14
Alice wants to transfer 1 BTC from address A to address B
Bob wants to transfer 1 BTC from address C to address D
CoinJoin gives them a way to combine their transfers into a single transaction that has two inputs (A and C) and two outputs (B and D). Someone observing the blockchain no longer knows which one of the outputs is Alice's and which one is Bob's. ...
8
CoinJoin uses SIGHASH_ALL.
I initially found this confusing because I assumed the interface to CoinJoin a little less synchronized than it is. CoinJoin requires each participant to first specify a UTXO and a public key to pay out to.
Someone then constructs a partially complete transaction which makes use of those UTXOs and pays out to the public keys ...
7
Cross-input signature aggregation (CISA) refers to an idea to produce one shared signature that covers multiple inputs in one transaction. The aggregation is made possible by the linearity of the Schnorr signature algorithm. Note that CISA seems to be mostly interesting for key path spending and this answer will not look at script path spending at all. ...
6
No.
CoinJoin does not rely on any cryptography to hide transaction flows. It merely combines multiple transactions into one, and randomizes the order of inputs and outputs.
Of course, as you point out, quantum computing would allow stealing ECDSA outputs...
5
TL;DR yes, it's still decentralized, no it isn't perfectly anonymous.
From the Darkcoin (now Dash) Wikipedia: "It adds privacy to transactions by combining identical inputs from multiple users into a single transaction with several outputs. Due to the identical inputs, transactions usually cannot be directly traced, obfuscating the flow of funds." The nodes ...
4
There was a bug in the full node software we were using to broadcast transactions: Bitcoin Knots 0.19. Adam Ficsor (nopara73) upgraded the backend yesterday with Bitcoin Knots 0.20, which has already fixed the bug. However things will take a few days to fully resolve (probably 99% of issues have already resolved though) as the backend's mempool have to get ...
4
Yes, DarkSend is one specific implementation of CoinJoin, and CoinJoin can implemented directly on top of Bitcoin without a modification of the protocol. So no fork is necessary.
The Darkcoin Whitepaper does not
mention anything that would deviate from the CoinJoin idea and thus require a modification of Bitcoin. (However, the paper is not very detailed ...
3
"Privacy loves company."
The key is to understand why a coinjoin transaction provides privacy. It is not a magical veil that shields your financial history, it is just a tool that helps obfuscate a particular output's history. This obfuscation is only achieved by including many inputs in the coinjoin transaction, such that each input could be the source of ...
3
The only advantages of doing a coinjoin is that the recipient of your funds cannot see the source of your funds (and the sender of funds to you cannot see your future transactions). If you do a coinjoin with only your funds, any branch they follow along this trail will lead to a source (or destination) of your funds.
Every source you include in the coinjoin ...
3
CoinJoin is the core idea underlying CoinShuffle (and other mixing techniques).
The idea behind CoinJoin: "When you want to make a payment, find someone else who also wants to make a payment and make a joint payment together". This leaves out two major details:
How two (or more) participants who want to make a payment find each other?
How is the joint ...
2
Even if you use a mixing service it is not guaranteed that the link between the two+ addresses will disappear. Actually, as far as I know it cannot be guaranteed by any mixing service, decentralized or not, including extra fees or not...
In theory, a good mixing scenario would use a purely decentralized service with a consistently huge amount of ...
2
With option 2, most analyses will conclude that Alice owned A1, A2 and A3, because the transactions which spent them have no change address. Typically, you assume that the amount you have held in a TXO never exactly matches the amount you're making as a payment, so transactions usually have change outputs too.
I think you have a little misunderstanding ...
2
Multisig inputs typically have multiple participants. Usually multiple parties are required to sign the transaction.
2
Doing coinjoin with only your coins is possible, it's called fake coinjoin. Samourai Wallet has one implementation, called Stonewall, I have written fake-coinjoin.sh for Bitcoin Core. But such fake coinjoin by itself does not give you much privacy, because of common-input-ownership heuristic. So, by default chain analysis companies assume that all the inputs ...
