Deanonymization and linkability of transactions based on network - PowerPoint PPT Presentation

Deanonymization and linkability of cryptocurrency Deanonymization and linkability of transactions based on network analysis cryptocurrency transactions based on Biryukov, Tikhomirov network analysis Introduction Tx clustering Parallel connections Alex Biryukov, Sergei Tikhomirov Weighting timestamp vectors Correlation matrix Measuring anonymity University of Luxembourg Experiments Estimating the source IP 17 June 2019 Discussion Euro S&P Conclusion Stockholm, Sweden 1/39

Deanonymization Outline and linkability of cryptocurrency transactions based on network analysis Introduction Biryukov, Tikhomirov Transaction clustering Introduction Parallel connections Tx clustering Parallel connections Weighting timestamp vectors Weighting timestamp vectors Correlation matrix Correlation matrix Measuring anonymity Measuring anonymity Experiments Estimating the source IP Experimental results Discussion Estimating the source IP Conclusion Discussion Conclusion 2/39

Deanonymization Outline and linkability of cryptocurrency transactions based on network analysis Introduction Biryukov, Tikhomirov Transaction clustering Introduction Parallel connections Tx clustering Parallel connections Weighting timestamp vectors Weighting timestamp vectors Correlation matrix Correlation matrix Measuring anonymity Measuring anonymity Experiments Estimating the source IP Experimental results Discussion Estimating the source IP Conclusion Discussion Conclusion 3/39

Deanonymization Bitcoin and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction Tx clustering Parallel connections Weighting timestamp vectors Correlation matrix Measuring anonymity Experiments ◮ The first to solve double-spending with proof-of-work Estimating the source IP Discussion Conclusion ◮ Senders broadcast transactions into a P2P network ◮ Miners construct blocks (thus confirming transactions) 4/39

Deanonymization Privacy in Bitcoin and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction Tx clustering ◮ Transactions not linked to ”real-world” identity Parallel connections Weighting timestamp vectors Correlation matrix ◮ Users can generate as many key pairs as they wish Measuring anonymity Experiments Estimating the source IP ◮ False sense of privacy? Discussion Conclusion 5/39

Deanonymization Taint analysis heuristics and linkability of cryptocurrency transactions based on network analysis ◮ All transaction inputs probably belong to the sender Biryukov, Tikhomirov ◮ One output probably also belongs to the sender Introduction Tx clustering Parallel connections Weighting timestamp vectors Correlation matrix Measuring anonymity Experiments Estimating the source IP Discussion Conclusion Figure: Bitcoin transaction structure 6/39

Deanonymization Privacy coins hinder blockchain analysis... and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Dash: mixing by masternodes Introduction ◮ Tx clustering Parallel connections Weighting timestamp vectors Correlation matrix Measuring anonymity Experiments Monero: ring signatures Estimating the source IP ◮ Discussion Conclusion Zcash: zk-SNARKs ◮ 7/39

Deanonymization ...but what about network analysis? and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction Tx clustering ◮ How do messages propagate through the network? Parallel connections Weighting timestamp vectors Correlation matrix ◮ What does a well-connected adversary learn? Measuring anonymity Experiments Estimating the source IP ◮ Is it possible to link txs by the same user? Discussion Conclusion 8/39

Deanonymization Our contributions and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction Tx clustering ◮ We introduce a new transaction clustering method Parallel connections Weighting timestamp based on weighted vectors of IP addresses vectors Correlation matrix Measuring anonymity ◮ We validate our method with experiments on Bitcoin Experiments Estimating the source IP and three major privacy-focused cryptocurrencies Discussion Conclusion 9/39

Deanonymization Outline and linkability of cryptocurrency transactions based on network analysis Introduction Biryukov, Tikhomirov Transaction clustering Introduction Parallel connections Tx clustering Parallel connections Weighting timestamp vectors Weighting timestamp vectors Correlation matrix Correlation matrix Measuring anonymity Measuring anonymity Experiments Estimating the source IP Experimental results Discussion Estimating the source IP Conclusion Discussion Conclusion 10/39

Deanonymization Message propagation in Bitcoin and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction Tx clustering Parallel connections Weighting timestamp vectors Correlation matrix Measuring anonymity Experiments Estimating the source IP Discussion Figure: Bitcoin’s 3-step message exchange Conclusion 11/39

Deanonymization Broadcast randomization in Bitcoin and forks and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction Tx clustering Parallel connections ◮ trickling: send to a random subset once every 100 ms Weighting timestamp vectors Correlation matrix Measuring anonymity ◮ diffusion: send to each neighbor after a random delay Experiments Estimating the source IP Discussion Conclusion 12/39

Deanonymization Intuition and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction Tx clustering Transactions issued from the Parallel connections Weighting timestamp vectors Correlation matrix same node have correlated Measuring anonymity Experiments broadcast patterns. Estimating the source IP Discussion Conclusion 13/39

Deanonymization Outline of our clustering method and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov ◮ Establish parallel connections to many nodes Introduction Tx clustering ◮ Log timestamps of received tx announcements Parallel connections Weighting timestamp vectors Correlation matrix ◮ For each tx, consider IPs which announced it to us Measuring anonymity Experiments Estimating the source IP ◮ Cluster transactions with ”similar” IP vectors Discussion Conclusion ◮ Measure the decrease in anonymity 14/39

Deanonymization Parallel connections and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction ◮ Default connections: 8 outgoing + up to 117 incoming Tx clustering Parallel connections ◮ We are unlikely to get a new tx quickly with only one Weighting timestamp vectors Correlation matrix connection per node Measuring anonymity Experiments Estimating the source IP ◮ bcclient establishes parallel connections to nodes Discussion Conclusion ◮ Bitcoin and Zcash show similar distribution of free slots 15/39

Deanonymization Bitcoin free slots and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction Tx clustering Parallel connections Weighting timestamp vectors Correlation matrix Measuring anonymity Experiments Estimating the source IP Discussion Conclusion 16/39

Deanonymization Zcash free slots and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction Tx clustering Parallel connections Weighting timestamp vectors Correlation matrix Measuring anonymity Experiments Estimating the source IP Discussion Conclusion 17/39

Deanonymization Weighting timing vectors and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov IP addresses p i announce a new tx to us at times t i . Introduction We assign exponentially decreasing weights to p i : Tx clustering Parallel connections w ( p i ) = e − ( t i / k ) 2 Weighting timestamp vectors Correlation matrix Measuring anonymity where the median IP gets weight 0 . 5: Experiments Estimating the source IP t median Discussion k = � Conclusion − ln(0 . 5) 18/39

Deanonymization Weighting timing vectors: example and linkability of cryptocurrency transactions based High values indicate higher probability of an IP to be the on network analysis sender or one of its entry nodes. Biryukov, Tikhomirov Introduction Tx clustering Parallel connections Weighting timestamp vectors Correlation matrix Measuring anonymity Experiments Estimating the source IP Discussion Conclusion Figure: Weight functions for 3 timestamp vectors 19/39

Deanonymization Clustering the correlation matrix and linkability of cryptocurrency transactions based on network analysis Biryukov, Tikhomirov Introduction ◮ For each pairwise correlations of weight vectors of txs Tx clustering Parallel connections Weighting timestamp ◮ Hypothesis: correlation matrix has a block-diagonal vectors Correlation matrix structure Measuring anonymity Experiments Estimating the source IP ◮ With a right permutation of rows and columns, related Discussion transactions will form clusters along the main diagonal Conclusion 20/39