State of the transaction privacy work in Bitcoin

[Kruw]

@nkaretnikov

“Full privacy” is an overstatement. CoinJoin is a mixing scheme. If the anonymity set is not good, then privacy is not good. It can be vulnerable to amount correlation, post-mix consolidation, address reuse, and timing/Sybil attacks.

These issues are solvable when using the WabiSabi coinjoin protocol.

Papers measuring coinjoin data can be found here, which shows that the anonymity set continuously increases over time from remixes:

Analysis of input-output mappings in coinjoin transactions with arbitrary values by Jiri Gavenda, Petr Svenda, Stanislav Bobon, and Vladimir Sedlacek (Masaryk University, Czechia)

CoinJoin ecosystem insights for Wasabi 1.x, Wasabi 2.x and Whirlpool coordinator-based privacy mixers by Petr Svenda + Jiri Gavenda (Masaryk University, Czechia) and Vasilios Mavroudis + Chris Hicks (The Alan Turing Institute)

@nkaretnikov

This is a valid observation, but PayJoin still can be used to improve privacy if: Bob uses a UTXO that doesn’t deanonymize a different counterparty (e.g., Bob’s own transfer from an exchange)

Changing Alice’s name to MtGox in the example doesn’t make any difference, an exchange is still a counterparty.

@nkaretnikov

Bob uses a UTXO already associated with Charlie. This breaks the common-input-ownership heuristic, obscures the payment amount, and can mislead change-identification heuristics.

Those heuristics are broken from a third party perspective, but using Payjoin in this scenario doesn’t make any difference for the conventional threat model: Bob can already consolidate these two UTXOs without revealing any new information to Charlie.

@nkaretnikov

Not a PayJoin issue, but an important point for real world usage. Appreciate you mentioning this.

It is a Payjoin issue - If Bob accepts a regular payment from Charlie’s mobile wallet instead of a payjoin, less data will be revealed to Charlie (and end up in the hands of surveillance companies).

@nkaretnikov

The word “just” makes it seem like a convenience feature. Making it easier to use the same address without linking transactions is huge for privacy.

Silent payments have no privacy advantages compared to a payment sent to a new address that was generated manually. It’s strictly a convenience improvement that allows reuse in two specific scenarios:

1. Receiving non-public donations
2. Receiving multiple payments from the same entity.

@nkaretnikov

As a side effect, this also reduces public key exposure for unspent outputs. Exposed public keys can become an issue with quantum computers.

This is incorrect. Silent payment outputs use Taproot keys, which are exposed onchain.