2
Status Quo
The CoinJoin transaction only has a minimally reduced blockspace requirement in comparison to the unaggregated transactions:
Transaction sizes (example is P2PKH) can be calculated by the following formula:
size = #inputs * 148 bytes + #outputs * 34 bytes + 10 bytes
By combining multiple transactions only the 10 bytes of the transaction ...
2
...does this present a privacy risk?
Privacy concerns can be boiled down to the following questions: what information am I giving up by engaging in this transaction? And who am I sacrificing this information to?
When you engage with some counterparty to make a payment, they will gain knowledge about your involvement in the bitcoin transaction that includes ...
2
Joinmarket
One group of participants (called market makers) will always be available to take part in CoinJoins at any time. Other participants (called market takers) can create a CoinJoin at any time. The takers pay a fee which incentivizes the makers. A form of smart contract is created, meaning the private keys will never be broadcasted outside of your ...
2
Murch answered this on Twitter.
The signatures for P2TR are part of the witness data already, and Schnorr sigs are only 64 bytes. Each aggregated signature but the last would need a one byte placeholder. So, the savings for a n-input tx would be (n-1)*63WU minus whatever other overhead is added.
A P2TR key-path input weighs 230 WU (57.5 vB), the header 42 ...
1
Without CISA: Multiple inputs in a Bitcoin transaction requires multiple signatures
With CISA: Multiple inputs require only one signature
How many inputs are used in different coinjoin implementations?
Joinmarket: More than 3 (Example Tx)
Wasabi: More than 10 (Example Tx)
Whirlpool: 5 (Example Tx)
Let's assume 5 number of inputs for whirlpool, 50 for ...
1
Using ring signatures off-chain to form a coinjoin transaction sounds hard, especially since because BTC doesn't have ring signature support without a hard fork or a soft fork.
You may find Cashfusion, an instance of CoinJoin shuffling, interesting, it's fully applicable to BTC and it uses TOR, which is simpler than Ring Signatures.
1
we can postulate a rational coin-holder would never construct a transaction with more inputs than required."
I don't think this is necessarily true, a user may create transactions with unnecessary inputs in order to confuse such privacy-attacking heuristics. It is in the user's interest to retain some privacy, after all.
Privacy is complicated, but if ...
1
I am very embarrassed, just circling back to share, the above workflow works perfectly. My problem was I had an incorrect vout value in one of my inputs. Basically I was trying to spend money I don't have (/facepalm). As soon as I corrected that, everything worked flawlessly.
Here's my multi-wallet.dat file Coinjoin :)
https://live.blockcypher.com/btc-...
1
Resources
Anonymous CoinJoin Transactions with Arbitrary Values
discusses the optimized and non-optimized version of it. In this reply I will discuss the non-optimized version of it.
CoinJoin Sudoku may also be something to look up.
Tooling
I wrote a small command line tool in .NET Core that anyone can play around with. You can either provide an input ...
1
Sidenote: bitcoins exist as unspent transaction outputs (UTXOs), so with this in mind the two options you outlined for Alice create two different situations: in situation 1, Alice will have one UTXO. In situation 2, Alice will have 3 UTXOs. The question you've asked involves an analysis of UTXOs, so I thought this was worth mentioning.
Can someone ...
1
There is nothing in particular stopping exchanges from using CoinJoin to construct transactions with other exchanges, but rather there does not appear to be any demand for this. For example both JoinMarket and Wasabi1 have APIs that could be used.
In the future this situation could change if something like Schnorr signature aggregation capabilities are ...
1
Is there a good technique to be able to spend these UTXO's without compromising privacy?
Never consolidate UTXOs after coinjoin.
Spend and use them separately.
Use payjoin.
Avoid sending directly to any KYC exchange. Bisq is one of the DEX which can be used.
Never share them on social media or any public groups which could result in associating your ...
1
Regardless of the maximum size of a single transaction, a CJ anonymity set can be made arbitrarily large (bounded, of course, by participants) by building a multi-stage switching network out of joins.
This was described in the original coinjoin post:
In particular, if you can build transactions with m participants per transaction you can create a ...
Only top voted, non community-wiki answers of a minimum length are eligible