Saeed AlMutar

Foundation Partners
-------------------
[![The Long Now Foundation](https://mobilecoin.foundation/wp-content/uploads/2021/07/The_Long_Now_logo.png)](https://longnow.org/)[![DreamHost](https://mobilecoin.foundation/wp-content/uploads/2021/07/Dreamhost_Logo.png)](https://www.dreamhost.com/)[![BlockDaemon](https://mobilecoin.foundation/wp-content/uploads/2021/07/blockdaemon_logo.png)](https://blockdaemon.com/)[![Ideas Beyond Borders](https://mobilecoin.foundation/wp-content/uploads/2021/07/Ideas_beyond_borders_logo.png)](https://www.ideasbeyondborders.org/)[![Community Arts Stabilization Trust](https://mobilecoin.foundation/wp-content/uploads/2021/07/CAST_logo.png)](https://cast-sf.org/)[![Fight for the Future](https://mobilecoin.foundation/wp-content/uploads/2021/07/FFTF_logo.png)](https://www.fightforthefuture.org/)



MobileCoin is a security-focused cryptocurrency [launched](https://mobilecoinfoundation.medium.com/mobilecoin-main-net-8e355d82c726) on December 7th, 2020. Its initial [code base](https://github.com/mobilecoinfoundation/mobilecoin) was developed by MobileCoin Inc. and published by the [MobileCoin Foundation](https://mobilecoin.foundation/) with an open-source license (GPLv3).

MobileCoin Foundation

MobileCoin is an open source project and has several contributors. The Roadmap is now live and public for all to view. You can view what is Planned, In Progress, and Complete on the main page, and you can submit feature requests through the feedback tool. 
http://mobilecoin.canny.io


Foundation Roadmap

We will reward the community members and developers who find and report bugs. 

1. Please report network issues to the main GitHub for mobilecoin: https://github.com/mobilecoinfoundation/mobilecoin/issues. 
2. Please report mobile app issues to the GitHub for the mobilecoin app: https://github.com/mobilecoinofficial/mobilecoin-app
3. Search both open and closed tickets to make sure your bug report is not a duplicate.
4. To participate in community discussions, please use the community discord server at [https://mobilecoin.chat](https://mobilecoin.chat).


We will reward the community members and developers who find and report bugs.

Bug Bounties

MobileCoin Consensus is built on trust relationships between individuals and organizations who are running MobileCoin Consensus Validator nodes.

Determining which nodes are listed as Foundation Trusted Nodes is challenging -- and involves a criteria selection that includes:

-   Based on the organization's track record and that of its leaders and backers, does it appear that the organization truly has the best interests of the public and protecting privacy at heart?
-   Have any concerns been raised about the organization's behavior as a Trusted Node, and if so, have further discussions satisfactorily resolved these concerns?
-   Is the organization free of any Conflicts of Interest that would undermine its ability to operate as a Trusted Node?

Each Node Operator determines which entities to trust and includes those entities' nodes in their quorum set definition. We hope other node operators will follow suit and choose to share their trusted node lists. Several members of the MobileCoin Foundation are running MobileCoin Consensus Validators in MainNet; these are available for peering. Below is a non-exhaustive list:

* * * * *

##### Organization

Blockdaemon

##### Node Address

mcp://blockdaemon.mobilecoin.bdnodes.net:8443

##### Message Signer Public Key

MCowBQYDK2VwAyEA_wMkv3-3MluopGsqtnZx4rbqzPR2axi7bCiqWWnOq0Q=

##### Ledger Archive Location

https://bd-mobilecoin-ledger.s3.amazonaws.com/blockdaemon.mobilecoin.bdnodes.net/

##### Accepting Consensus and Watcher Peers on Port

8443

##### Accepting Client Transactions on Port

443

* * * * *

##### Organization

The Long Now Foundation

##### Node Address

mcp://thelongnowfoundation.mobilecoin.bdnodes.net:8443

##### Message Signer Public Key

MCowBQYDK2VwAyEAXd4Xyfv0OizkLKB_Jb7HM_KDjd1mMgbF34MStLqd1WY=

##### Ledger Archive Location

https://bd-mobilecoin-ledger.s3.amazonaws.com/thelongnowfoundation.mobilecoin.bdnodes.net/

