Nostr Web Client

First of all SW coordinator is blinded run over tor so even if Samourai can track xpubs they don’t know entities ip and even if they do they have no idea about what happens post mix txns.

For equal outputs to exist there will be change and coordinator is blinded (soon decentralized) It doesn't know the links between a coinjoin's inputs and outputs. That was one of the major goals of the zerolink framework. Also doxxic change is completely unaffected by mixes since it has never been mixed.

Every SW user knows exactly what to do with that doxxic change so there is no combining with other doxxic change that didn’t come from the same source.

The Tx0 makes all your UTXO's share a tx hash, which prevents them from mixing with each other, preventing an "accidental" Sybil attack from entering a large amount of BTC, Samourai separates the coordinator fee in the Tx0 no fee flagging in the fee addresses. Every communication between Alice and the coordinator is made with a different Tor identity. It's transparent for the coordinator if one of the messages is actually sent by Bob, so when Alice sends her clear output to the coordinator it's made with a Tor identity different from the Tor identity used to submit the input and the blinded ouput. Who is using this Tor identity is transparent for the coordinator. It’s two separate Tor identities. This was even in the original zerolink docs IIRC.

So once coins are mixed, they are segregated and can't "accidentally" make their way back to unmixed section of wallet. You have to manually generate a receive address and send from postmix to get utxos back there, which obviously you shouldn't do. This is the only way to have true ZeroLink, where a user can't spend mixed and unmixed together. SW doing ZeroLink original spec, whihc is simultaneous denominated pools, max entropy mixes for the number of inputs/outputs, never 2 or more same previous tx in a same mix, and unequal amount coinjoined spends post-mix if the user chooses.

So no they will not be able to demix everyone. If that happens then why wasabi users were arrested but not sw or sparrow?

Kruw 2y ago

Doxxic change is NOT a requirement for equal outputs to exist. Wasabi Wallet's coinjoins eliminate traceable change, which entirely solves Whirlpool's issue of creating unspendable non private coins: https://bitcoinmagazine.com/technical/toxic-change-wabisabi-bitcoin-coinjoin-privacy

Reply to this note

Please Login to reply.

Discussion

XMR Future 2y ago

What is the trade-off for this in your opinion? (if any, but I suspect there is)

Kruw 2y ago

The implied tradeoff is that there are less occurrences of each standard denomination compared to WW1/Whirlpool which forces every participant to create the same size standard denomination: https://blog.wasabiwallet.io/privacy-guarantees-of-wasabi-wallet-2-0/

However, this tradeoff is overwhelmingly negated once the round gets large enough; Since there is no 1:1 ratio of participants to standard amounts of a single size like WW1 or Whirlpool, observers have to consider all the possible compositions and decompositions of ANY input and ANY output.

Since zkSNACKS has a minimum of 150 inputs per round (up to 400), the possibilities break your calculator:

XMR Future 2y ago

Appreciate the engagement and honesty. Going to mull this over.

In your opinion would this be correct:

Whirlpool > Wasabi 1.0

Wasabi 2.0 > Whirlpool

Or would it be fair to say Whirlpool prioritizes uniformity/pool size above any efficiency, cost, and speed gains. While Wasabi 2.0 protocol will take a big efficiency, cost, and speed gain for a small uniformity/pool size loss?

Kruw 2y ago

There's no privacy advantages of Whirlpool over Wasabi 1.0. The only difference between those implementations is the tx0 transaction that Whirlpool creates prior to coinjoining.

The privacy sacrifice of the tx0 transaction is a tradeoff to "speed up" registration so a user can participate in multiple rounds simultaneously since tx0 creates all their outputs immediately. Here's a very simplified MSPaint example of how WW1 can make change more private than Whirlpool:

Kruw 2y ago

(The 0.7 and 9.5 outputs obviously have enough value to meet the 0.5 pool minimum again, but the others cannot.)