4

Does Monero protect against timing analysis?

As I understand it, Monero mixes the transactions so that you cannot definitively determine UserA sent money to UserB. Not 100%, but because the outputs are being mixed with UserS, UserQ, UserL, it would seem these users are just as plausible senders.

However, if UserA broadcasts that TX at 8:00PM, is there any record of that?

Assuming there is a record, and assuming the analyst sees it is currently 8:01PM, could analysts determine that the most recently created output has a high(er) probability that UserA was the authentic sender?

Improve this question

1 Answer 1

Reset to default
3

This is somewhat related to the Temporal Associations, described in MRL4 here, and temporal alignment, described in this SE question.

To specifically answer your questions:

However, if UserA broadcasts that TX at 8:00PM, is there any record of that?

The broadcast of the transaction isn't stored in the blockchain, but its time of inclusion into the blockchain is (the timestamp of the block). However, someone sniffing the network could record the time of all transaction broadcasts.

Assuming there is a record, and assuming the analyst sees it is currently 8:01PM, could analysts determine that the most recently created output has a high(er) probability that UserA was the authentic sender?

Theoretically, yes. However, this is only problematic under the following circumstances. 1- you just received your monero, so you only own recent outputs. 2) you only own outputs in 1 block.

Issue number 2 will be somewhat fixed with RingCT because denominations will not be necessary so there will no need to stack many outputs into a transaction - so no alignment.

Issue number 1 can only be dealt with (using the current Monero client) by letting your monero "bake" in the blockchain. Future developments could include custom ring partner (mixin, fake output) selection, such that the user could decide which ring partner collection (created at random using probability density functions of different distributions) will work best for the outputs owned by the user.

Improve this answer
3
  • 1
    I'm not convinced that "choose your own partner" is an improvement. Humans tend to have predictable patterns. A simple RNG is still better than explicit choice.
    – hyc
    Commented Nov 22, 2016 at 21:23
  • 1
    I tend to agree with @hyc; the only change that we've made recently in an attempt to thwart such an attack is that every ring signature now includes a "new" output by default, either the user's real output or a randomly picked one. If every input on the blockchain has a new output in its ring, how will an analyst use that to their advantage?
    – fluffyponyza
    Commented Nov 23, 2016 at 9:48
  • 1
    I edited the response to indicate what I meant by "choose your own partner" though it could still be wrong headed. > If every input on the blockchain has a new output in its ring, how will an analyst use that to their advantage? Perhaps an analyst could assume that the "newest" output is a fake one? I dunno. Here I am using SE for a discussion.
    – Ginger Ale
    Commented Nov 23, 2016 at 11:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.