##### Accepting Consensus and Watcher Peers on Port

--

##### Accepting Client Transactions on Port

--

* * * * *

##### Organization

MobileCoin Worldwide

##### Node Address

mcp://peer1.prod.mobilecoinww.com:443

##### Message Signer Public Key

MCowBQYDK2VwAyEAwxHjdoRQBF9Ozp8lE0wq9pppyP48nKphcQ0GeEb4zYg=

##### Ledger Archive Location

https://ledger.mobilecoinww.com/node1.prod.mobilecoinww.com

##### Accepting Consensus and Watcher Peers on Port

433

##### Accepting Client Transactions on Port

433

* * * * *

##### Organization

MobileCoin Worldwide

##### Node Address

mcp://peer2.prod.mobilecoinww.com:443

##### Message Signer Public Key

MCowBQYDK2VwAyEAMtTj21PtiL-FQW3YbKZXfcfnFztHlVhnbvwvaiWDFuE=

##### Ledger Archive Location

https://ledger.mobilecoinww.com/node2.prod.mobilecoinww.com

##### Accepting Consensus and Watcher Peers on Port

433

##### Accepting Client Transactions on Port

433


MobileCoin Consensus is built on trust relationships between individuals and organizations who are running MobileCoin Consensus Validator nodes.

Trusted Nodes


[MobileCoin Improvement Proposals]: #mcips

Many changes, including bug fixes and documentation improvements can be
implemented and reviewed via the normal GitHub pull request workflow.

Some changes though are "substantial", and we ask that these be put through a
bit of a design process and produce a consensus among the MobileCoin community and
the teams.

The "MCIP" (MobileCoin Improvement Proposal) process is intended to provide a consistent
and controlled path for new features to enter the ecosystem, so that all
stakeholders can be confident about the direction the protocol is evolving in.


## Table of Contents
[Table of Contents]: #table-of-contents

  - [Opening](#mcips)
  - [Table of Contents]
  - [When you need to follow this process]
  - [Team-specific guidelines]
  - [Before creating an MCIP]
  - [What the process is]
  - [The MCIP life-cycle]
  - [Reviewing MCIPs]
  - [Implementing an MCIP]
  - [MCIP Postponement]
  - [Help this is all too informal!]
  - [License]
  - [Contributions]


## When you need to follow this process
[When you need to follow this process]: #when-you-need-to-follow-this-process

You need to follow this process if you intend to make "substantial" changes to the
MobileCoin Foundation codebase, or the MCIP process itself. What constitutes a
"substantial" change is evolving based on community norms and varies depending
on what part of the ecosystem you are proposing to change, but may include the
following.

  - Any semantic or syntactic change to the APIs which are not a bugfix.
  - Removing features.
  - Changes to the interface between the clients and servers.

Some changes do not require an MCIP:

  - Rephrasing, reorganizing, refactoring, or otherwise "changing shape does
    not change meaning".
  - Additions that strictly improve objective, numerical quality criteria
    (warning removal, speedup, better platform coverage, more parallelism, trap
    more errors, etc.)
  - Additions only likely to be _noticed by_ other developers-of-mobilecoin,
    invisible to users-of-mobilecoin.

If you submit a pull request to implement a new feature without going through
the MCIP process, it may be closed with a polite request to submit an MCIP first.


### Team specific guidelines
[Team-specific guidelines]: #team-specific-guidelines

For more details on when an MCIP is required for the following areas, please see
the foundation's team-specific guidelines for:

  - [consensus](consensus.md),
  - [fog](fog.md),


## Before creating an MCIP
[Before creating an MCIP]: #before-creating-an-mcip

A hastily-proposed MCIP can hurt its chances of acceptance. Low quality
proposals, proposals for previously-rejected features, or those that don't fit
into the near-term roadmap, may be quickly rejected, which can be demotivating
for the unprepared contributor. Laying some groundwork ahead of the MCIP can
make the process smoother.

Although there is no single way to prepare for submitting an MCIP, it is
generally a good idea to pursue feedback from other project developers
beforehand, to ascertain that the MCIP may be desirable; having a consistent
impact on the project requires concerted effort toward consensus-building.

As a rule of thumb, receiving encouraging feedback from long-standing project
developers, and particularly members of the relevant team is a good
indication that the MCIP is worth pursuing.


## What the process is
[What the process is]: #what-the-process-is

In short, to get a major feature added to MobileCoin, one must first get the MCIP
merged into the MCIP repository as a markdown file. At that point the MCIP is
"active" and may be implemented with the goal of eventual inclusion into MobileCoin.

