JoinMarket-or-Finding a Risk-Free Rate for Bitcoin

Adlai Chandrasekhar
JoinMarket Contributor
Scaling Bitcoin 2016 - Milan

“Once, however, money has been digitized,
one of the services available for purchasecan be the anonymous transfer of funds."
Eric Hughes, 1994-08-03

“Once, however, money has been digitized,
one of the services available for purchasecan be the anonymous transfer of funds."
Eric Hughes, 1994-08-03

What is Privacy?

Anonymity is always within a set"Kid Sister" vs Government
Hiding vs Deniability

What is Privacy?

●Anonymity is always within a set"Kid Sister" vs Government
Hiding vs Deniability

What is Privacy?

●

Anonymity is always within a set●"Kid Sister" vs Government
Hiding vs Deniability

What is Privacy?

●

Anonymity is always within a set●"Kid Sister" vs Government●

Hiding vs Deniability

Prior Art (2011 - 2014)
Users attempt to unlink Bitcoins using altcoinsand centralized sites
Sites dedicated to unlinking, commonly known as"mixers" or "tumblers"
Greg Maxwell proposes CoinJoin and CoinSwap,(former gains limited traction, latter: none)
DarkWallet offers P2P CoinJoin but lacks
consistent liquidity (users must wait)Prior Art (2011 - 2014)●

Users attempt to unlink Bitcoins using altcoinsand centralized sites

Sites dedicated to unlinking, commonly known as"mixers" or "tumblers"
Greg Maxwell proposes CoinJoin and CoinSwap,(former gains limited traction, latter: none)
DarkWallet offers P2P CoinJoin but lacks
consistent liquidity (users must wait)Prior Art (2011 - 2014)●●

Users attempt to unlink Bitcoins using altcoinsand centralized sites
Sites dedicated to unlinking, commonly known
as "mixers" or "tumblers"

Greg Maxwell proposes CoinJoin and CoinSwap,(former gains limited traction, latter: none)
DarkWallet offers P2P CoinJoin but lacks
consistent liquidity (users must wait)Prior Art (2011 - 2014)●●●

Users attempt to unlink Bitcoins using altcoinsand centralized sites
Sites dedicated to unlinking, commonly known
as "mixers" or "tumblers"
Greg Maxwell proposes CoinJoin and CoinSwap,(former gains limited traction, latter: none)
DarkWallet offers P2P CoinJoin but lacks
consistent liquidity (users must wait)Prior Art (2011 - 2014)●●●

Users attempt to unlink Bitcoins using altcoinsand centralized sites
Sites dedicated to unlinking, commonly known
as "mixers" or "tumblers"
Greg Maxwell proposes CoinJoin and CoinSwap,(former gains limited traction, latter: none)●

DarkWallet offers P2P CoinJoin but lacks
consistent liquidity (users must wait)

The Simplest “Smart” Contract

JoinMarket Goals
No counterparty risk
Weak / Granular Privacy
Liquidity / High Availability
Compatible with Bitcoin protocol"Cypherpunks write code"

JoinMarket Goals●

No counterparty risk

Weak / Granular Privacy
Liquidity / High Availability
Compatible with Bitcoin protocol"Cypherpunks write code"

JoinMarket Goals●●

No counterparty risk

Weak / Granular Privacy

Liquidity / High Availability
Compatible with Bitcoin protocol"Cypherpunks write code"

JoinMarket Goals●●●

No counterparty risk

Weak / Granular Privacy

Liquidity / High Availability

Compatible with Bitcoin protocol"Cypherpunks write code"

JoinMarket Goals
●

●

●

●

No counterparty risk

Weak / Granular PrivacyLiquidity / High Availability

Compatible with Bitcoin protocol"Cypherpunks write code"

JoinMarket Goals
●

●

●

●

No counterparty risk

Weak / Granular Privacy

Liquidity / High Availability

Compatible with Bitcoin protocol●"Cypherpunks write code"

JoinMarket’s Innovation
Compensate participantion!

Incentivize availability
Attract additional liquidity

JoinMarket’s Innovation
Compensate participantion!

Incentivize availability
Attract additional liquidity

JoinMarket’s Innovation
Compensate participantion!

●

Incentivize availability

Attract additional liquidity

JoinMarket’s Innovation
Compensate participantion!

