CoinParty: Secure Multi-Party Mixing of Bitcoins

[humanitee]

https://www.comsys.rwth-aachen.de/fileadmin/papers/2015/2015-ziegeldorf-codaspy-coinparty.pdf

I'm only about 1/3 through it - I skipped to the parts that interested me, but this seems thoroughly awesome. Very nice work.

 

[Windowly]

Wow pretty fascinating.

I love the fact that they have taken away the need for transaction fees. (The coin mixer in dark wallet for example, need transaction fees.) And it's more anonymous than Coinjoin.They write that:

Improved anonymity: To outsiders and the fellow mixing participants observing the blockchain, CoinParty’s threshold transactions are indistinguishable from other non-threshold transactions. Thus, CoinParty’s mixing transactions are anonymous among all contemptuous transactions with the same value. We conduct a quantitative analysis on the blockchain to show that this increases anonymity by orders of magnitude.

Plausible deniability: In [9] the authors briefly mention deniability as one desirable property for mixings. CoinParty is first among related approaches for mixing Bitcoins to provide its users with plausible deniability.

No fees: CoinParty issues multiple small transactions that do not require transaction fees. Since CoinParty is run in absence of any trusted third party, i.e., a service provider, no mixing fees are charged either. Related approaches require at least transaction or mixing fees.

Applicability: CoinParty is fully compatible with the existing Bitcoin network. We evaluate a proof-of-concept implementation in a real-world network setting to show that CoinParty incurs only small overheads even when scaling to large numbers of participants.
​

On the fees they write specifically:

Transaction fees. Unlike other decentralized Bitcoin mixing protocols, CoinParty does not bundle mixing transactions into one joint transaction with many inputs and outputs. Instead, CoinParty issues one transaction with one input and a few outputs per mixing input, i.e., n separate transactions. As of today, Bitcoin transactions smaller than 1 KB can be safely sent without fees [7]. Transactions in CoinParty do not exceed this size and would not require any transaction fees at all. If desired, transaction fees τ can be paid nevertheless. Input peers then commit at least ν +τ funds to Ti but only ν funds are transferred in the mixing transaction Ti ν→ Oπ(i).
​

I wonder how hard it would be to set something like this up. I would definitely use it on a regular basis.

 

[Justus Ranvier]

I love the fact that they have taken away the need for transaction fees. (The coin mixer in dark wallet for example, need transaction fees.) And it's more anonymous than Coinjoin.They write that:

I don't think "no fee" mixing is ever going to be practical or reliable.

In order to perform joins, you need people who provide liquidity. Providing liquidity accrues both risk and opportunity cost. If that cost is not paid for, then the makers never show up.

JoinMarket got this right.

 

[Windowly]

@Justus Ranvier There shouldn't be any risk to provide liquidity.

I assume some people will offer liquidity at a cost, and some will do it for altruistic reasons. (I would definitely be willing to provide liquidity for altruistic reasons.)

Regardless, the competition will drive the mixing costs towards zero.

 

[Zangelbert Bingledack]

@Windowly

Not toward zero, but toward the opportunity cost of having those coins tied up, essentially the market interest rate (plus risk factors, though those may be negligible), because while your coins are tied up in joins, you miss out on the interest those coins could be earning for you if they were loaned out. Or more simply, if 10% of your coins are continually in joins, you can only have 90% of your coins continually available to do something else.

Now this cost will be very low, of course, so free might not really matter.

 

[Justus Ranvier]

@Justus Ranvier There shouldn't be any risk to provide liquidity.

There is always risk associated with having Bitcoins in a hot wallet.

Regardless, the competition will drive the mixing costs towards zero.

This is fine. Fixing the price at zero by protocol isn't.

 

[Windowly]

@Justus Ranvier It's not fixed by the protocol, at least how I read the paper.