Wasabi Research Club #6 - Coinshuffle++ with Tim Ruffing (Part 2)
Channel: Wasabi Wallet
Date: 11/02/2020

In today's episode Tim Ruffing explores the concept of disruption in the Coinshuffle++ protocol and how it can be detected. He explains that the protocol passively observes messages and their outcomes, without knowing which message belongs to each participant. The speaker also discusses the practicality of blocking someone from the protocol, mentioning the role of network setting and the potential power of an attacker. Additionally, Ruffing highlights the importance of multiple communication rounds, protocols for key exchange, and the need for peers to verify if the protocol has been disrupted. Further Tim explains the concept of introducing another broadcast round in Coinshuffle++ to avoid disruption. By replacing one broadcast with another, the protocol ensures that if one message is disrupted, all messages are disrupted. This eliminates the need for a broadcast round to check for disruption, as participants can simply look at the list of messages and determine if their own message is there or not. This approach provides a guarantee of message integrity without additional broadcasts. Ruffing also addresses the limitations of Coinshuffle++, such as the lack of privacy in transactions with unequal inputs and the inability to pay while mixing. He discusses potential solutions for the anonymity of payments and emphasizes the benefits of Coinshuffle++ for coin shuffling. The timing and trust aspects of the protocol are also discussed, with a mention of potential delays and the need to trust other peers. Overall, Coinshuffle++ offers improvements in message integrity and coin mixing, but there is room for further development in addressing certain limitations and ensuring robust anonymity.

Topic: In this meeting we discussed CoinShuffle++ with one of the authors, Tim Ruffing.

Wasabi Research Club playlist:
https://www.youtube.com/playlist?list=PLPwc75tPMdsgTYlu9dJZlosCm0s7WmIpF
Join The Wasabikas Highlights playlist: https://youtube.com/playlist?list=PLPwc75tPMdsjpqK1YHYYG5b55M6Y--6Qd
Join The Wasabikas full episodes playlist: https://youtube.com/playlist?list=PLPwc75tPMdsixsuhwau82Q0IfxECo0z_E
Website: https://WasabiWallet.io
Blog: https://blog.WasabiWallet.io
Documentation: https://docs.WasabiWallet.io
GitHub: https://github.com/zkSNACKs/WalletWasabi
Podcast: https://anchor.fm/Wasabikas
YouTube: https://youtube.com/c/WasabiWallet

01:00 How Bitcoin transactions work.

01:39 Main privacy issues.

02:23 Transaction graph analysis.

02:45 Big picture of privacy technologies.

04:20 Coin mixing.

05:16 Peer-to-peer mixing.

06:16 P2P trust model. / Anonymity Set in the presence of adversaries.

07:45 Termination in the presence of malicious users.

09:00 How does CoinShuffle++ work? / DC-net (Chaum, CRYPTO '88).

12:12 DC-nets in practice.

15:54 Slot assignment.

17:48 Alphabetic ordering of public keys for slot assignment.

19:07 Why are finite fields needed?

19:57 Slot reservation. / Multiple messages (BB, EC'89).

21:02 Why doesn't Alice lose anonymity on broadcast of m_1 in slot 1?

23:41 Sum of messages over finite-fields. / Power sums.

27:25 Disruption.

29:07 Why Coinshuffle++ works. / Flowchart of CoinShuffle++

31:53 Validating Bitcoin addresses instead of messages.

41:30 "Fresh" vs. "Fixed" input messages.

42:38 Features of P2P mixing protocols.

43:23 Define termination.

44:35 Wasabi does not guarantee termination.

47:10 Is identifying the malicious peer a requirement for termination. / Dissent (CCS'10).

50:02 CoinShuffle++ is a circular protocol.

50:39 Anonymity attack on Dissent Protocol.

56:13 How practical is it to block an adversary from the protocol.

58:38 Broadcast rounds.

01:04:22 Example execution.

01:09:10 Practical evaluation of CoinShuffle++.

01:10:00 Handling unequal inputs.

01:15:19 Mixing and paying simultaneously.

01:22:13 Double-spend attack.

01:26:30 CoinShuffle++ with arbitrary numbers of malicious users.