●●Incentivize availability

Attract additional liquidity

JoinMarket Roles
Participant / "Maker"

Initiator / "Taker"

Provides liquidity, earns fees

Pays fees to consume liquidity

Slight Privacy Gain

Larger Privacy Gain

Continuous Participation

Sporadic Participation

Merely signs provided TX

Coordinates and assembles TX

JoinMarket Roles
Participant / "Maker"

Initiator / "Taker"

Continuous Participation

Sporadic Participation

Merely signs provided TX

Coordinates and assembles TX

Provides liquidity, earns fees

Pays fees to consume liquidity

Slight Privacy Gain

Larger Privacy Gain

JoinMarket Roles
Participant / "Maker"

Initiator / "Taker"

Continuous Participation

Sporadic Participation

Merely signs provided TX

Coordinates and assembles TX

Provides liquidity, earns fees

Pays fees to consume liquidity

Slight Privacy Gain

Larger Privacy Gain

JoinMarket Roles
Participant / "Maker"

Initiator / "Taker"

Continuous Participation

Sporadic Participation

Merely signs provided TX

Coordinates and assembles TX

Provides liquidity, earns fees

Pays fees to consume liquidity

Slight Privacy Gain

Larger Privacy Gain

JoinMarket Roles
Participant / "Maker"

Initiator / "Taker"

Continuous Participation

Sporadic Participation

Merely signs provided TX

Coordinates and assembles TX

Provides liquidity, earns fees

Pays fees to consume liquidity

Slight Privacy Gain

Larger Privacy Gain

First JoinMarket Protocol
Participant / "Maker"

Initiator / "Taker"

Advertise liquidity and rate (publicly)
Send chosen offer, coinjoin amount,and encryption key
Reply with own encryption key
Messages beyond this point are encrypted
Send signature of encryption key
using input utxo pubkey
Send inputs, desired output andchange addresses (all signed)
Construct transaction using eachparticipant’s inputs and outputs
Sign constructed transaction
Sign and broadcast

First JoinMarket Protocol
Participant / "Maker"

Initiator / "Taker"

Advertise liquidity and rate (publicly)
Send chosen offer, coinjoin amount,and encryption key
Reply with own encryption key
Messages beyond this point are encrypted
Send signature of encryption key
using input utxo pubkey
Send inputs, desired output andchange addresses (all signed)Construct transaction using eachparticipant’s inputs and outputs
Sign constructed transaction
Sign and broadcast

First JoinMarket Protocol
Participant / "Maker"

Initiator / "Taker"

Advertise liquidity and rate (publicly)
Send chosen offer, coinjoin amount,and encryption key
Reply with own encryption key
Messages beyond this point are encrypted
Send signature of encryption key
using input utxo pubkey
Send inputs, desired output andchange addresses (all signed)
Construct transaction using eachparticipant’s inputs and outputs
Sign constructed transaction
Sign and broadcast

First JoinMarket Protocol
Participant / "Maker"

Initiator / "Taker"

Advertise liquidity and rate (publicly)
Send chosen offer, coinjoin amount,and encryption key
Reply with own encryption key
Messages beyond this point are encrypted
Send signature of encryption key
using input utxo pubkey
Send inputs, desired output andchange addresses (all signed)
Construct transaction using eachparticipant’s inputs and outputs
Sign constructed transaction
Sign and broadcast

First JoinMarket Protocol
Participant / "Maker"

Initiator / "Taker"

Advertise liquidity and rate (publicly)
Send chosen offer, coinjoin amount,and encryption key
Reply with own encryption key
Messages beyond this point are encrypted
Send signature of encryption key
using input utxo pubkey
Send inputs, desired output andchange addresses (all signed)
Construct transaction using eachparticipant’s inputs and outputs
Sign constructed transaction
Sign and broadcast

First JoinMarket Protocol
Participant / "Maker"

Initiator / "Taker"

Advertise liquidity and rate (publicly)
Send chosen offer, coinjoin amount,and encryption key
Reply with own encryption key
Messages beyond this point are encrypted
Send signature of encryption key
using input utxo pubkey
Send inputs, desired output andchange addresses (all signed)
Construct transaction using eachparticipant’s inputs and outputs
Sign constructed transaction
Sign and broadcast

First JoinMarket Protocol
Participant / "Maker"

Initiator / "Taker"

Advertise liquidity and rate (publicly)
Send chosen offer, coinjoin amount,and encryption key
Reply with own encryption key
Messages beyond this point are encrypted
Send signature of encryption key
using input utxo pubkey
Send inputs, desired output andchange addresses (all signed)
Construct transaction using eachparticipant’s inputs and outputs
Sign constructed transaction
Sign and broadcast

First JoinMarket Protocol
Participant / "Maker"

Initiator / "Taker"

