Do CoinJoins Really Require Equal Transaction Amounts for Privateness? Part One: CashFusion


Though Satoshi Nakamoto’s white paper means that privateness was a design aim of the Bitcoin protocol, blockchain evaluation can usually break customers’ privateness. This can be a downside. Bitcoin customers won’t essentially need the world to know the place they spend their cash, what they earn or how a lot they personal, whereas companies might not need to leak transaction particulars to rivals — to call some examples.

However there are answers to regain privateness, like CoinJoin. A few of the hottest mixing options out there right now use this trick, together with Wasabi Pockets (which leverages ZeroLink) and Samourai Pockets (which leverages Whirlpool). In each circumstances, customers chop their cash into equal quantities to combine them with one another. Utilizing equal quantities is taken into account a vital step for the combo to be efficient.

Nevertheless, a brand new mixing protocol referred to as CashFusion, in improvement for the Bitcoin Money community, challenges this assumption. The builders behind the protocol declare that CashFusion presents privateness via CoinJoins with out the requirement to solely combine equal quantities. If true, this may drastically change how we take into consideration privateness in Bitcoin as effectively.

If true…


Let’s begin at first. (Or skip this half if you recognize what CoinJoin is.)

A typical bitcoin transaction has one or a number of inputs (principally the addresses cash are despatched from) and one or a number of outputs (principally the addresses cash are despatched to). If a transaction has a couple of enter, it’s often as a result of the sender used a number of chunks of his cash (UTXOs) to get to the required quantity. If a transaction has a couple of output, it’s often as a result of a number of persons are being paid directly (a batched transaction) and/or the payer is sending a reimbursement to one in all his personal addresses as change (as a result of the chunks didn’t add as much as the precise correct amount; that is usually the case).

Sadly, a typical transaction as outlined right here reveals quite a bit. For instance, it’s simple to conclude that every one enter addresses belong to the identical particular person, which permits for deal with clustering. The transaction additionally exhibits from which addresses to which addresses cash are shifting, revealing a path of cash over the blockchain. There could be extra (delicate) hints, and all are unhealthy for privateness.

A possible resolution to this downside, first proposed by Bitcoin Core contributor Gregory Maxwell in 2013, known as CoinJoin. The thought behind CoinJoin is easy: A number of unbiased transactions are merged into one large transaction. So if two transactions have two inputs and two outputs every, that is mixed right into a single transaction that has 4 inputs and 4 outputs. This a minimum of breaks the belief that every one enter addresses belong to the identical particular person and will assist break the path of cash as effectively.

Why Equal Amounts

It’s often assumed that the privateness positive factors of CoinJoin as described above could be restricted, nonetheless. In lots of circumstances, the quantities despatched within the inputs and the quantities acquired within the outputs could be puzzled collectively, to rediscover which particular person transactions went into the mixed CoinJoin transaction.

For instance, let’s take two transactions, one from Alice to Carol and one from Bob to Dave. Alice has two chunks of cash value 2.three and 1.four bitcoin, and she or he needs to pay Carol three.2 bitcoin. Bob has chunks of three and a pair of bitcoin, and desires to pay Dave four bitcoin.

Simplified, these transactions appear like so:

2.three + 1.four = three.2 + zero.5


three + 2 = four + 1

(The zero.5 BTC and 1 BTC outputs are change.)

Merged collectively, the CoinJoin transaction would appear like so:

three + 2.three + 2 + 1.four = four + three.2 + 1 + zero.5

Though the transactions had been merged, it’s trivial to rediscover which inputs paid which outputs, and, subsequently, additionally which inputs could be matched collectively as belonging to the identical sender. Assuming you recognize that there are two payers, the quantities could be puzzled along with just one potential configuration: the unique transactions.

For that reason, standard mixing options like ZeroLink and Whirlpool are restricted to mixing equal quantities. It doesn’t matter what quantities are put into a mixture as inputs, the combined outputs are indistinguishable from each other, which implies that any participant may have acquired any fixed-size chunk of coin.

If the mounted quantities are set at 1 BTC, Alice, Bob, Carol and Dave’s CoinJoin would appear like so:

three + 2.three + 2 + 1.four = 1 + 1 + 1 + 1 +1 + 1 + 1 + 1 + zero.5 + zero.2

This can be a large enchancment, since any of the chunks of 1 might be puzzled again collectively into both of the 2 unique transactions. It’s not clear which of the 1 BTCs belong to Alice, Bob, Carol or Dave, and even to which pair.

Nevertheless, it’s nonetheless not excellent, as a result of there are unequal outputs left. These outputs, precisely as a result of they don’t have equal quantities, can nonetheless be linked to particular inputs: Alice’s. This additionally implies that Alice’s inputs could be linked to one another. And if, after a number of mixes, somebody combines the unequal outputs in a subsequent transaction, that hurts privateness, too: it hyperlinks the completely different chunks to the identical particular person. Furthermore, if the unequal outputs are later utilized in mixture with the fixed-amount outputs, these leaks may wreck the preliminary mixing course of itself.


CashFusion, a venture by Bitcoin Money builders Mark Lundeberg and Jonald Fyookball, got down to cope with the “leftover” outputs downside. They initially created this as an addition to CashShuffle, which is an implementation of CoinShuffle for Bitcoin Money, and mixes equal quantities. The considerably stunning potential of CashFusion may additionally imply that it turns into its personal standalone mixing protocol, nonetheless.

To know this potential, let’s take a look at one other set of transactions. Let’s say Alice needs to pay Carol four cash, and she or he has two UTXOs value 2 and three cash. In the meantime, Bob needs to pay Dave 9 cash, and he has two UTXOs value 7 and eight cash.

