Chris Belcher [ARCHIVE] on Nostr: 📅 Original date posted:2020-06-02 📝 Original message:Hello ZmnSCPxj, On ...
📅 Original date posted:2020-06-02
📝 Original message:Hello ZmnSCPxj,
On 31/05/2020 03:30, ZmnSCPxj via bitcoin-dev wrote:
> Good morning Ruben and Chris,
> I am not in fact convinced that PayJoin-with-CoinSwap adds *that* much privacy.
>
> These transactions:
>
> +---+ +---+
> Alice ---| |--| |--- Bob
> Alice ---| | | |
> Bob ---| | +---+
> +---+
>
> Are not really much different in coin ownership analysis from these:
>
> +---+ +---+
> Alice ---| |----| |--- Bob
> Alice ---| | +--| |
> +---+ | +---+
> Bob ---------+
The main benefit of PayJoin-with-CoinSwap is it breaks the
common-input-ownership heuristic, which is a major widely used
heuristic. It would be a big win if that heuristic could be broken.
PayJoin-with-CoinSwap would be useful if Alice is trying to recover some
privacy which was previously degraded, for example if she is spending
from a reused address or from an address linked to her identity. If she
does a PayJoin with the reused address then some other economic entity
would have his activity linked with Alice's.
Just the fact that PayJoin-with-CoinSwap exists would improve privacy
for people who don't use it, for example if someone buys bitcoin from an
exchange that knows their identity and then co-spends it with other
coins they obtained another way. The fact that PayJoin exists means an
adversary cannot assume for sure that this user really owns that other
address which was co-spent. This doesn't apply for regular CoinSwap,
which only ever breaks the transaction graph heuristic, so in our
example the destination the coins are sent *to* would be uncertain, but
that the co-spent inputs are owned by the same person would be certain
in a world where PayJoin didn't exist.
> It also removes the need for Bob to reveal additional UTXOs to Alice during the swap protocol; yes PoDLE mitigates the privacy probing attack that Alice can mount on Bob, but it is helpful to remember this is "only" a mitigation.
Opening up the possibility of spying for free is a real downside for
PayJoin-with-CoinSwap. Using decoy UTXOs as described in my design
document, rather than PoDLE, seems like a better way of resisting these
attacks. This is because at the cost of a little bit more bandwidth and
CPU its possible to make the probability of an attacker successfully
guessing the maker's real UTXOs to be as low as you want.
> But S6 has the mild advantage that all the funding transactions paying to 2-of-2s *can* appear on the same block, whereas chaining swaps will have a particular order of when the transactions appear onchain, which might be used to derive the order of swaps.
On the other hand, funds claiming in S6 is also ordered in time, so
someone paying attention to the mempool could guess as well the order of
swaps.
I think this is wrong, and that it's possible for the funding
transactions of chained/routed swaps to all be in the same block as well.
In CoinSwap it's possible to get DOS'd without the other side spending
money if you broadcast your funding transaction first and the other side
simply disappears. You'd get your money back but you have to waste time
and spend miner fees. The other side didn't spend money to do this, not
even miner fees.
>From the point of view of us as a maker in the route, we know we won't
get DOS'd like this for free if we only broadcast our funding
transaction once we've seen the other side's funding transaction being
broadcast first. This should work as long as the two transactions have a
similar fee rate. There might be an attack involving hash power: If the
other side has a small amount of hash power and mines only their funding
transaction in a manner similar to a finney attack, then our funding
transaction should get mined very soon afterwards by another miner and
the protocol will continue as normal. If the other side has knowledge of
the preimage and uses it to do CPFP and take the money, then we can
learn that preimage and do our own CPFP to get our money back too.
So in a routed coinswap setup it should be possible for Alice the taker
to broadcast her funding transaction first, which will lead to all the
makers broadcasting their funding transactions as well once they see the
other side has broadcast first. Then it would be possible for all those
funding transactions to be confirmed in the same block.
I hope I haven't missed anything, because if this doesn't work and each
maker must wait for confirmations, then the UX of routed CoinSwap would
degrade: a CoinSwap route of 5 makers would require at least 5 blocks to
be mined.
Of course this setup can leak the ordering of the routes because the
funding transaction would appear in the mempool in that order, but this
could be beaten if some Alices choose to intentionally spread out the
funding transaction broadcasts among multiple blocks for privacy reasons.
An interesting tangent could be to see if it's possible to make private
key handover work with S6. A nice side-effect of private key handover is
that the transfer of possession of the coins happens off-chain, so then
paying attention to the mempool won't help an adversary much.
