Topic: Blind signatures for bitcoin transaction anonymity, by Watson Ladd (Read 3505 times)

It seems I had accidentally locked this topic, sorry!

Death&Taxes, thanks again for the posts.

OT-cash-only system is already "perfect anonymity" to me... not even the server can trace the transaction. That's practically as anonymous as a physical cash transactions. But I have the impression such level of anonymity is impossible to be implemented in "full p2p". Maybe one day the geniality of a "new Satoshi" will surprise us...

IIRC Open Transactions features anonymous digital cash using blinded signatures. The catch is that the blinded signing has to be performed by an entity (the server) trusted by all involved parties. However, this blind signer doesn't need to know who is sending what to whom - you can operate "cash only" without so much as a pseudonym.

Bitcoins COULD still be tracked based on the size of inputs/outputs (like any other mixing service) but you could manually control the mixing process yourself.

Don't take my word for it, though... Most of what I've discovered so far is how much I have left to learn.

For the record I am not advocating building such a system.  I am just pointing out some ideas that could improve anonymity of crypto currencies in general.  Bitcoin likely can't be improved much because anonymity must be handled at a fundamental level.

Hopefully Bitcoin will remain viable despite its limits on fungibility and the the never ending ambitions of the taint zealouts to destroy that fungibility.

If it does fail then such discussions will be less academic as I would hope crypto 2.0 would seek to expand on Bitcoins limitations.

"cointumbler" type services are too limited IMHO to provide much real anonymity.  You also need to trust them.  You need to trust they won't steal your coins or give your info to law enforcement.  You need to hope they have enough "legit" volume to blend the tx (and who sends legit coins to a mixing service?) Multi-sig and double blind are part of the "solution".

As far as aggregators being like instawallet I think I was unclear.  With instawallet you have no control over your private key and most tx don't go through instawallet.  Instawallet still relies on the blockchain and current broadcast to all method of propogating txs.  Instawallet knows your inputs and output and broadcasts those details to the entire network.

When I am talking about aggregators I am talking about a fundamental change in how tx are processed.  All nodes would have the capability to aggregate tx (possibly for a fee), handle the multi-party signing and broadcast the unified tx for inclusion in a block.  Most likely wouldn't and instead would just pass tx components, unified tx, and blocks around the network.    Since all tx would be processed this way double-blind tx wouldn't show up as "special".  The tx one was looking to keep "secret" would be in a sea of other tx and "unified" with dozens of unrelated tx components.  You may ask why not just have the miner (and by extension pool) handle this.  They most likely would but some may want to have a different party handle the aggregation.

Psuedo communicaiton code would be something like this:

Sender 1 -> Aggregator (tx components:  list of inputs, double blind outputs, and fee designated for aggregator)
Sender 2 -> Aggregator (tx components:  list of inputs, double blind outputs, and fee designated for aggregator)
...
Sender n -> Aggregator (tx components:  list of inputs, double blind outputs, and fee designated for aggregator)

Aggregator combines all inputs and outputs, adds an output for its fee.

Aggregator -> Sender 1 (unsigned unified tx)
Sender 1 verifies and signs
Sender 1 -> Aggregator (signed unified tx)

Aggregator -> Sender 2 (unified tx signed by sender 1)
Sender 2 verifies and signs
Sender 2 -> Aggregator (unified tx signed by sender 1 & 2)

...
Sender n -> Aggregator (unified tx signed by all parties)

Aggegator -> Entire network (signed unified tx)

Thank you DnT, very informative as always!

So, the current option to use a cointumbler (everyone sends bitcoin there, bitcoin are mixed, everyone gets random bitcoin back) isn't that far from the (bitcoin-possible) optimum, and the proposal in the paper would not add significant anonymity, if any..?
Basically, the part about aggregators reads almost the same as instawallet to me.

Ente

I put this in a separate post because it is semi off-topic.

Perfect anonymity is most likely impossible given the constraints of digital systems.  The only place perfect anonymity would exist is where the currency is perfectly fungible, can be accurately verified.  Only then is it possible to transact safely without records.   An example would be identical physical coins with no deviation (dates, variations, serial #s, etc) where all coins in circulation are in perfect condition and all can be accurately and instantly evaluated as authentic.   Such a system probably is impossible without nanotechnology and probably would involve exotic material.  You could use synthetic isotopes which can't be created without significant cost (think physical hashing) and which can be identified by unique (low level) radioactive signature.  


Outside of that anonymity can only be improved it can't ever be perfect.  Adding significant anonymity to the current protocol is hindered by the block chain design.  Futher anonymity likely requires a new design for recording txs.

For example imagine the blockchain separated "sends" from "redeems" in a double blind system.  Sends would go into one block and then they would be redeemed in another block.  This would have other useful implications.  Sends could have an expiration date in blocks.  If the coins were sent to an invalid address or the recipient has lost the private key it would never be redeemed and the tx would be canceled.  

Now if signing of blocks was done as it is now anonymity would be improved BUT there would be significant limits.  The boundary of the improved anonymity is the tx boundry.  While the outputs are double blind one can still link an input to a set of outputs.

Now imagine instead of sending tx directly to miners there was an interim party.  Entities on the network called aggregators.   One would be splitting the role of tx processing, collecting and block signing.  Major pools likely would also be their own aggregator but that wouldn't be a requirement.

Instead of sending the signed tx to an aggregator your node would send just the inputs and the double-blind outputs.  The aggregator would take your input and the inputs of dozens or hundreds of others and create a single mult-sig tx, send it back to all participants to sign and then broadcast the "unified tx" to the network.   Thus the rest of the network only sees the unified tx (imagine a block where all the tx are combined).

Even here we don't have perfect anonymity.  The aggegator knows the inidividual "pieces".  That entity could break your trust.  This is similar to a VPN provider.  While your ISP doesn't know what you are doing the VPN provider does and if they decide to break your trust they have a complete log of your activities.  Still if one chooses the aggregator wisely the # of entities which know the "secrets" is limited.


Summary:
Current Protocol - very distinct link between inputs, output, and identity
Paper's proposal - improvement because identity is obfuscated from output, scope is limited because it is a "special" (and thus likely not often used) tx.
Blockchain based on "double blind" - tx you are looking to "hide" blends in because all tx are double blind.  the ambiguity is limited to tx boundry
Adding aggregators - allows creation of unified txs (either by miner or by trusted third party).  Anonymity significantly improved because scope of those who know the "secret" it limited.
...
?
...
?
...
Perfect anonymity

can it be taken further?  maybe.  It might be possible to involve 2 or more aggregators so that neither one can reconstruct the tx on their own.  This would require collusion between multiple trusted parties.   Some might not like the idea of trusted parties but the trust would be optional.  The only thing you are trusting is they won't share the tx components.  If they did it would be no worse than now (when every node knows every component of every tx).  Parties who don't care could send tx to all nodes for aggregation.  Parties who do care could be selective in which nodes they communicate with.

Well traceability is improved but it isn't untraceable.  Bitcoin simply can't be untraceable.  Preventing double spend requires identifying the prior tx and ensuring that no equivalent tx already exists.

That being said nothing is untraceable.  If the US govt wanted to could they could require ID with every cash tx and install serial # readers at every merchant.  With a swipe of the ID, and a scan of the bills (in and out) one could build a map of every dollar and exactly where it went, by whom, and when.

Making inputs and outputs loosely coupled makes using that tracing more difficult and makes coin laundry services more comprehensive.


Hum, doesn't that already happen when one makes a send-many transaction? I supposed you used the word "loosely" to mean something particular....