Wasabi Research Club #8 - CashFusion with Jonald Fyookball & Ethan Heilman (Part 2)
Channel: Wasabi Wallet
Date: 25/02/2020

In today's episode we discuss various aspects of CashFusion, including the complexity of analyzing input-output pairs, the privacy implications of different coin join scenarios, the rejection of the knapsack cryptosystem, and the concept of plausible deniability. They also touch on the birthday problem, the interpretation of an article on CashFusion, the number of valid partitions in a coin join, fungibility, and the challenges of maintaining privacy in CoinJoin transactions. The participants propose solutions for mitigating attacks and emphasize the importance of balancing privacy and regulation. Further research is encouraged to fully understand the privacy implications and security of CashFusion. Additional information on specific attacks can be found on the Wasabi Research Club and Bitcoin dev mailing list. Later on the conversation focuses on various attack vectors on CashFusion and potential mitigation strategies. The speakers discuss the importance of adding randomness and reducing precision in output amounts to protect against attacks. They also explore the idea of restricting the Hamming weight as a more robust mitigation strategy. They acknowledge that while these mitigations may address certain attack vectors, further consideration is needed to mitigate more advanced attacks. The speakers also discuss concepts such as fuzzing, plausible deniability, and infusion, highlighting their importance in improving privacy and consistency. They touch on the evolution of CashFusion from fusing inputs into outputs to becoming a many-to-many coin joint, as well as the need to address issues such as coin selection and wallet usability. They also emphasize the importance of privacy and potential future developments, while acknowledging the complexity and potential risks involved.

Topic: Naive CoinJoins

Special Guests: Jonald Fyookball, Ethan Heilman
CashFusion/Avoiding Amount Linkages Through Combinatorics - https://github.com/cashshuffle/spec/blob/master/CASHFUSION.md#avoiding-amount-linkages-through-combinatorics
Jonald Fyookball: Analyzing the Combinatoric Math in CashFusion - https://read.cash/@jonald_fyookball/analyzing-the-combinatoric-math-in-cashfusion-29943fb7
James Waugh: Is CashFusion Really Anonymous? - https://medium.com/@james.waugh28/is-cashfusion-really-anonymous-352164a071c2
bitcoin-dev mailing list: Non-equal value CoinJoins. (last thread) - https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-December/thread.html

Wasabi Research Club playlist:
https://www.youtube.com/playlist?list=PLPwc75tPMdsgTYlu9dJZlosCm0s7WmIpF
Join The Wasabikas Highlights playlist: https://youtube.com/playlist?list=PLPwc75tPMdsjpqK1YHYYG5b55M6Y--6Qd
Join The Wasabikas full episodes playlist: https://youtube.com/playlist?list=PLPwc75tPMdsixsuhwau82Q0IfxECo0z_E
Website: https://WasabiWallet.io
Blog: https://blog.WasabiWallet.io
Documentation: https://docs.WasabiWallet.io
GitHub: https://github.com/zkSNACKs/WalletWasabi
Podcast: https://anchor.fm/Wasabikas
YouTube: https://youtube.com/c/WasabiWallet

00:00 Introduction

01:23 Weekly recap

01:54 Problem statement. / arbitrary outputs, arbitrary amounts

03:44 Example: CashFusion CoinJoin. / Passive observer

06:31 Bell number: the number of ways a set can be partitioned

09:26 Subset sum problem

12:04 Jonald Fyookball's comments. / Stirling numbers

15:47 Ethan's comments. / Worst-case vs. best-case analysis

18:16 Can we calculate a range for inputs?

19:32 Merkle–Hellman knapsack cryptosystem (1978)

22:12 Bell numbers as security parameters / Subset sum is a search problem / Linear programming

26:41 Number of solutions is the privacy gained

27:34 Heuristics for analysing Wasabi. / Change outputs. / Plausible deniability

29:55 Birthday paradox

32:11 Definition of plausible deniability. / Additive combinatorics

35:03 Weak plausible deniability

38:11 Does the coordinator know which outputs belong to which users?

41:31 How well links are broken

46:35 How much privacy is needed?

48:45 Minimum privacy

50:03 Largest input, largest output attack

50:41 How do you get insights into which inputs go together?

52:40 Equal and unequal outputs in one transaction

54:00 Using CashFusion. / Is amount-splitting needed

55:51 Attacks. / Mitigating largest input, largest output problem

58:06 Precision attack. / Randomisation in the fees

01:01:44 Is it easy to mitigate the precision attack?

01:04:13 Hamming weight.

01:06:45 Attack 2 on non-equal value Coinjoins.

01:11:15 Does the tumbler know how many inputs and outputs each player got?

01:13:34 SharedCoin (2013). / Coinjoin Sudoku (Kristov Atlas).

01:16:21 How was CashFusion intended to work?

01:21:35 Does the software limit outputs from past fusions in future fusions? / Users with a small utxo set.

01:23:07 Might CashFusion be ported to Bitcoin?

01:25:01 Samourai Wallet: Ricochet, Stowaway.

01:26:17 How to make sure the tumbler is not lying about its parameters.

01:29:00 Conclusion.