Simplified, these transactions appear like so:

three + 2 = four + 1


eight + 7 = 9 + 6

Merged collectively, the CoinJoin transaction would appear like so:

eight + 7 + three + 2 = 9 + 6 + four + 1

Now, from this CoinJoin transaction, it’s attainable to puzzle collectively the unique two transactions, after all. Nevertheless, even when you recognize that there are two payers, a number of different combos are attainable as effectively.

For instance:

eight + 2 = 9 + 1


7 + three = 6 + four


eight + 2 = 6 + four


7 + three = 9 + 1


7 + 2 = 9


eight + three = 6 + four + 1


7 = 6 + 1


eight + three + 2 = 9 + four

For the sake of simplicity, this instance solely used spherical numbers. This makes extra potential configurations attainable however will truly not replicate actuality fairly often. On the flipside, this simplified instance solely used two unique transactions. In actuality, a CoinJoin may encompass dozens and even a whole lot of unique transactions. So whereas simplified, this simplification each helps and harms the potential of making a number of configurations.

CashFusion is constructed across the principle, derived from the sector of Combinatorics, that a big sufficient CoinJoin transaction will usually (if not all the time) provide a number of completely different options to the puzzle, even when sensible quantities are used. And that, as extra inputs and outputs are included, extra potential configurations could be derived from it. (This needs to be very true if the quantities are in the identical ballpark — like 1 BCH — which CashFusion customers are inspired to do for the sake of their very own privateness.)

As there are extra potential options to the puzzle, a blockchain analyst may have a more durable time determining which resolution was the unique configuration. This could break the path of cash and make it more durable to hyperlink inputs collectively. As such, it ought to provide privateness.

To enhance this potential, CashFusion consists of an additional trick to make it even more durable to puzzle collectively the unique configuration: It lets customers semi-randomly chop up their outputs into a number of smaller outputs. So as a substitute of Alice paying Carol one output of four cash, Alice may, for instance, ship Carol outputs of three and 1 coin. Bob, as a substitute of paying one output of 9 cash, may ship Dave outputs of 5, three and 1 coin.

In the meantime, customers are inspired to supply a number of inputs as effectively, maybe from earlier mixes. This enables them to consolidate their smaller chunks into a much bigger chunk, with out that being apparent on the blockchain. (Alice would, for instance, present inputs of two + 2 + 1; Bob would offer inputs of 6 + 5 + four.) Certainly, consolidating the unequal leftover chunks into greater outputs was the unique thought and serves because the origin of the protocol’s identify: CashFusion.

However Does the Assumption Maintain Up?

To disappoint you in the event you learn this far trying for a ultimate conclusion: This text won’t present a definitive reply to the query whether or not CashFusion’s assumptions maintain up or not, or to what extent. It appears there isn’t a definitive reply but. The proposal has gone via relative little peer evaluation to this point, and whereas the builders behind CashFusion imagine their resolution presents enough privateness, others seem a bit extra skeptical.

On the face of it, CashFusion’s method appears misguided, as earlier unequal quantity mixing schemes like Blockchain’s SharedCoin had been damaged years in the past. However the essential distinction, Lundeberg and Fyookball now imagine, is that a CashFusion transaction would come with extra inputs and outputs than a SharedCoin transaction did. Much like different nonintuitive mathematical quirks just like the birthday downside, the variety of potential configurations grows exponentially for every added enter and output, fixing the issue SharedCoin had — although Lundeberg agrees higher math proofs will likely be essential to correctly verify this.

The CashFusion description itself does embrace what Lundeberg self-admittedly considers “serviette math,” of which a barely extra superior model was additionally revealed by him on Reddit. These estimates counsel that even with solely 10 individuals, every offering 10 inputs to be consolidated into one output (for a complete of 100 inputs and 10 outputs), the variety of attainable configurations would, on common, be within the vary of 100 quintillion. (That’s a one with twenty zeroes, or 10^20.) Even simply computing all of those prospects would take fairly a little bit of time — nevermind accurately reestablishing the unique transactions.

On the time of writing this text, extra analysis is ongoing; Fyookball not too long ago revealed his personal evaluation on this weblog put up. For now, Lundeberg, Fyookball and others are a minimum of sufficiently satisfied of the CashFusion protocol to need to deploy it. An alpha consumer of the CashFusion software program is out there for testing; a full launch is anticipated inside months.

However others aren’t as satisfied. A critique of the proposal is that — even when the 10^20 quantity (roughly) holds up — not each output of a CashFusion CoinJoin will likely be equally more likely to have come from each enter. In different phrases, whereas some individuals might achieve important privateness, others may achieve a lot much less privateness from the identical combine. And for any particular person person, it’d be troublesome to inform whether or not they’re those gaining a lot privateness or not. (This critique and different critiques could be discovered on this current bitcoin-dev e mail thread.)

Against this, equal-amount mixing presents related privateness to all individuals and leads to a most variety of attainable configurations. In a approach, equal-amount mixes end in a “excellent” CashFusion CoinJoin and is, subsequently, strictly higher — if the unequal change downside is ignored.

Nonetheless, even when CashFusion would by no means utterly change equal-amount mixing, it’d simply assist resolve the unequal-change difficulty, as initially supposed…

Creator’s observe: There is a little more to the CashFusion proposal, like how the CoinJoin transaction is constructed. There are additionally a number of extra delicate dangers and trade-offs relating to privateness, like how customers deal with their cash earlier than and after the combo. For simplicity and readability, this text focuses solely on the central and arguably most attention-grabbing thought behind CashFusion: unequal-amount mixing.

Because of Mark Lundeberg for info and suggestions.

Part two of this text will cowl one other non-equal quantity mixing method referred to asKnapsack.

Source link Bitcoin Magazine


Be the first to comment

Leave a Reply

Your email address will not be published.