Coinshuffle is a communication protocol that allows for a number of peers to privately collaborate in making a Bitcoin coinjoin transaction in such a way that they all provide their addresses for the transaction, but still it is not possible for the other peers to know who provided each one. Its first implementation came out 2 years ago, and used the same sort of idea as in TOR. You can read about it here: https://bitcointalk.org/index.php?topic=567625.0

Two months ago, the same authors of that paper made a substantial improvements to the whole protocol of anonymously communicating the destination addresses to the group. This time instead of onion routing, they are using something similar to the dining cryptographer's protocol. You can read about it here: https://bitcointalk.org/index.php?topic=1497271

From what I understand, each pair of the n peers establish one-time symmetric keys, so each peer knows n-1 such keys. When there is a communication round, each one sends their messages out XORed with all their keys. Once everything is XORed together, the keys will appear each twice and will therefore cancel. Well, it is not as simple as that since the result would be just the XORing of all messages, but using some polynomial tricks the messages can be recovered in the end simultaneously by all the peers, and no one knows who provided each message!

So I was wondering if something similar couldn't be implemented to make it so that every Monero transaction was broadcast to (and relayed through) the network in this manner. That is, it would just appear simultaneously at all n connected nodes in a certain clique in the network. The findings in these papers seem to indicate that we could have that level of privacy in Monero's networking software, and perhaps do away with the need for TOR or I2P.

Now in going over those papers, I have found at least one inconvenience to adapting it, but perhaps people here can find a way around:

If some peers cheat and use garbage instead of the keys, or don't participate at all in the round etc, then currently the way to weed them out is this: everyone reveals their secret one-time keys and messages, and the round is replayed in the clear to find out what peers to exclude in the next round. This is okay when making a coinjoin transaction since the addresses provided would only have any value if the transaction was signed, and in the next round everybody would use new fresh addresses. If the message itself already had meaningful content, like a signed transaction, then such procedure is unacceptable. But I am hopeful that a better solution might exist.

Please let me know if you think that this idea has any merit, and if you have any suggestion on how to improve this procedure to protect the message. With some luck maybe we can get one more level of privacy directly into Monero's software!

EDIT/TL;DR: Specifically, there are two questions here:

1) Do you think that the messaging protocol from Coinshuffle++ could be implemented in Monero's transaction broadcasting protocol? What would have to be adapted?

2) Assuming we want to use a similar procedure to eliminate dishonest peers, can you think of a way to adapt the one from Coinshuffle++ but without revealing the messages (i.e. transactions, in Monero's world)?

  • 1
    Can you try to break this down into several separate, more specific questions?
    – Smart Kid
    Commented Sep 1, 2016 at 4:08
  • 1
    Hey. As I said in the OP, the question is whether the idea of using the message broadcasting protocol from Coinshuffle++ for relaying Monero transactions has any merit. I understand that my post is more an invitation to discuss the idea than a simple and direct question, but couldn't you lift the hold and let people discuss it? Perhaps tag it as [discussion / open-ended question]? I really feel that this idea, if viable, could improve Monero's network privacy.
    – user141
    Commented Sep 2, 2016 at 18:46
  • I realize that in order to answer my question, the readers will have to go read the reference posts, and perhaps papers, but that is the nature of the question... Also, if this question is inappropriate for this site, where would you suggest I post it? Thank you.
    – user141
    Commented Sep 2, 2016 at 18:58
  • 2
    I would suggest starting with a question like "How could the messaging protocol from Coinshuffle++ be implemented into the Monero transaction broadcasting protocol?" Your second follow up question should be asked separately.
    – Smart Kid
    Commented Sep 2, 2016 at 20:36
  • 2
    @user141 It sounds like an interesting question to me but you need to narrow the scope of the question substantially. It is fine to ask multiple questions. There is no need to pile so much into this one. Commented Sep 3, 2016 at 10:40


Browse other questions tagged or ask your own question.