FCMP++ Monero Privacy Upgrade
You may have heard that the FCMP++ update for Monero is on the way!
But... What exactly is it? Below is the excerpt and background for the initial paper that Luke Parker wrote that first addressed this solution for Monero.
An animation is below that to go with it.
There is also a story that should help you understand at the end.
Read the complete 21 page paper for more details about FCMP++
Abstract & Background:
FCMP++
Luke βKayabaβ Parker
March 10, 2025Abstract
FCMP++, shortened from FCMP+SA+L, short for Full-Chain Membership Proofs + Spend Authorization + Linkability, are an accomplishment of full-set privacy over the existing RingCT protocol used within Monero. This document serves as a specification and implementation ref-erence.
1. Background
Monero is currently planning to deploy the Seraphis upgrade, most notable for its definition as a composition which distinguishes membership from spend authorization. With that, we are allowed much more efficient membership proofs (enabling full-set privacy). RingCT, which fails to so distinguish, was considered infeasible for full-set privacy for that reason and due to how its linking tags are defined. With Seraphis, outputs are defined as k0 Β· G0 + k1 Β· G1 + k2 Β· G2 with the linking tag defined as (k2/k1) Β· J. This allows k0 to be re-randomized without malleating the linking tag.
With a new, incompatible definition of linking tags, it forces creation of a new anonymity set (with explicit migration) to prevent double-spending of already spent outputs (which would now be given a new linking tag if βimportedβ by simply adding a 1 Β· G2 term).
With RingCT, outputs are defined as O = x Β· G with the linking tag defined as x Β· HashToPoint(O). To re-randomize x would be to malleate the linking tag.
Animation of story
Story to help understand:
Here is the spec told as a chronicle. Every plot turn below is a real design decision from the document.
The crowd of sixteen
In the old city, spending a coin meant standing in a line of sixteen look-alikes while the magistrate, a man named CLSAG, asked one bundled question: is one of these coins yours, are you truly its owner, and here is your seal so you may never spend it twice? Your privacy was exactly as large as the crowd you could afford to stand in. And there was a second problem, older and stranger: the seal was carved from the very substance of your identity. Wear any disguise and the seal itself changed shape β and a seal that changes shape cannot stop a coin being spent twice. So disguise was forbidden, and the magistrate's ritual grew more expensive with every person you added to the crowd, so the crowd stayed small. Sixteen. Forever.
The city across the river
Seraphis, the city being built across the river, solved the weld by rebuilding identity itself β new names of three parts, with seals that drink from only two. But their seals are shaped by a new rule, and a coin re-stamped under the new rule forgets it was ever spent. So their gates stay closed to old coins, and the old city's whole crowd would have to migrate at once into a new anonymity set, leaving history behind.
The silent syllable
The insight FCMP++ builds on is smaller and stranger: change not the seal, but the name. Every citizen's name gains a second syllable β and, this is the whole trick, every name in the city's entire history has always left that syllable silent. The old ledger, word for word, describes the same people it always did. No migration, no new crowd, no border. But the seal listens only to the first syllable. Disguise lives entirely in the second, and the seal never hears it.
Two clerks
Next, the bundled question is divided in two. One clerk answers only: does this coin exist in the ledger at all? The other answers only: are you its owner, and is your seal well-formed? The first clerk is deliberately kept ignorant β no names, no amounts, nothing that identifies you β so his paperwork can be done by anyone you would trust with your correspondence: your wallet, your own node, a service. The second clerk's ritual is tiny β small enough to live inside a signet ring, smaller than the old magistrate's ceremony ever was.
The wrappings and the thread
To walk between the clerks, everything you carry is wrapped β the key, the seal's base, the amount β each in its own cloth, so no clerk sees any of them bare. One thread is woven from a single one of those cloths, and it is made to run through both testimonies. The tower knows it as the weave that binds two of the wrappings together; the notary knows it as the secret whose product with your identity shapes the shadow on your seal. Neither testimony alone is worth anything. Together, the thread pins the seal to a coin that neither clerk can name.
The vault that multiplies
The notary's hardest task is the crux of the whole chronicle: certify that the hidden number branded on a vault door is the product of two other hidden numbers β while seeing none of the three. For this there is the arithmetic guild's ceremony (Bulletproof+): the prover seals commitments, the examiner calls a challenge, and the responses balance only if the product is true. Then comes the subtraction: the vault's brand is set against the published wrappings, and a liar's numbers leave a residue with nowhere to sit β a ghost of a term that no honest equation can absorb.
