How much privacy is enough?
Evaluating tradeoffs in privacy and scalability

Ian Miers@secparam
Cornell Tech/ Zcash Foundation

Privacy enhancements: so many choices?

Bolt

Modified from Bitcoin Techniques and Politics
Arvind Narayanan, Malte Möser

2017

Privacy

Where does a given technique fall?

Efficiency/scalability

Evaluating privacy?
●●

Akin to evaluating privacy issues on the Internet in 1992
Cannot measure with empirical attacks
○○○

●
●

Almost all transactions are speculative
Limited usage in daily lives
Researchers have data, cost, and ethics limitations

Need to use thought experiments
To do so, we must understand realistic threatsSome Real World Privacy Threats

This is your threat model:

And thisFungibility:●●●

Freshly mined coins sell for a premium
Exchanges blocking customers based on transaction history
Exchanges are not mere third party observers:○○●

Know more than just the transaction graph
Make transactions on user’s behalf

Akin to being private on the internet while using Google/Gmail/Maps/Android

What are thedefenses?

In a world of AI/ML andtargeted ads, plausible
deniability is not aplausible defense.

Bolt

2017
Modified from Bitcoin Techniques and Politics
Arvind Narayanan, Malte Möser

Blockchain privacy is not intuitive.
●●

Only threat is NOT a third party passive observerMust consider active attackers who:
○
○
○

●

Receives payments from targeted users
Sends payments to targeted users
Interact with third parties

Consider obvious attacks:○○○

Merchants who try and track customers
Users who try and identify a recipients real identity
Exchanges who ban customers for certain transaction types

Bolt

2017
Modified from Bitcoin Techniques and Politics
Arvind Narayanan, Malte Möser

Privacy approaches●●Bitcoin (vanilla ): explicitly identify origin of payment
Decoy transaction based systems:○●Pick e.g. 5 decoy source transactions to hide real origin■ Coinjoin, Mimblewimble, etc. (decoys sampled from current transactions)■ Cryptonote/RingCT(e.g Monero, etc ) (decoys sampled from all of history)

Zerocoin and Zerocash like (e.g. Zcash, etc)○

Private transactions have no identified origin.

Payments in Bitcoin:

Blockchain

Payments in Decoy Systems (coinjoin/monero/etc)

Blockchain○○

Coinjoin, etc : decoy set sampled from current transactions
Cryptonote/RingCT(e.g Monero): decoy sampled from all ofhistory)

Decoy transactions

Payments in Zerocash

Blockchain

BitcoinCoinjoin/RingCT/etc

ZerocashAre decoy systems private?

Taint tree: possible ancestor payments

Taint free: following your money

Attacks

Tracking customers

Tracking customers

Tracking customers

Identifying anonymous merchants?
Bob’s deposited coins

Repeated interactions
with a malicious
sender/recipient aredangerous

Taint tree: following your money

Dust attack: confirming where money is spentDust attack: confirming where money is spentDust attack: confirming where money is spentDust attack: confirming where your money is spentDust attack: confirming where your money is spent

Limitations of decoy approaches:●

Customers can be tracked
○
○

●

●

Use of change transactions
Common origins in taint tree

Anonymous Merchants can be identified
Third parties can see where your money goes

Privacy approaches: perception●●NOT PRIVATE

Bitcoin (vanilla ): explicitly identify origin of payment
Decoy transaction based systems:○●

Pick e.g. 5 decoy source transactions to hide real origin■ Coinjoin, Mimblewimble, etc. (decoys sampled from current transactions)■ Cryptonote/RingCT(e.g Monero) (decoys sampled from all of history)

Zerocoin and Zerocash like (e.g. Zcash, etc)○

Private transactions have no identified origin.

PRIVATE

Privacy approaches: reality●●

Bitcoin (vanilla ): explicitly identify origin of payment
Decoy transaction based systems:○●

NOT PRIVATE

Pick e.g. 5 decoy source transactions to hide real origin■ Coinjoin, Mimblewimble, etc. (decoys sampled from current transactions)■ Cryptonote/RingCT(e.g Monero) (decoys sampled from all of history)

Zerocoin and Zerocash like (e.g. Zcash, etc)
○Private transactions have no identified origin.

PRIVATEIf you do use decoy schemes●

Decoy systems might work if○○○●

If your decoy set is very large (i.e. 5,000,000 instead of 5)
Decoy sets substantially overlap across all recent transactions
Decoys are sampled really carefully

But:
○
○
○

We need much more rigorous analysis
A careful understanding of when things failAcknowledge limitations

Scalable decoy schemes●●●Cannot have O(decoy set size) sized transactions
Need logarithmic scaling for size/ transaction generation
Use a Zerocash style system:
○○
○

●
●
●
●

Transactions outputs are commitments to (value, recipient address)
Merkle Tree over some fraction of UTXO set
Zk-proof that origin exists in the UTXO merkle tree.

Pick a zk-proof technology you like (zkSNARKs, bullet proofs, STARKs, MPCin head,etc)
Pick a merkle tree depth d that the zk circuit is efficientYour decoy set is now 2^dSomehow sample decoys securelyStrongly private protocols are getting faster2

Think critically about scalability vs privacy●Cryptocurrencies need some privacy solution:○○●

By all means prioritize scaling over privacy, but understand the limitations ofwhat you have:
○
○
○

●

Maybe on chain
Maybe in layer twoYour threat model isn’t just passive observers
Adding some privacy doesn’t make a protocol private
Attacks only get better

Privacy problems don’t magically go away with small tweaks

Questions?

Ian Miers@secparam
Cornell Tech/ Zcash foundation