Privacy-Enhancing Overlays in Bitcoin Sarah Meiklejohn (University - PowerPoint PPT Presentation

Privacy-Enhancing Overlays in Bitcoin Sarah Meiklejohn (University College London) Claudio Orlandi (Aarhus University) 1

Anonymity in Bitcoin 2

Anonymity in Bitcoin 2

Anonymity in Bitcoin 2

Anonymity in Bitcoin 2

Anonymity in Bitcoin How much anonymity does Bitcoin really provide? 2

Outline 3

Outline Background 3

Outline Background Taint resistance 3

Outline Background Taint resistance Achieving taint resistance 3

Outline Background Taint resistance Achieving taint resistance Conclusions 3

Outline Background How Bitcoin works Background Taint resistance Anonymity in Bitcoin Coinjoin Achieving taint resistance Conclusions 3

How Bitcoin works 4

How Bitcoin works peer-to-peer network 4

How Bitcoin works (pk A ,sk A ) (pk B ,sk B ) peer-to-peer network 4

How Bitcoin works (pk A ,sk A ) address (pk B ,sk B ) peer-to-peer network 4

How Bitcoin works (pk A ,sk A ) address (pk B ,sk B ) peer-to-peer network 4

How Bitcoin works (pk A ,sk A ) address tx:Sign(pk B → pk A ) transaction (pk B ,sk B ) peer-to-peer network 4

How Bitcoin works (pk A ,sk A ) address miner tx:Sign(pk B → pk A ) transaction (pk B ,sk B ) peer-to-peer network 4

How Bitcoin works blockchain (pk A ,sk A ) address miner tx:Sign(pk B → pk A ) transaction (pk B ,sk B ) peer-to-peer network 4

Anonymity in Bitcoin How much anonymity does Bitcoin really provide? (pk A ,sk A ) address (pk B ,sk B ) 5

Anonymity in Bitcoin How much anonymity does Bitcoin really provide? in theory, a lot! addresses are not linked to identity (pk A ,sk A ) address (pk B ,sk B ) 5

Input clustering [RH13,RS13,A+13, M +13,SMZ14] 1 7 2 15 6 3 Heuristic: the same user controls these addresses 6

Change clustering [A+13, M +13,SMZ14] 1 1 7 1 2 14 0 3 14 Heuristic: the same user also controls this address 7

Tracking technique [ M +13,HD M +14] cycle theft heists ... = exchange individual thefts service interaction 8

Tracking technique [ M +13,HD M +14] cycle theft heists ... = exchange individual thefts service interaction 8

Anonymity in Bitcoin How much anonymity does Bitcoin really provide? in theory, a lot! addresses are not linked to identity in practice, maybe not so much 9

Privacy-enhancing overlays 10

Privacy-enhancing overlays 10

Privacy-enhancing overlays 10

Privacy-enhancing overlays 10

Privacy-enhancing overlays 10

Privacy-enhancing overlays 10

Privacy-enhancing overlays 10

Coinjoin Introduced on August 22 2013 by Gregory Maxwell “Bitcoin privacy for the real world” 11

Coinjoin 1 1 2 2 3 12

Coinjoin 1 1 2 2 3 12

Coinjoin σ 1 1 1 σ 2 2 2 3 12

Coinjoin σ 1 1 1 σ 2 2 2 σ 3 3 12

Coinjoin σ 1 1 1 3 σ 2 2 2 σ 3 3 3 12

Coinjoin signatures contributed separately σ 1 1 1 3 σ 2 2 2 σ 3 3 3 12

Coinjoin prevents clustering 1 7 2 15 6 3 Heuristic: the same user controls these addresses 13

Coinjoin prevents clustering 1 7 2 15 6 3 Heuristic: the same user controls these addresses 13

Coinjoin signatures contributed separately σ 1 1 1 3 σ 2 2 2 σ 3 3 3 could be: • private communication • IRC (+Tor) • central server (+blind signatures) 14

Coinjoin signatures contributed separately σ 1 1 1 3 σ 2 2 2 σ 3 3 3 could be: • private communication • IRC (+Tor) • central server (+blind signatures) 14

“Coinjoin” transactions 15

“Coinjoin” transactions “coinjoin” has: • more than 5 inputs • more than 5 outputs 15

“Coinjoin” transactions “coinjoin” has: # “coinjoins” per block • more than 5 inputs • more than 5 outputs time 15

“Coinjoin” transactions 13 “coinjoin” has: # “coinjoins” per block • more than 5 inputs • more than 5 outputs 3 2011 8/2013 time 15

Anonymity in Bitcoin How much anonymity does Bitcoin really provide? in theory, a lot! addresses are not linked to identity in practice, maybe not so much 16

