Date: Tue, 01 Dec 2020 16:24:11 +0000
To: ZmnSCPxj <ZmnSCPxj@protonmail.com>,
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <OM9jyMUsRukofhHIun9Ij-pmypjN1OjySaKgDjlkDvUleZ13aXRxjltx8nxh_GHQbYmlp2toHhUyANMEbrk1Xp2NVOp_1a2HQcLz27oFlJA=@protonmail.com>
In-Reply-To: <a_ytmG7wahHYE15SU_JER_s2dLFVpI8fRLBZTuV32QuXVOoOq2r7Dyof1tugJUFoE1bDAbYMffJ21HGNPVhh2dLGIWPkIPfEryT2Jk_sg3Y=@protonmail.com>
References: <9a068476-855e-0dd7-4c9c-264d5d8bf60a@gnet.me>
 <00e301d6c77e$2a4eeab0$7eecc010$@voskuil.org>
 <3f172428-fb03-755f-3020-43817fdb1897@gnet.me>
 <a_ytmG7wahHYE15SU_JER_s2dLFVpI8fRLBZTuV32QuXVOoOq2r7Dyof1tugJUFoE1bDAbYMffJ21HGNPVhh2dLGIWPkIPfEryT2Jk_sg3Y=@protonmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: Re: [bitcoin-dev] Out-of-band transaction fees
Precedence: list

Good morning e, and Sebastian,

So it seems, the goals are the below:

* Someone wants to pay a fee to get a transaction confirmed.
* Miners want to know how much they earn if they confirm a transaction.
* The one paying for the fee does not want to link its other coins to the t=
ransaction it wants confirmed.

Would that be a fair restatement of the goal?

If so, it seems to me we can make a CoinJoin-like approach using only L1, a=
nd combine fees by a kind of FeeJoin.

The issue with linking is that if for example the one paying a fee to get a=
 transaction confirmed wants to CPFP the transaction, it may need to take a=
nother UTXO it controls into the child transaction, thereby linking its "an=
other UTXO" with the "transaction it wants confirmed".

However, if multiple such individuals were to CoinJoin their transactions, =
the linking becomes much harder to trace.

So a possible mechanism, with a third-party that is trusted only to keep th=
e service running (and cannot cheat the system and abscond with the fees an=
d leave miners without money) would be:

* The third-party service divides its service into fixed-feerate bins.
* Clients select a preferred feerate bin they want to use.
* For each client:
  * Connects to the service by Tor to register a transaction it wants to ha=
ve CPFPed.
  * Connects to the service by a different Tor circuit to register a UTXO i=
t will use to spend fees.
* The server passes through the CPFPed outputs in the whole value.
* The server deducts the fee from the fee-paying UTXO and creates an output=
 with all the fees (CPFP output spend, UTXO input spend, CPFP output re-cre=
ation, UTXO output re-creation) deducted from the UTXO.
* The server gives the resulting transaction to the clients.
* The clients sign the transaction after checking that its interested CPFPe=
d outputs and fee-paying UTXOs are present.

This results in a transaction with many CPFPed inputs and fee-paying UTXOs,=
 and no easy way to link the latter with the former.

* Miners and chain analysis cannot link them, as they see only the resultin=
g tx.
* The service cannot link them, as clients talk to them on two separate Tor=
 connections.

The above is blatantly the Wasabi way of CoinJoining; using the JoinMarket =
way of CoinJoining should be possible as well, and is left as an exercise t=
o the reader.

Now, you have mentioned a number of times that you believe Bitcoin will eve=
ntually be a settlement layer, and somehow link this with standardized UTXO=
 sizes.
But I think the end goal should be:

* To improve Bitcoin blockchain layer privacy.

It should not matter how we achieve this, whether it involves standardized =
UTXO sizes or not; if you want to use this solution, you need to present a =
good reason why this is the best solution for Bitcoin privacy, and better t=
han other solutions.

For example, the JoinMarket way of CoinJoining does not require any particu=
lar standardized UTXO size.
The upcoming SwapMarket that Chris Belcher is working on, also does not req=
uire such a standardized UTXO size, as it is based as well on the JoinMarke=
t technique, where the client can select whatever sizes it wants.
Why should the Bitcoin ecosystem adopt a strict schedule of UTXO sizes for =
privacy, if apparently JoinMarket and SwapMarket can improve privacy withou=
t this?

Regards,
ZmnSCPxj