1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
|
Return-Path: <ZmnSCPxj@protonmail.com>
Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138])
by lists.linuxfoundation.org (Postfix) with ESMTP id 92296C016F
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 11 Jun 2020 11:51:17 +0000 (UTC)
Received: from localhost (localhost [127.0.0.1])
by whitealder.osuosl.org (Postfix) with ESMTP id 7BC388873A
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 11 Jun 2020 11:51:17 +0000 (UTC)
X-Virus-Scanned: amavisd-new at osuosl.org
Received: from whitealder.osuosl.org ([127.0.0.1])
by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024)
with ESMTP id ALQeZCWBhOB0
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 11 Jun 2020 11:51:15 +0000 (UTC)
X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6
Received: from mail-40140.protonmail.ch (mail-40140.protonmail.ch
[185.70.40.140])
by whitealder.osuosl.org (Postfix) with ESMTPS id 55BF988736
for <bitcoin-dev@lists.linuxfoundation.org>;
Thu, 11 Jun 2020 11:51:15 +0000 (UTC)
Date: Thu, 11 Jun 2020 11:51:03 +0000
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com;
s=protonmail; t=1591876272;
bh=bssnrwZ+/FCBqtMDq7Aiw2C+wOs5z1ounJTBZbGUumk=;
h=Date:To:From:Reply-To:Subject:From;
b=Ebpth57f532FP8+VGBZHBfkWh2/+EaaBbfvitZfbRciiSHiXAhsGdT+c1KgjVZHnm
uLxEkWlGgGo+Kqg8/I8c4SMs3TyhqLM/IxGYOLk0tyAzrH2MDBsLVKQIY8Y7mJDGug
8O4fAIMiQlJqQEliVT3jHn1h5rpuLlAPrIf3kN0I=
To: Chris Belcher <belcher@riseup.net>,
bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
From: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Reply-To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Message-ID: <fQt0iIzsA5QprW64lX4SR1R78Aj6e-WqIgSMvk75mdiagQmAchIUqCpXzDjD4jPBhorg0i-oGlrYz7ot2xWMgJiha-eGFzl3PxbtZ-mbjSc=@protonmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Subject: [bitcoin-dev] Hiding CoinSwap Makers Among Custodial Services
X-BeenThere: bitcoin-dev@lists.linuxfoundation.org
X-Mailman-Version: 2.1.15
Precedence: list
List-Id: Bitcoin Protocol Discussion <bitcoin-dev.lists.linuxfoundation.org>
List-Unsubscribe: <https://lists.linuxfoundation.org/mailman/options/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=unsubscribe>
List-Archive: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/>
List-Post: <mailto:bitcoin-dev@lists.linuxfoundation.org>
List-Help: <mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=help>
List-Subscribe: <https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev>,
<mailto:bitcoin-dev-request@lists.linuxfoundation.org?subject=subscribe>
X-List-Received-Date: Thu, 11 Jun 2020 11:51:17 -0000
Good morning Chris, and bitcoin-dev (but mostly Chris),
I made a random comment regarding taint on bitcoin-dev recently: https://li=
sts.linuxfoundation.org/pipermail/bitcoin-dev/2020-June/017961.html
> For CoinSwap as well, we can consider that a CoinSwap server could make m=
ultiple CoinSwaps with various clients.
> This leads to the CoinSwap server owning many small UTXOs, which it at so=
me point aggregates into a large UTXO that it then uses to service more cli=
ents (for example, it serves many small clients, then has to serve a single=
large client that wants a single large UTXO for its own purposes).
> This aggregation again leads to spreading of taint.
I want to propose some particular behaviors a SwapMarket maker can engage i=
n, to improve the privacy of its customers.
Let us suppose that individual swaps use some variant of Succinct Atomic Sw=
ap.
Takers take on the role of Alice in the SAS description, makers take on the=
role of Bob.
We may be able to tweak the SAS protocol or some of its parameters for our =
purposes.
Now, what we will do is to have the maker operate in rounds.
Suppose two takers, T1 and T2, contact the sole maker M in its first ever r=
ound.
T1 and T2 have some coins they want to swap.
They arrange things all the way to confirmation of the Alice-side funding t=
x, and pause just before Bob creates its own funding tx for their individua=
l swaps.
The chain now shows these txes/UTXOs:
42 of T1 ---> 42 of T1 & M
50 of T2 ---> 50 of T2 & M
100 of T1 ---> 100 of T1 & M
200 of M -
Now the entire point of operating in rounds is precisely so that M can serv=
ice multiple clients at the same time with a single transaction, i.e. batch=
ing.
So now M provides its B-side tx and complete the SAS protocols with each of=
the takers.
SAS gives unilateral control of the outputs directly to the takers, so we e=
lide the fact that they are really 2-of-2s below:
42 of T1 ---> 42 of T1 & M
50 of T2 ---> 50 of T2 & M
100 of T1 ---> 100 of T1 & M
200 of M +--> 11 of M
+--> 140 of T1
+--> 49 of T2
(M extracted 1 unit from each incoming coin as fee; they also live in a fic=
tional universe where miners mine transactions out of the goodness of their=
hearts.)
Now in fact the previous transactions are, after the SAS, solely owned by M=
the maker.
Now suppose on the next round, we have 3 new takers, T3, T4, and T5, who of=
fer some coins to M to CoinSwap, leading to more blockchain data:
42 of T1 ---> 42 of T1 & M
50 of T2 ---> 50 of T2 & M
100 of T1 ---> 100 of T1 & M
200 of M -+-> 11 of M
+-> 140 of T1
+-> 49 of T2
22 of T3 ---> 22 of T3 & M
90 of T3 ---> 90 of T3 & M
11 of T4 ---> 11 of T4 & M
50 of T4 ---> 50 of T4 & M
20 of T5 ---> 20 of T5 & M
In order to service all the new takers of this round, M takes the coins tha=
t it got from T1 and T2, and uses them to fund a new combined CoinSwap tx:
42 of T1 ---> 42 of T1 & M -+--+-> 110 of T3
50 of T2 ---> 50 of T2 & M -+ +-> 59 of T4
100 of T1 ---> 100 of T1 & M -+ +-> 14 of T5
+-> 9 of M
200 of M -+-> 11 of M
+-> 140 of T1
+-> 49 of T2
22 of T3 ---> 22 of T3 & M
90 of T3 ---> 90 of T3 & M
11 of T4 ---> 11 of T4 & M
50 of T4 ---> 50 of T4 & M
15 of T5 ---> 15 of T5 & M
That transaction, we can observe, looks very much like a batched transactio=
n that a custodial service might produce.
Now imagine more rounds, and I think you can begin to imagine that the magi=
c of transaction batching, ported into SwapMarket, would help mitigate the =
blockchain size issues that CoinSwap has.
Makers are expected to adopt this technique as this reduces the overall cos=
t of transactions they produce, thus they are incentivized to use this tech=
nique to increase their profitability.
At the same time, it spreads taint around and increases the effort that cha=
in analysis must go through to identify what really happened.
Regards,
ZmnSCPxj
|
