11

Alice wants to transfer 1 BTC from address A to address B Bob wants to transfer 1 BTC from address C to address D CoinJoin gives them a way to combine their transfers into a single transaction that has two inputs (A and C) and two outputs (B and D). Someone observing the blockchain no longer knows which one of the outputs is Alice's and which one is Bob's. ...


6

No. CoinJoin does not rely on any cryptography to hide transaction flows. It merely combines multiple transactions into one, and randomizes the order of inputs and outputs. Of course, as you point out, quantum computing would allow stealing ECDSA outputs...


5

CoinJoin uses SIGHASH_ALL. I initially found this confusing because I assumed the interface to CoinJoin a little less synchronized than it is. CoinJoin requires each participant to first specify a UTXO and a public key to pay out to. Someone then constructs a partially complete transaction which makes use of those UTXOs and pays out to the public keys ...


5

TL;DR yes, it's still decentralized, no it isn't perfectly anonymous. From the Darkcoin (now Dash) Wikipedia: "It adds privacy to transactions by combining identical inputs from multiple users into a single transaction with several outputs. Due to the identical inputs, transactions usually cannot be directly traced, obfuscating the flow of funds." The nodes ...


4

Yes, DarkSend is one specific implementation of CoinJoin, and CoinJoin can implemented directly on top of Bitcoin without a modification of the protocol. So no fork is necessary. The Darkcoin Whitepaper does not mention anything that would deviate from the CoinJoin idea and thus require a modification of Bitcoin. (However, the paper is not very detailed ...


3

CoinJoin is the core idea underlying CoinShuffle (and other mixing techniques). The idea behind CoinJoin: "When you want to make a payment, find someone else who also wants to make a payment and make a joint payment together". This leaves out two major details: How two (or more) participants who want to make a payment find each other? How is the joint ...


2

Even if you use a mixing service it is not guaranteed that the link between the two+ addresses will disappear. Actually, as far as I know it cannot be guaranteed by any mixing service, decentralized or not, including extra fees or not... In theory, a good mixing scenario would use a purely decentralized service with a consistently huge amount of ...


2

With option 2, most analyses will conclude that Alice owned A1, A2 and A3, because the transactions which spent them have no change address. Typically, you assume that the amount you have held in a TXO never exactly matches the amount you're making as a payment, so transactions usually have change outputs too. I think you have a little misunderstanding ...


2

Status Quo The CoinJoin transaction only has a minimally reduced blockspace requirement in comparison to the unaggregated transactions: Transaction sizes (example is P2PKH) can be calculated by the following formula: size = #inputs * 148 bytes + #outputs * 34 bytes + 10 bytes By combining multiple transactions only the 10 bytes of the transaction ...


2

...does this present a privacy risk? Privacy concerns can be boiled down to the following questions: what information am I giving up by engaging in this transaction? And who am I sacrificing this information to? When you engage with some counterparty to make a payment, they will gain knowledge about your involvement in the bitcoin transaction that includes ...


1

Sidenote: bitcoins exist as unspent transaction outputs (UTXOs), so with this in mind the two options you outlined for Alice create two different situations: in situation 1, Alice will have one UTXO. In situation 2, Alice will have 3 UTXOs. The question you've asked involves an analysis of UTXOs, so I thought this was worth mentioning. Can someone ...


1

Regardless of the maximum size of a single transaction, a CJ anonymity set can be made arbitrarily large (bounded, of course, by participants) by building a multi-stage switching network out of joins. This was described in the original coinjoin post: In particular, if you can build transactions with m participants per transaction you can create a ...


Only top voted, non community-wiki answers of a minimum length are eligible