Regards,
Chris Belcher
Published at
2023-06-07 18:25:00Event JSON
{
"id": "f454ab38f840af12ddd0ae25df934b7e10f2f8d14a67e42c00c5d99388b60d8c",
"pubkey": "cd99305dce8f7a8772455d28d44a8451787c19b2ffd2c8b1010acecc3c5f95c7",
"created_at": 1686162300,
"kind": 1,
"tags": [
[
"e",
"812ea09327d0d60318e0dbb8828e39487ff300b44ffb16833385faf46e010f8f",
"",
"root"
],
[
"e",
"75296e8d8814cb40a45251f3330eaad6aa6524b32a75a7c5584fd5a85b1a6687",
"",
"reply"
],
[
"p",
"c4c73e48c7d7f313938a90d71ff5e4be5d01dd4157f98ed99adf14737bfb78e0"
]
],
"content": "📅 Original date posted:2020-06-02\n📝 Original message:Hello ZmnSCPxj,\n\nOn 31/05/2020 03:30, ZmnSCPxj via bitcoin-dev wrote:\n\u003e Good morning Ruben and Chris,\n\n\u003e I am not in fact convinced that PayJoin-with-CoinSwap adds *that* much privacy.\n\u003e \n\u003e These transactions:\n\u003e \n\u003e +---+ +---+\n\u003e Alice ---| |--| |--- Bob\n\u003e Alice ---| | | |\n\u003e Bob ---| | +---+\n\u003e +---+\n\u003e \n\u003e Are not really much different in coin ownership analysis from these:\n\u003e \n\u003e +---+ +---+\n\u003e Alice ---| |----| |--- Bob\n\u003e Alice ---| | +--| |\n\u003e +---+ | +---+\n\u003e Bob ---------+\n\nThe main benefit of PayJoin-with-CoinSwap is it breaks the\ncommon-input-ownership heuristic, which is a major widely used\nheuristic. It would be a big win if that heuristic could be broken.\n\nPayJoin-with-CoinSwap would be useful if Alice is trying to recover some\nprivacy which was previously degraded, for example if she is spending\nfrom a reused address or from an address linked to her identity. If she\ndoes a PayJoin with the reused address then some other economic entity\nwould have his activity linked with Alice's.\n\nJust the fact that PayJoin-with-CoinSwap exists would improve privacy\nfor people who don't use it, for example if someone buys bitcoin from an\nexchange that knows their identity and then co-spends it with other\ncoins they obtained another way. The fact that PayJoin exists means an\nadversary cannot assume for sure that this user really owns that other\naddress which was co-spent. This doesn't apply for regular CoinSwap,\nwhich only ever breaks the transaction graph heuristic, so in our\nexample the destination the coins are sent *to* would be uncertain, but\nthat the co-spent inputs are owned by the same person would be certain\nin a world where PayJoin didn't exist.\n\n\u003e It also removes the need for Bob to reveal additional UTXOs to Alice during the swap protocol; yes PoDLE mitigates the privacy probing attack that Alice can mount on Bob, but it is helpful to remember this is \"only\" a mitigation.\n\nOpening up the possibility of spying for free is a real downside for\nPayJoin-with-CoinSwap. Using decoy UTXOs as described in my design\ndocument, rather than PoDLE, seems like a better way of resisting these\nattacks. This is because at the cost of a little bit more bandwidth and\nCPU its possible to make the probability of an attacker successfully\nguessing the maker's real UTXOs to be as low as you want.\n\n\u003e But S6 has the mild advantage that all the funding transactions paying to 2-of-2s *can* appear on the same block, whereas chaining swaps will have a particular order of when the transactions appear onchain, which might be used to derive the order of swaps.\nOn the other hand, funds claiming in S6 is also ordered in time, so\nsomeone paying attention to the mempool could guess as well the order of\nswaps.\n\nI think this is wrong, and that it's possible for the funding\ntransactions of chained/routed swaps to all be in the same block as well.\n\nIn CoinSwap it's possible to get DOS'd without the other side spending\nmoney if you broadcast your funding transaction first and the other side\nsimply disappears. You'd get your money back but you have to waste time\nand spend miner fees. The other side didn't spend money to do this, not\neven miner fees.\n\n\u003eFrom the point of view of us as a maker in the route, we know we won't\nget DOS'd like this for free if we only broadcast our funding\ntransaction once we've seen the other side's funding transaction being\nbroadcast first. This should work as long as the two transactions have a\nsimilar fee rate. There might be an attack involving hash power: If the\nother side has a small amount of hash power and mines only their funding\ntransaction in a manner similar to a finney attack, then our funding\ntransaction should get mined very soon afterwards by another miner and\nthe protocol will continue as normal. If the other side has knowledge of\nthe preimage and uses it to do CPFP and take the money, then we can\nlearn that preimage and do our own CPFP to get our money back too.\n\nSo in a routed coinswap setup it should be possible for Alice the taker\nto broadcast her funding transaction first, which will lead to all the\nmakers broadcasting their funding transactions as well once they see the\nother side has broadcast first. Then it would be possible for all those\nfunding transactions to be confirmed in the same block.\n\nI hope I haven't missed anything, because if this doesn't work and each\nmaker must wait for confirmations, then the UX of routed CoinSwap would\ndegrade: a CoinSwap route of 5 makers would require at least 5 blocks to\nbe mined.\n\nOf course this setup can leak the ordering of the routes because the\nfunding transaction would appear in the mempool in that order, but this\ncould be beaten if some Alices choose to intentionally spread out the\nfunding transaction broadcasts among multiple blocks for privacy reasons.\n\nAn interesting tangent could be to see if it's possible to make private\nkey handover work with S6. A nice side-effect of private key handover is\nthat the transfer of possession of the coins happens off-chain, so then\npaying attention to the mempool won't help an adversary much.\n\n\nRegards,\nChris Belcher",
"sig": "c6d271bcf80953fe29ebc8c447b021b5ebeb1979494141dae0c01f3c527d9efdfb66e2535b3bb655e3b9163f38b474d5405836b57720f1ead7e914cebff36272"
}