Anonymity in Bitcoin does Coinjoin How much anonymity does Bitcoin really provide? in theory, a lot! addresses are not linked to identity in practice, maybe not so much 16

Outline Taint resistance Cryptographic background Background Taint resistance Accuracy Taint resistance Achieving taint resistance Conclusions 17

Anonymity in Bitcoin does Coinjoin How much anonymity does Bitcoin really provide? in theory, a lot! addresses are not linked to identity in practice, maybe not so much 18

Anonymity in Bitcoin does Coinjoin How much anonymity does Bitcoin really provide? in theory, a lot! addresses are not linked to identity in practice, maybe not so much 18

Coinjoin σ 1 1 1 3 σ 2 2 2 σ 3 3 3 19

Coinjoin σ 1 1 1 3 σ 2 2 2 σ 3 3 3 should be hard to figure out which input addresses sent to this output address 19

Coinjoin σ 1 1 1 3 σ 2 2 2 σ 3 3 3 should be hard to figure out which input addresses sent to this output address should be hard to figure out permutation 19

Taint resistance taint set σ 1 1 1 3 σ 2 2 2 σ 3 3 3 20

Taint resistance taint set σ 1 1 1 3 σ 2 2 2 σ 3 3 3 accuracy : how accurately can one identify taint set? 20

Taint resistance taint set σ 1 1 1 3 σ 2 2 2 σ 3 3 3 accuracy : how accurately can one identify taint set? |A ∩ T| × |S \ (A ∪ T)| - |A \ T| × |T \ A| MCC = √ (|A||T||S\T||S\A|) 20

Taint resistance taint set σ 1 1 1 3 σ 2 2 2 σ 3 3 3 accuracy : how accurately can one identify taint set? input keys (candidate set) |A ∩ T| × |S \ (A ∪ T)| - |A \ T| × |T \ A| MCC = √ (|A||T||S\T||S\A|) guess for taint set (true) taint set 20

Taint resistance taint set σ 1 1 1 3 σ 2 2 2 σ 3 3 3 accuracy : how accurately can one identify taint set? input keys (candidate set) |A ∩ T| × |S \ (A ∪ T)| - |A \ T| × |T \ A| MCC = √ (|A||T||S\T||S\A|) guess for taint set (true) taint set taint resistance : no adversary can have good accuracy 20

Bad taint resistance: lopsided values 50.123 σ 1 50.123 2 σ 2 1.987 1.987 21

Bad taint resistance: process of elimination σ 1 1 1 3 σ 2 2 2 σ 3 3 3 22

Outline Cryptographic background Background Taint resistance Achieving taint resistance Achieving taint resistance Conclusions Constructive approaches Is Coinjoin taint resistant? 23

Constructing taint-resistant protocols σ 1 1 1 σ 2 2 2 σ 3 3 could be: • private communication • IRC (+Tor) • central server 24

Constructing taint-resistant protocols σ 1 1 1 σ 2 2 2 σ 3 3 could be: if server is trusted • private communication • IRC (+Tor) and A is passive • central server then we can achieve taint resistance 24

Constructing taint-resistant protocols σ 1 1 1 σ 2 2 2 σ 3 3 could be: if server is trusted • private communication if server is • IRC (+Tor) and A is passive • central server passively corrupted then we can achieve then we can achieve taint resistance (1- ε )-taint resistance 24

Constructing taint-resistant protocols σ 1 1 1 σ 2 2 2 (like CoinShuffle [RM-SK14]) σ 3 if an active A controls 3 τ fraction of n parties then we can achieve (1-n τ n-1 )-taint resistance could be: if server is trusted • private communication if server is • IRC (+Tor) and A is passive • central server passively corrupted then we can achieve then we can achieve taint resistance (1- ε )-taint resistance 24

Analyzing taint-resistant protocols 25

Analyzing taint-resistant protocols participated in 108 transactions ourselves 25

Analyzing taint-resistant protocols implemented simple subset-sum algorithm: (roughly) if sum of input values is output value, input addresses might be in taint set for output address 26

Analyzing taint-resistant protocols implemented simple subset-sum algorithm: (roughly) if sum of input values is output value, input addresses might be in taint set for output address (Atlas,Coinjoin Sudoku) 26

Analyzing taint-resistant protocols implemented simple subset-sum algorithm: (roughly) if sum of input values is output value, input addresses might be in taint set for output address active adversary knows addresses and knows coinjoins (Atlas,Coinjoin Sudoku) 26

Analyzing taint-resistant protocols implemented simple subset-sum algorithm: (roughly) if sum of input values is output value, input addresses might be in taint set for output address active adversary knows addresses passive adversary and knows coinjoins knows no addresses and guesses coinjoins (Atlas,Coinjoin Sudoku) 26