With the product certified, the notary performs a triple attestation (a generalized Schnorr protocol): open the disguise, open the vault, open the seal β one challenge, one set of answers, three relations that must all hold or all fall. The last relation is the shadow-subtraction. The seal, as shown, equals what the disguised seal-base would produce minus exactly the shadow cast by the blind β and only the true owner holding the true thread knows the shadow's shape. When the shadow is subtracted honestly, the disguise falls away and the seal reads the same as it always would have: bound to the coin, not to the costume.
The tower of two languages
Membership now means somewhere among every coin ever minted β so the ledger becomes a tree. Leaves are folded into branch-seals, branch-seals folded upward, all the way to a crown the whole city can see. Proving a leaf means walking one path from a deep branch to the crown, and each step is cheap, so the walk stays short even in a boundless tree.
But each floor of the tower is argued in a different language. A testimony's reasoning happens in the script of the floor it stands on, and each floor's page-numbers are written in that floor's own hand β so the floor above must speak the floor below's numbers as a native tongue. This demands two scribes whose mother tongues interlock: each one's speaking-script is the other's arithmetic-script, so testimony can climb forever by alternating between them. The old scribe, Ed25519, has a stutter β a small redundancy in his speech β and no partner can interlock with him. So the tower does not stand in a circle with the old scribe; it stands over him. Tevador found the two scribes who interlock with each other while still understanding the old one, and the old scribe's words are transliterated into a plainer script the floors can argue about. The architecture itself is borrowed from the builders of Curve Trees, and the author says so plainly.
Two gifts make the tower cheap. The scribes fold a summary of any page into the ongoing testimony at no extra cost. And mid-testimony, the examiner may throw dice whose roll is derived from the story so far β fresh challenges drawn from the tale already told β which allows far cleverer interrogations than a single fixed questionaire would.
The surveyor and the mirror
To prove a committed step-count truly scales a public staircase, you do not walk it β you divide the path. This is Eagen's trick: hang weights on surveyor's poles along the ridge; the ledger of weights balances if and only if the poles truly sum to the destination, and checking the balance at one random checkpoint suffices. Curiously, the step-count need not be written in proper form β any spelling of the same number is accepted, so long as it cannot be reshuffled into a different number.
The upper floors record only faces, not profiles, for speed. But a coin and its mirror-twin share a face. The fix: every witness is recorded standing at a fixed public mark. The twin standing at the mark is a different picture, and no one can smuggle the mark into their claimed stance, because all testimony must open positions against the official measuring rods alone. One more scruple the tower deliberately skips: nobody bothers proving the page is otherwise blank. A crowded page gains the forger nothing.
The gardeners
The city's keepers tend the tree. Pages enter only after ten blocks of seasoning, so storms can be waited out; when a storm does hit, the same paths unwind in reverse. The gardeners never rewrite the book β the seals are additive, so adding or removing a page only nudges the seals along one path to the crown. The book begins at genesis and admits every old coin, each scrubbed of ghosts by a small ritual of multiplication. The old city's calendar-time locks are quietly retired: a waiting list keyed to the wall clock would be a heckler's paradise, a thing anyone could paralyze, while locks keyed to block heights cost almost nothing to honor.
The open seam
Every transaction cites which edition of the book it proves against β an edition at least ten blocks seasoned. But the signature deliberately does not cover that citation, nor the membership proof itself. A seam is left open on purpose, so that a promise can be signed before the coin it spends exists: two parties perform their two-of-two ritual against a coin not yet minted, agreeing in advance on all wrappings; once the coin is minted and seasoned, either party alone can complete the spend. One shared climb of the tower serves the whole transaction, padded out to a tidy size β a party of nine pays for sixteen, so the city charges accordingly and caps the party.
What the city gained
The crowd is now everyone, forever β and the old sleight-of-hand of choosing decoys, with the fingerprints it left, is simply gone. The signet ring performs only the small attestation, so holders of the rings keep their jobs. The notary, it turns out, is secretly a plain Schnorr signature in robes, so every multi-signature scheme ever devised for Schnorr works here with little ceremony. The first syllable of a name can be shared as an outgoing view key β letting its holder read seals on coins as they leave, while the silent second syllable remains the true secret β though only for newly made names, since the old names left that syllable publicly silent. And forward secrecy holds against the strongest adversary in the chronicle: an oracle who can pick any single lock still cannot name the spent coin, because for every coin in the city a forger can construct a fully consistent witness and an indistinguishable proof β the true testimony drowns in a chorus of fabrications, and the oracle cannot even tell which coins have the new property, only compute what an old-style seal would be and wait.
Epilogue: the giants
No new magic is claimed. This is old magic arranged so the old city can wear it without moving house: the multiplying vault from Bulletproof+, the triple attestation from the generalized Schnorr protocol, the tower from Curve Trees, the divided path from Eagen's divisors, the interlocking scribes from tevador's Helios and Selene.