  - Fork the MCIP repo [MCIP repository]
  - Copy `0000-template.md` to `text/0000-my-feature.md` (where "my-feature" is
    descriptive). Don't assign an MCIP number yet; This is going to be the PR
    number and we'll rename the file accordingly if the MCIP is accepted.
  - Fill in the MCIP. Put care into the details: MCIPs that do not present
    convincing motivation, demonstrate lack of understanding of the design's
    impact, or are disingenuous about the drawbacks or alternatives tend to
    be poorly-received.
  - Submit a pull request. As a pull request the MCIP will receive design
    feedback from the larger community, and the author should be prepared to
    revise it in response.
  - Now that your MCIP has an open pull request, use the issue number of the PR
    to update your `0000-` prefix to that number.
  - Each pull request will be labeled with the most relevant team, which
    will lead to its being triaged by that team in a future meeting and assigned
    to a member of the team.
  - Build consensus and integrate feedback. MCIPs that have broad support are
    much more likely to make progress than those that don't receive any
    comments. Feel free to reach out to the MCIP assignee in particular to get
    help identifying stakeholders and obstacles.
  - The team will discuss the MCIP pull request, as much as possible in the
    comment thread of the pull request itself. Offline discussion will be
    summarized on the pull request comment thread.
  - MCIPs rarely go through this process unchanged, especially as alternatives
    and drawbacks are shown. You can make edits, big and small, to the MCIP to
    clarify or change the design, but make changes as new commits to the pull
    request, and leave a comment on the pull request explaining your changes.
    Specifically, do not squash or rebase commits after they are visible on the
    pull request.
  - At some point, a member of the team will propose a "motion for final
    comment period" (FCP), along with a *disposition* for the MCIP (merge, close,
    or postpone).
    - This step is taken when enough of the tradeoffs have been discussed that
    the team is in a position to make a decision. That does not require
    consensus amongst all participants in the MCIP thread (which is usually
    impossible). However, the argument supporting the disposition on the MCIP
    needs to have already been clearly articulated, and there should not be a
    strong consensus *against* that position outside of the team. Team
    members use their best judgment in taking this step, and the FCP itself
    ensures there is ample time and notification for stakeholders to push back
    if it is made prematurely.
    - For MCIPs with lengthy discussion, the motion to FCP is usually preceded by
      a *summary comment* trying to lay out the current state of the discussion
      and major tradeoffs/points of disagreement.
    - Before actually entering FCP, *all* members of the team must sign off;
    this is often the point at which many team members first review the MCIP
    in full depth.
  - The FCP lasts 1 business days.
  - In most cases, the FCP period is quiet, and the MCIP is either merged or
    closed. However, sometimes substantial new arguments or ideas are raised,
    the FCP is canceled, and the MCIP goes back into development mode.

## The MCIP life-cycle
[The MCIP life-cycle]: #the-mcip-life-cycle

Once an MCIP becomes "active" then authors may implement it and submit the
feature as a pull request to the relevant repo. Being "active" is not a rubber
stamp, and in particular still does not mean the feature will ultimately be
merged; it does mean that in principle all the major stakeholders have agreed
to the feature and are amenable to merging it.

Furthermore, the fact that a given MCIP has been accepted and is "active"
implies nothing about what priority is assigned to its implementation, nor does
it imply anything about whether a developer has been assigned the task of
implementing the feature. While it is not *necessary* that the author of the
MCIP also write the implementation, it is by far the most effective way to see
an MCIP through to completion: authors should not expect that other project
developers will take on responsibility for implementing their accepted feature.

Modifications to "active" MCIPs can be done in follow-up pull requests. We
strive to write each MCIP in a manner that it will reflect the final design of
the feature; but the nature of the process means that we cannot expect every
merged MCIP to actually reflect what the end result will be at the time of the
next major release.

In general, once accepted, MCIPs should not be substantially changed. Only very
minor changes should be submitted as amendments. More substantial changes
should be new MCIPs, with a note added to the original MCIP. Exactly what counts
as a "very minor change" is up to the team to decide; check
[Team-specific guidelines] for more details.


## Reviewing MCIPs
[Reviewing MCIPs]: #reviewing-mcips

While the MCIP pull request is up, the team may schedule meetings with the
author and/or relevant stakeholders to discuss the issues in greater detail,
and in some cases the topic may be discussed at a team meeting. In either
case a summary from the meeting will be posted back to the MCIP pull request.

