In a two party coinjoin consists of Mr Seller and Mr Buyer. Mr Seller has set A of sender addresses/input and set B of receiver addresses (output) Mr Buyer has set C of sender addresses/input and set D of receiver addresses (Output) Assume all input/output are addresses (P2PK or P2PKH and none of them are script).

How does Mr Seller prove to others that set A and set B addresses belong to him? Is there any other way to prove than proving the address one by one which can be very long. On top of that set B addresses are hashes. Mr Seller also need to cooperation from Mr Buyer to provide proof that set C and Set D address belong to Mr Buyer. This is a requirement from IRS audit department who wanted proof of payment amount from the given invoice record.

  1. Why would you prove ownership of inputs/outputs in two-party coinjoin? This data upon publishing would make the coinjoin efforts obsolete and would totally cancel all anonymity set in this specific transaction.
  2. For input you could use some specific wallet setup where inputs would be in separate xpub derivation path, and outputs in separate.
  3. Even with point 2. you'd have to post the outputs as the list of addresses if you don't want to leak pubkeys?

This looks to me like an XY problem and your requirements are contradicting themselves. Could you explain what you're trying to achieve?

  • for auditing and tax purposes! IRS asked for the proof of payment details. Let assume IRS will not leak out the info.
    – Cisco Mmu
    Sep 25 '20 at 3:52

I think what you need is a threshold signature(n of n). I don't know of any tools that would help you create such signature, but conceptually speaking it is not that difficult.

You take all of the addresses in Set A and Set B and get the corresponding public keys. Then you can create a single threshold signature(MuSig for example) using all of those public keys.

Since you are asking these for tax purposes, you would also need to prove that you don't own those coins in Set(C+D). For that, you would also need another threshold signature from other person over Sets(C + D) to show that they own those coins.

As I said earlier, I don't know of any readymade tools for doing these.

  • thank you for your respond.
    – Cisco Mmu
    Oct 5 '20 at 12:04

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.