Advertise liquidity and rate (publicly)
Send chosen offer, coinjoin amount,and encryption key
Reply with own encryption key
Messages beyond this point are encrypted
Send signature of encryption key
using input utxo pubkey
Send inputs, desired output andchange addresses (all signed)
Construct transaction using eachparticipant’s inputs and outputs
Sign constructed transaction
Sign and broadcast

First JoinMarket Protocol
Participant / "Maker"

Initiator / "Taker"

Advertise liquidity and rate (publicly)
Send chosen offer, coinjoin amount,and encryption key
Reply with own encryption key
Messages beyond this point are encrypted
Send signature of encryption key
using input utxo pubkey
Send inputs, desired output andchange addresses (all signed)
Construct transaction using eachparticipant’s inputs and outputs
Sign constructed transaction
Sign and broadcast

Leakage, Leakage, Leakage!
Initiator signs last… or not at all
Information learned during an incomplete
run of the protocol is thus free
Malicious initiator can snoop which coins areprovided by which participants
By June 2016, most initiations failed tocomplete (real usage also increased)Leakage, Leakage, Leakage!
●Initiator signs last… or not at all

Information learned during an incomplete
run of the protocol is thus free
Malicious initiator can snoop which coins areprovided by which participants
By June 2016, most initiations failed tocomplete (real usage also increased)Leakage, Leakage, Leakage!
●●

Initiator signs last… or not at all

Information learned during an incomplete
run of the protocol is thus free

Malicious initiator can snoop which coins areprovided by which participants
By June 2016, most initiations failed tocomplete (real usage also increased)Leakage, Leakage, Leakage!
●●●

Initiator signs last… or not at all

Information learned during an incomplete
run of the protocol is thus free
Malicious initiator can snoop which coins
are provided by which participants
By June 2016, most initiations failed tocomplete (real usage also increased)Leakage, Leakage, Leakage!
●●●

Initiator signs last… or not at all

Information learned during an incomplete
run of the protocol is thus free
Malicious initiator can snoop which coins
are provided by which participants●

By June 2016, most initiations failed tocomplete (real usage also increased)

Second JoinMarket Protocol
Same overall sequence as first version
Every message is signed
Takers a unique-per-UTXO commitment
before makers reveal inputs
Malicious snoop must create freshcommitments, putting a cost on the attack

Second JoinMarket Protocol●

Same overall sequence as first version
Every message is signed

Takers a unique-per-UTXO commitment
before makers reveal inputs
Malicious snoop must create freshcommitments, putting a cost on the attack

Second JoinMarket Protocol●

Same overall sequence as first version●

Every message is signed

Takers a unique-per-UTXO commitment
before makers reveal inputs
Malicious snoop must create freshcommitments, putting a cost on the attack

Second JoinMarket Protocol●

Same overall sequence as first version●

Every message is signed

Takers publish a unique-per-UTXO
commitment before makers reveal inputs●

Malicious snoop must create freshcommitments, putting a cost on the attack

Second JoinMarket Protocol●

Same overall sequence as first version●

Every message is signed

Takers publish a unique-per-UTXO
commitment before makers reveal inputs●

Malicious snoop must create freshcommitments, putting a cost on the attack●

Future Directions
Wallet Integrations (Electrum, Core)
Hybrid Mode (make while you take)
Interface Cleanup (API-ification)
Statistics on economic activity
Gauge privacy improvement
CoinSwapFuture Directions●

Wallet Integrations (Electrum, Core)
Hybrid Mode (make while you take)
Interface Cleanup (API-ification)
Statistics on economic activity
Gauge privacy improvement
CoinSwapFuture Directions●

Wallet Integrations (Electrum, Core)●

Hybrid Mode (make while you take)
Interface Cleanup (API-ification)
Statistics on economic activity
Gauge privacy improvement
CoinSwapFuture Directions●

Wallet Integrations (Electrum, Core)●

Hybrid Mode (make while you take)●

Interface Cleanup (API-ification)
Statistics on economic activity
Gauge privacy improvement
CoinSwapFuture Directions●

Wallet Integrations (Electrum, Core)●

Hybrid Mode (make while you take)●●

Interface Cleanup (API-ification)
Statistics on economic activity
Gauge privacy improvement
CoinSwapFuture Directions●

Wallet Integrations (Electrum, Core)●

Hybrid Mode (make while you take)●

Interface Cleanup (API-ification)
Statistics on economic activity●●

Gauge privacy improvement
CoinSwapFuture Directions●Wallet Integrations (Electrum, Core)●Hybrid Mode (make while you take)●Interface Cleanup (API-ification)
Statistics on economic activity●●Gauge privacy improvement●CoinSwap

THIS SLIDE LEFTINTENTIONALLY BLANK