A team makes final decisions about MCIPs after the benefits and drawbacks
are well understood. These decisions can be made at any time, but the team
will regularly issue decisions. When a decision is made, the MCIP pull request
will either be merged or closed. In either case, if the reasoning is not clear
from the discussion in thread, the team will add a comment describing the
rationale for the decision.


## Implementing an MCIP
[Implementing an MCIP]: #implementing-an-mcip

Some accepted MCIPs represent vital features that need to be implemented right
away. Other accepted MCIPs can represent features that can wait until some
arbitrary developer feels like doing the work. Every accepted MCIP has an
associated epic tracking its implementation in a repository; thus that
associated epic can be assigned a priority via the triage process that the
team uses for all issues in a repository.

The author of an MCIP is not obligated to implement it. Of course, the MCIP
author (like any other developer) is welcome to post an implementation for
review after the MCIP has been accepted.

If you are interested in working on the implementation for an "active" MCIP, but
cannot determine if someone else is already working on it, feel free to ask
(e.g. by leaving a comment on the associated issue).


## MCIP Postponement
[MCIP Postponement]: #mcip-postponement

Some MCIP pull requests are tagged with the "postponed" label when they are
closed (as part of the rejection process). An MCIP closed with "postponed" is
marked as such because we want neither to think about evaluating the proposal
nor about implementing the described feature until some time in the future, and
we believe that we can afford to wait until then to do so. Historically,
"postponed" was used to postpone features until after 1.0. Postponed pull
requests may be re-opened when the time is right. We don't have any formal
process for that, you should ask members of the relevant team.

Usually an MCIP pull request marked as "postponed" has already passed an
informal first round of evaluation, namely the round of "do we think we would
ever possibly consider making this change, as outlined in the MCIP pull request,
or some semi-obvious variation of it." (When the answer to the latter question
is "no", then the appropriate response is to close the MCIP, not postpone it.)


### Help this is all too informal!
[Help this is all too informal!]: #help-this-is-all-too-informal

The process is intended to be as lightweight as reasonable for the present
circumstances. As usual, we are trying to let the process be driven by
consensus and community norms, not impose more structure than necessary.


## License
[License]: #license

This repository is licensed as:

* MIT license ([LICENSE](LICENSE) or https://opensource.org/licenses/MIT)

### Contributions
[Contributions]: #contributions

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you shall be licensed as above, without any additional terms or conditions.


[MCIP repository]: https://github.com/mobilecoinfoundation/mcips


[MobileCoin Improvement Proposals]: mcips

Proposal Process

Please see [this document](https://github.com/mobilecoinfoundation/technical-committee/blob/master/CHARTER.md) for details.


Technical Committee Charter

Decrease the minimum fee to 0.0004 MOB (400uMOB, which is 0.02 USD/tx at a 50 USDMOB exchange rate) per board instruction, allow node operators to override the hard-coded minimum fee, and prevent divergent fees by including fee agreement in the node-to-node attestation / key exchange protocol.

Please see [this document](https://github.com/mobilecoinfoundation/mcips/blob/main/text/0001-dynamic-fees-v1.md) for details.


Decrease the minimum fee to 0.0004 MOB (400uMOB, which is 0.02 USD/tx at a 50 USDMOB exchange rate) per board instruction, allow node operators to override the hard-coded minimum fee, and prevent divergent fees by including fee agreement in the node-to-node attestation / key exchange protocol.

Dynamic Fees

We propose to extend mobilecoin transaction outputs to include an "encrypted memo" field of a fixed, 46 byte length. These memo fields have a standard encryption scheme and can be read by the sender and recipient, but no one else.

These memos are intended to hold data, rather than human-readable text. (Although that is one possible use.) We propose an extensible method for specifying a schema for the plaintext data in the memo. We propose that memo types are standardized via MCIP proposals, so that clients can interoperate seamlessly.

Please see [this doucment](https://github.com/mobilecoinfoundation/mcips/blob/main/text/0003-encrypted-memos.md) for details.


We propose to extend mobilecoin transaction outputs to include an "encrypted memo" field of a fixed, 46 byte length. These memo fields have a standard encryption scheme and can be read by the sender and recipient, but no one else.

Encrypted Memos

We propose to specify three memo types that support a "recoverable transaction history" feature.

