[PPT] - Privacy-Enhancing Overlays in Bitcoin Sarah Meiklejohn (University PowerPoint Presentation

SLIDE 1

Sarah Meiklejohn (University College London) Claudio Orlandi (Aarhus University)

1

Privacy-Enhancing Overlays in Bitcoin

SLIDE 2

Anonymity in Bitcoin

2

SLIDE 3

Anonymity in Bitcoin

2

SLIDE 4

Anonymity in Bitcoin

2

SLIDE 5

Anonymity in Bitcoin

2

SLIDE 6

Anonymity in Bitcoin

2

How much anonymity does Bitcoin really provide?

SLIDE 7

Outline

3

SLIDE 8

Outline

Background

3

SLIDE 9

Outline

Background Taint resistance

3

SLIDE 10

Outline

Background Taint resistance Achieving taint resistance

3

SLIDE 11

Outline

Background Taint resistance Achieving taint resistance Conclusions

3

SLIDE 12

Outline

Background Taint resistance Achieving taint resistance Conclusions Background

How Bitcoin works Anonymity in Bitcoin Coinjoin

3

SLIDE 13

How Bitcoin works

4

SLIDE 14

How Bitcoin works

4

peer-to-peer network

SLIDE 15

How Bitcoin works

4

(pkA,skA) (pkB,skB)

peer-to-peer network

SLIDE 16

How Bitcoin works

4

(pkA,skA) (pkB,skB)

address peer-to-peer network

SLIDE 17

How Bitcoin works

4

(pkA,skA) (pkB,skB)

address peer-to-peer network

SLIDE 18

How Bitcoin works

4

(pkA,skA) (pkB,skB)

address peer-to-peer network

tx:Sign(pkB→pkA)

transaction

SLIDE 19

How Bitcoin works

4

(pkA,skA) (pkB,skB)

address peer-to-peer network miner

tx:Sign(pkB→pkA)

transaction

SLIDE 20

How Bitcoin works

4

(pkA,skA) (pkB,skB)

blockchain address peer-to-peer network miner

tx:Sign(pkB→pkA)

transaction

SLIDE 21

Anonymity in Bitcoin

5

How much anonymity does Bitcoin really provide?

(pkA,skA) (pkB,skB)

address

SLIDE 22

Anonymity in Bitcoin

5

How much anonymity does Bitcoin really provide?

(pkA,skA) (pkB,skB)

address

in theory, a lot! addresses are not linked to identity

SLIDE 23

Input clustering [RH13,RS13,A+13,M+13,SMZ14]

2 1 3

6

7 15

Heuristic: the same user controls these addresses

6

SLIDE 24

Change clustering [A+13,M+13,SMZ14]

2 1 3 14

7

14

1 1 Heuristic: the same user also controls this address

SLIDE 25

Tracking technique [M+13,HDM+14] cycle theft ... heists

= exchange

service interaction

8

individual thefts

SLIDE 26

Tracking technique [M+13,HDM+14] cycle theft ... heists

= exchange

service interaction

8

individual thefts

SLIDE 27

Anonymity in Bitcoin

9

How much anonymity does Bitcoin really provide?

in theory, a lot! addresses are not linked to identity in practice, maybe not so much

SLIDE 28

Privacy-enhancing overlays

10

SLIDE 29

Privacy-enhancing overlays

10

SLIDE 30

Privacy-enhancing overlays

10

SLIDE 31

Privacy-enhancing overlays

10

SLIDE 32

Privacy-enhancing overlays

10

SLIDE 33

Privacy-enhancing overlays

10

SLIDE 34

Privacy-enhancing overlays

10

SLIDE 35

Coinjoin

Introduced on August 22 2013 by Gregory Maxwell “Bitcoin privacy for the real world”

11

SLIDE 36

Coinjoin

12

2 1 3 2 1

SLIDE 37

Coinjoin

12

2 1 3 2 1

SLIDE 38

Coinjoin

12

2 1 3 2 1

σ1 σ2

SLIDE 39

Coinjoin

12

2 1 3 2 1

σ1 σ2 σ3

SLIDE 40

Coinjoin

12

2 1 3 2 1

σ1 σ2 σ3

3 3

SLIDE 41

Coinjoin

12

2 1 3 2 1

σ1 σ2 σ3

3 3

signatures contributed separately

SLIDE 42

Coinjoin prevents clustering

2 1 3

13

7 15

Heuristic: the same user controls these addresses

6

SLIDE 43

Coinjoin prevents clustering

2 1 3

13

7 15

Heuristic: the same user controls these addresses

6

SLIDE 44

Coinjoin

14

2 1 3 2 1

σ1 σ2 σ3

could be:

private communication
IRC (+Tor)
central server (+blind signatures)

