When constructing a change output, does it have to be sent to the main public address?

Question

I was thinking about how the behavior of spending Monero from the same wallet over time introduces the risk of eventually linking change outputs when they are later combined and spent. Can this be avoided?

It occurred to me that the wallet will prefer to spend from within particular subaddresses (citation could be useful here), so I was thinking that one way to prevent future linking of change outputs would be to address them to various subaddresses.

Back to the title, is it possible for change outputs to be sent to subaddresses? Does such functionality exist in the code now? Ignoring the obvious downside where an actively used wallet would quickly have an issue with a plethora of difficult-to-manage subaddresses, is it possible and does the idea have merit?

Answer 1

It's possible to send change to any subaddress/account inside any wallet where you know the private view key and public spend key for that wallet. (If you were not sending to a subaddress destination, then you could send change to any wallet where you only knew the public view and spend keys).

The wallet rule is currently that outputs can be spent together if they are received to any subaddress within the same account. Therefore to achieve what you're talking about, you'd need to send change to a different account within your wallet.

Now, however, you have a new problem. If change outputs from that new account were spent together, you'd have the same kinds of traceability problems.

If churning is deemed effective, the solution is probably to have a 'high privacy' wallet mode, where every change output is kept track of by the wallet, and churned several times before becoming available for spending. You'd not need to bother with sending change to different subaddresses, because the wallet would be easily capable of keeping track of which outputs are change and how many times each change output has been churned.

Alternatively, you could reason that as long as outputs in a particular account are always churned before entering that account, and if that account is only used to spend funds with entities that are not aware of your real-world identity, then it doesn't matter if change outputs are churned. You'd simply have an account for spending with people that know your real identity, and another account for people that don't. This has the benefit of it not being necessary to churn every single change output. You'd only need to churn prior to filling the high-privacy account with funds, and prior to withdrawing funds from that account to an exchange or real-world-identity account.