(See [mobilecoinfoundation/mcips#3](https://github.com/mobilecoinfoundation/mcips/pull/3) for a
description of memos and memo types.)

When a sender sends money to a recipient, the "sender memo" is attached to the TxOut that the
recipient recieves, and permits them to identify the sender. The "destination memo" is attached
to the change TxOut that the sender recieves, and records details of the recipient and the amount sent.

In a mobile chat application, the use of these memos in payments permits the app to recover transaction
history given only the private keys of the user, by fetching all of the user's TxOut's from Fog and then
decoding and validating the memos.

Some additional ancillary parts of the proposal:
- Change subaddress is standardized to subaddress index 1.
- Clients should always produce a change output even if the change is zero, in order to have a place to put
  the destination memo.
- A standard 16-byte hash of a public address is specified, which may be useful elsewhere.
- A memo containing payment request id numbers is also introduced.

Please see [this doucment](https://github.com/mobilecoinfoundation/mcips/blob/main/text/0004-recoverable-transaction-history.md) for details.


We propose to specify three memo types that support a "recoverable transaction history" feature.

Recover Transaction History

Proposals

Governance


1.  ### What is MobileCoin and why was it created?

    MobileCoin is an encrypted-focused cryptocurrency designed for use in everyday transactions. MobileCoin addresses 4 fundamental issues: Security, Transaction Speed, Energy Consumption, and Optimization for Mobile devices. No one except for the sender and receiver can see the details of the transaction. The public blockchain is encrypted to ensure security. MobileCoin is an unrivaled cryptocurrency designed to be fast and secure enough to be used for mobile transactions.

2.  ### Why is MobileCoin used in messaging apps?

    We believe in fast, secure, and easy to use payments on mobile devices. MobileCoin is currently available for use with [one of the world’s most secure messaging apps](http://signal.org/). By design, it’s easy to link a MobileCoin wallet to your phone so you can start sending funds to friends and family, receive funds from them, keep track of your balance, and review your transaction history with a simple interface. Since the goal is to [keep your data in your hands](https://signal.org/blog/update-on-beta-testing-payments), MobileCoin’s [design](https://github.com/mobilecoinfoundation/mobilecoin) means no third party has access to your balance, full transaction history, or funds. You can also transfer your funds at any time if you want to switch to another app or service.

3.  ### How did MobileCoin Inc. start?

    MobileCoin Inc. was founded in 2017 by Josh Goldbard & Shane Glynn. It is a venture-backed company based in San Francisco, CA. The MobileCoin Protocol was [open-sourced](https://github.com/mobilecoinfoundation/mobilecoin) by the MobileCoin Foundation in 2020. The network went live on [December 7, 2020](https://mobilecoinfoundation.medium.com/mobilecoin-main-net-8e355d82c726).

4.  ### What is MobileCoin used for?

    MobileCoin is currently being used for payments in some of the world’s most secure messaging apps. MobileCoin is mobile-first and also works on desktop, offering both the speed and security expected for a payment system.

5.  ### Why does the world need another cryptocurrency?

    MobileCoin could be the foundation for an accessible, secure, and sustainable payments system for the world to use. The best way to create this technology is via a new cryptocurrency and encrypted blockchain. Currently, there is no cryptocurrency that is designed to offer both the security and speed expected for payments. The MobileCoin Foundation provides governance for the MobileCoin Protocol in order to help solve for the most important aspects of any modern payment system: Security, Transaction Speed, Energy Consumption, and Optimization for Mobile. Think of a simple, secure currency utility, like PayPal but encrypted.

6.  ### What is MobileCoin’s energy consumption compared to other cryptocurrencies?

    While other blockchains take as much energy to run an entire country, you could power all of transactions on the MobileCoin Protocol with the same energy needed to power a few households. Since MobileCoin technology uses the Federated Byzantine Agreement instead of Proof of Work, node servers are mostly idle – they only wake up to do work when there is work to do, saving enormously on energy consumption. And now, thanks to the MobileCoin community, MobileCoin is the [first carbon negative cryptocurrency](https://medium.com/mobilecoin/mobilecoin-is-the-worlds-first-carbon-negative-cryptocurrency-54570fce10dc).

7.  ### How do you use MobileCoin?

