Single "Multiple Inputs Tx" vs Multiple "Single Input Tx"

Question

Alice owns three addresses A1, A2, A3. She decides to collect the coins held by these addresses into a single coin so she generates a fresh new address A4 for that.

She has the following two options:

1. Single transaction

+--------------+ |A1 A4| |A2 -> | |A3 | +--------------+

2. Multiple transactions

+--------------+ |A1 A4| +--------------+

+--------------+ |A2 A4| +--------------+

+--------------+ |A3 A4| +--------------+

---

She does not want people to know that A1, A2 and A3 are owned by her. And she does not intend to use any mixing services. She also don't mind paying more transaction fees as in option 2.

Option 1

A1, A2 and A3 can be linked together assuming she did not use any Coin Join technique.

Option 2

It can be seen that A4 is reused to receive payments. However A4 has never been seen before this transaction.

Questions on Option 2:

1. Can someone observing the Blockchain deterministically figure out A1, A2 and A3 belong to same user?

2. If Alice now spends A4 to Bob (sends all amount, she never uses A4 again), can Bob ever figure out that A1, A2 and A3 belonged to Alice?

3. What privacy will Alice (or someone down the trail, like Bob) lose if she goes for option 2?

4. Is reusing addresses to only receive payments and spending that address only once okay?

Answer 1

Sidenote: bitcoins exist as unspent transaction outputs (UTXOs), so with this in mind the two options you outlined for Alice create two different situations: in situation 1, Alice will have one UTXO. In situation 2, Alice will have 3 UTXOs. The question you've asked involves an analysis of UTXOs, so I thought this was worth mentioning.

Can someone observing the Blockchain deterministically figure out A1, A2 and A3 belong to same user?

No, they cannot determine this absolutely in either case. Coinjoining techniques exist that break the heuristic of "all transaction inputs belong to a single user", and as these techniques are developed and more widely adopted they will make this heuristic even less reliable. I know you said "assume she didn't use these techniques", but in the real world that assumption may not be valid.

Otherwise your question is more of an assertion: "We must assume coinjoin of any sort does not exist, and therefore all transaction inputs belong to a single user". A transaction which has multiple users supplying inputs is by definition a joining of coins.

If Alice now spends A4 to Bob (sends all amount, she never uses A4 again), can Bob ever figure out that A1, A2 and A3 belonged to Alice?

Bob can see that A1, A2, and A3 were involved in the same transaction Alice was, but this does not imply she owns all of those addresses. Those addresses could be Alice's, or someone else that sent BTC to Alice. By spending A4 she does not reveal any information in this regard.

What privacy will Alice (or someone down the trail, like Bob) lose if she goes for option 2?

Creating multiple UTXOs for a single address does not give the user more privacy, compared to creating a single UTXO for that address.

Is reusing addresses to only receive payments and spending that address only once okay?

It depends what you mean by 'okay'. It is not good for your privacy, or the privacy of those you interact with, since other users can see more of your financial history, and get a better idea of what other addresses you've transacted with. That is generally the biggest worry of using a singular address, the sort of hypothetical future ECDSA-breaking attack that not revealing your public key protects against (ie: only spend once from an address) is probably less of a concern for most users.

Answer 2

With option 2, most analyses will conclude that Alice owned A1, A2 and A3, because the transactions which spent them have no change address. Typically, you assume that the amount you have held in a TXO never exactly matches the amount you're making as a payment, so transactions usually have change outputs too.

I think you have a little misunderstanding about where bitcoins are held. Bitcoins are not stored in addresses. You don't "spend an address." You spend one or more UTXOs. Each transaction in option 2 creates a separate TXO, even though they share the same address for spending. This means, when the coins associated with A4 get spent in full, the individual TXOs are each inputs for the new transaction, which makes it look more like option 1 (multiple inputs, one output) when spent, like this.

+--------------------+
|A4 (txo1)         B1|
|A4 (txo2)   ->      |
|A4 (txo3)           |
+--------------------+

Bob can of course, look at each of these inputs and see which transaction they came from, but he can't necessarily determine whether the addresses actually belonged to Alice, or whether it is just likely that is the case. Without some more evidence from further back in the history of the coins, you cannot prove whether Alice owned them initially or received them from somebody else.