Skip to content
CryptoDecentral

Note

From Rings of 16 to the Whole Chain: What FCMP++ Changes

Monero-class privacy already hides recipients, amounts, and spenders with a small ring. Full-chain membership proofs aim to replace that fixed decoy set with membership across the ledger — without a forced address migration.

2026-09-11 · privacy, monero, fcmp

From Rings of 16 to the Whole Chain: What FCMP++ Changes

Monero-class privacy already hides recipients (stealth addresses), amounts (RingCT), and — with probabilistic assurance — spenders (ring signatures). The live companion note on this site covers that triad. This note goes one layer deeper: why a fixed decoy ring is a design compromise, and what full-chain membership proofs (FCMP / FCMP++) are meant to replace it with — without turning the upgrade into hype, a launch-day scorecard, or a wallet shopping list.

This is educational protocol literacy. It is not a claim that mainnet already runs FCMP++, not investment framing, and not a guide to “disappear” from lawful process.

What a ring actually proves

Moneropedia’s ring-signature entry is blunt: a ring signature can be produced by any member of a set of key holders, and it should be computationally infeasible to tell which member signed. In Monero, your real spend is mixed with other outputs pulled from the chain; every ring member looks equally valid to an outside observer. That is plausible deniability inside a small anonymity set — not a mathematical guarantee that no heuristic can ever prefer one candidate.

Ring size is the size of that set. Official Moneropedia currently states a fixed ring of 16 (15 foreign “decoy” outputs plus yours). Uniform ring size exists partly so users cannot self-fingerprint by choosing exotic mixin counts. Decoys are selected from the chain (historically with a gamma-style age distribution). Over time the same past outputs can appear in many rings.

That design has known tension points, which Monero’s own FCMP development post names without euphemism: vulnerability to certain targeted analyses (including EAE-class surfaces discussed in research), awkwardness around chain reorganizations, and room for statistical preference among candidates even when every signature verifies. Better decoy selection and fixed ring size reduce those risks. They do not erase the structural fact that the anonymity set on a spend is immediate and small (today: sixteen), not “everyone who ever held an output.”

Frame: A ring proves “I am one of these n outputs.” A full-chain membership proof aims to prove “I am one of the outputs on this ledger,” without pointing at a short candidate list.

Membership versus spend authorization

Seraphis research (and the FCMP write-ups that grew from it) separates two statements rings historically glued together:

  1. Membership — the spent output is one of some set of outputs on the chain.
  2. Spend authorization / linkability — the spender controls the key, and a linking tag (key image) prevents double-spend without revealing which output was spent.

Once modular, membership can use a much larger set without forcing spend-authorization to open the same small ring. Early FCMP work paired with Seraphis (larger “Grootle”-style rings, then full-chain proofs). The catch: that path wanted a new key/transaction format and a migration that would invalidate prior addresses.

FCMP++: full-chain membership without waiting on Seraphis migration

In April 2024, Luke “Kayaba” Parker’s official getmonero.org post described a second proposal — originally “FCMPs+SA+L,” shortened to FCMP++ — built under spam-era pressure for stronger sender privacy sooner. FCMP++ independently adds Spend Authorization + Linkability, removing the hard dependency on Seraphis for the membership upgrade itself.

The educational claim is concrete: the immediate anonymity set moves from 16 toward on the order of 100,000,000 outputs, because the proof asserts membership in the full chain rather than a hand-picked decoy ring. Stressnet release notes phrase it operationally: prove you own 1 of 150 million+ outputs, not 1 of 16.

Kayaba’s technical gist frames FCMP++ as a drop-in-style replacement for CLSAG’s role: membership must still compose with spend authorization and linkability so double spends stay impossible. The construction builds on Curve Trees (IACR 2022/756) — transparent zero-knowledge set membership via shallow Merkle structure over curve cycles and Pedersen-style hashing — with Eagen’s elliptic-curve divisor techniques (IACR 2022/596) cited in Monero’s CCS trail to shrink discrete-log circuit cost enough for node-scale verification.

That is a different proof statement: membership over an accumulator of the ledger, not a local decoy list.

Features the post says the protocol can support

Kayaba’s getmonero.org article lists protocol-layer capabilities (with the deliberate trade-off that some wallet UX can ship later, so the first hard goal stays full sender privacy):

  • Transaction chaining — signing a spend of a not-yet-mined parent, relevant to some layer-two designs.
  • Outgoing view keys — stronger spent detection than today’s incoming-only view keys, useful for cold/multisig and simpler view UX.
  • Forward secrecy (stated goal) — an adversary with a discrete-log oracle should not break protocol privacy as defined in the design notes.

Seraphis can deliver related features via a migration to a new anonymity set and address format. FCMP++’s pitch is a faster path without forced address invalidation at launch, accepting that some wallet features may trail consensus.

Carrot: addressing layer on top of FCMP++

Carrot (Cryptonote Address on Rerandomizable-RingCT-Output Transactions) is an addressing protocol atop FCMP++ consensus, not a second fork. The spec is explicit: FCMP++ sets validity rules; Carrot defines how wallets interact with addresses on those transactions, while keeping backwards compatibility with existing Cryptonote addresses, subaddresses, and integrated addresses — no mandatory key migration to participate.

Rerandomization (already used for amount commitments in RingCT) enables Carrot’s headline protections: address-conditional forward secrecy properties, Janus-attack recognition for recipients, and stateless burning-bug mitigation by binding output pubkeys to a per-transaction input_context. New key hierarchies can add fuller view-only tiers and compartmentalized address-generation roles; legacy wallets still gain the shared protections without rewriting seeds.

Treat Carrot as how you talk to addresses once membership proofs change, not as a ticker or a “new Monero.”

Status, not theatre (as of this draft)

Primary sources describe active development and public stressnets, not a finished mainnet activation with a locked calendar date in the materials fetched for this draft. The FCMP++ & Carrot beta stressnet (e.g. v0.19.0.0-beta.1.1) hard-forked testnet in May 2026 for community testing; release notes warn that stressnet node anonymity sets are tiny versus mainnet, that some wallet features were still incomplete in that cut, and that wallets must use compatible daemons. Treat each audit PDF as a primary document when it lands — not a vibe from a timeline thread.

Why this matters in SA and the Global South

Transparent ledgers turn money into a permanent public graph. Rings already make which output spent ambiguous inside a small set. Full-chain membership aims to make that ambiguity ledger-wide, which matters where ambient financial surveillance is concrete: domestic safety when spend patterns are easy to score; civic space for journalists and organisers whose donor graphs should not be trivial to reconstruct; dignity of salaries, clinic fees, remittances, and small-business cashflow that are not public APIs.

Stronger membership proofs do not replace device hygiene, network-layer care, or lawful process. They change what the consensus data structure itself advertises about senders.

What this note deliberately does not do

It does not recommend buying, selling, or holding any asset. It does not rank wallets, nodes, or custodians. It does not claim FCMP++ is live on mainnet, unbreakable against nation-state traffic analysis, malware, or user error, or a substitute for Tor/VPN/operational security. It does not explain how to evade investigations. It does not treat stressnet participation as privacy practice (the beta release’s own anonymity-set warning is the opposite). It does not productize adjacent tools.

Educational takeaway: rings buy plausible deniability in a small set; FCMP++ is the research-and-engineering path to prove membership over the whole chain while keeping spend authorization and linkability intact — with Carrot as a compatible addressing story. Until consensus activates and wallets catch up, the live privacy model remains the ring/stealth/RingCT triad. Evaluate upgrades by primary specs, not by launch mythology.

Related on CryptoDecentral

Further reading (primary)

Sources

All notes