    Check out this [helpful blog post](https://mobilecoinfoundation.medium.com/how-to-get-mobilecoin-into-your-signal-wallet-for-uk-beta-users-2e847ccbca5b) with video and written explanation. Here are our how to guides for [downloading our desktop wallet](https://mobilecoin.com/news/how-to-download-and-set-up-your-mobilecoin-desktop-wallet) and [purchasing MOB](https://mobilecoin.com/news/how-to-buy-mob-in-the-us).

8.  ### Are you worried that bad behavior will happen with the use of encrypted cryptocurrency?

    People and entities misuse all types of financial platforms and instruments. Outside the US, MobileCoin can be purchased at [www.buymobilecoin.com](https://www.buymobilecoin.com/), which applies best practices of financial institutions around the world to prevent bad actors from obtaining MobileCoin. Any third-party entities that buy, sell, or trade MobileCoin apply their own standards and practices to vet persons or entities trying to purchase MobileCoin.
    
9. ### What is the impact of an Intel SGX compromise on encryption for transactions?

    Secure enclaves can provide improved integrity and confidentiality while functioning as intended. Like most complex new technologies, we should anticipate that design flaws will inevitably be discovered. Several side channel attacks against secrets protected by Intel SGX have been published, and subsequently patched or otherwise mitigated. MobileCoin is designed to provide "defense in depth" in the event of an attack based on a secure enclave exploit. MobileCoin transactions use CryptoNote technology to ensure that, even in the clear, the recipient is concealed with a one-time address, the sender is concealed in a ring signature, and the amounts are concealed with Ring Confidential Transactions (RingCT).

    In the event of an Intel SGX compromise, the attacker's view of the ledger inside the enclave would still be protected by both ring signatures and one-time addresses, and amounts would remain concealed with RingCT. These encryption mechanisms leave open the possibility of statistical attacks that rely on tracing the inputs in ring signatures to determine probabilistic relationships between transactions. This attack is only applicable to transactions made during the time that the secure enclave exploit is known, but not patched. Once the Intel SGX vulnerability is discovered and addressed, statistical attacks are no longer possible, therefore forward secrecy is preserved.

10. ### Can I run a validator node without Intel SGX?

    You can run the consensus-service using Intel SGX in simulation mode, however you will not be able to participate in consensus with other validator nodes. Your software measurement will be different from hardware-enabled Intel SGX peers and remote attestation will fail.

11. ### Can I run a watcher node without Intel SGX?

    Yes, you can operate a watcher node and validate block signatures by running the mobilecoind daemon, which does not require Intel SGX.

12. ###  Where is the code for mobile devices?

    Please see [fog](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/fog), [android-bindings](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/android-bindings), and [libmobilecoin](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/libmobilecoin), to see how the balance checking and transaction building process works on mobile devices that don't sync the ledger.

    Please see also the MobileCoin [Android](https://github.com/mobilecoinofficial/android-sdk/) and [iOS](https://github.com/mobilecoinofficial/MobileCoin-Swift) SDKs, which can be integrated into your app to enable MobileCoin payments.

13. ### Will I need to put my keys on a remote server to scan the blockchain for incoming transactions?

    Keys will never leave your mobile device. For more details on how this works, please see the [MobileCoin Fog README](https://github.com/mobilecoinfoundation/mobilecoin/blob/master/fog).

14. ### Is Fog decentralized?

    Fog is a scalable service that helps users find their transactions, conduct balance checks, and build new transactions. Fog does so without requiring a local copy of the blockchain and without revealing a user's activities or giving away their private keys.

    Fog is intended to be run by app providers to provide their users with a safe and positive mobile experience. Users need only trust the integrity of SGX, and not the service provider.

    Fog is thus not a single, decentralized network, but can be deployed as needed by each party willing to offer this service. Fog can be treated as critical infrastructure for an app, and can be scaled to meet each party's needs.

15. ### What is the hint field? Can I put anything in there?

    The purpose of the hint field is to send an encrypted message to the Fog ingest enclave, which it finds when it post-processes the blockchain. A conforming client puts only an mc-crypto-box ciphertext of a specific size there. For non-fog transactions, a ciphertext encrypted for a random public key should be put there. Putting something in the hint field which is distinguishable from this may degrade security.

16. ### How do I get support?

   For troubleshooting help and other questions, please visit our [community forum](https://community.mobilecoin.foundation/).

   You may also open a technical support ticket via [email](mailto://support@mobilecoin.foundation)


Get your Wallet

Get the Signal App

Activate Payments

stay notified