3 3

signatures contributed separately

SLIDE 45

Coinjoin

14

2 1 3 2 1

σ1 σ2 σ3

could be:

private communication
IRC (+Tor)
central server (+blind signatures)

3 3

signatures contributed separately

SLIDE 46

“Coinjoin” transactions

15

SLIDE 47

“Coinjoin” transactions

15

“coinjoin” has:

more than 5 inputs
more than 5 outputs

SLIDE 48

“Coinjoin” transactions

15

# “coinjoins” per block time

“coinjoin” has:

more than 5 inputs
more than 5 outputs

SLIDE 49

“Coinjoin” transactions

15

2011 8/2013 13 3 # “coinjoins” per block time

“coinjoin” has:

more than 5 inputs
more than 5 outputs

SLIDE 50

Anonymity in Bitcoin

16

How much anonymity does Bitcoin really provide?

in theory, a lot! addresses are not linked to identity in practice, maybe not so much

SLIDE 51

Anonymity in Bitcoin

16

How much anonymity does Bitcoin really provide?

does Coinjoin

in theory, a lot! addresses are not linked to identity in practice, maybe not so much

SLIDE 52

Outline

17

Cryptographic background Taint resistance Achieving taint resistance Conclusions Background Taint resistance

Accuracy Taint resistance

SLIDE 53

Anonymity in Bitcoin

18

How much anonymity does Bitcoin really provide?

does Coinjoin

in theory, a lot! addresses are not linked to identity in practice, maybe not so much

SLIDE 54

Anonymity in Bitcoin

18

How much anonymity does Bitcoin really provide?

does Coinjoin

in theory, a lot! addresses are not linked to identity in practice, maybe not so much

SLIDE 55

Coinjoin

19

2 1 3 3 3 2 1

σ1 σ2 σ3

SLIDE 56

Coinjoin

19

2 1 3 3 3 2 1

σ1 σ2 σ3

should be hard to figure out which input addresses sent to this output address

SLIDE 57

Coinjoin

19

2 1 3 3 3 2 1

σ1 σ2 σ3

should be hard to figure out which input addresses sent to this output address should be hard to figure out permutation

SLIDE 58

Taint resistance

20

2 1 3 3 3 2 1

σ1 σ2 σ3

taint set

SLIDE 59

Taint resistance

20

2 1 3 3 3 2 1

σ1 σ2 σ3

taint set accuracy: how accurately can one identify taint set?

SLIDE 60

Taint resistance

20

2 1 3 3 3 2 1

σ1 σ2 σ3

taint set accuracy: how accurately can one identify taint set?

MCC = |A∩T|×|S \ (A∪T)| - |A \ T|×|T \ A| √(|A||T||S\T||S\A|)

SLIDE 61

Taint resistance

20

2 1 3 3 3 2 1

σ1 σ2 σ3

taint set accuracy: how accurately can one identify taint set?

MCC = |A∩T|×|S \ (A∪T)| - |A \ T|×|T \ A| √(|A||T||S\T||S\A|)

guess for taint set (true) taint set input keys (candidate set)

SLIDE 62

Taint resistance

20

2 1 3 3 3 2 1

σ1 σ2 σ3

taint set accuracy: how accurately can one identify taint set? taint resistance: no adversary can have good accuracy

MCC = |A∩T|×|S \ (A∪T)| - |A \ T|×|T \ A| √(|A||T||S\T||S\A|)

guess for taint set (true) taint set input keys (candidate set)

SLIDE 63

Bad taint resistance: lopsided values

21

2 1.987 50.123 50.123

σ1 σ2

1.987

SLIDE 64

Bad taint resistance: process of elimination

22

2 1 3 3 3 2 1

σ1 σ2 σ3

SLIDE 65

Outline

23

Cryptographic background Taint resistance Achieving taint resistance Conclusions Background Achieving taint resistance

Constructive approaches Is Coinjoin taint resistant?

SLIDE 66

Constructing taint-resistant protocols

24

could be:

private communication
IRC (+Tor)
central server

2 1 3 2 1

σ1 σ2 σ3

SLIDE 67

Constructing taint-resistant protocols

24

could be:

private communication
IRC (+Tor)
central server

if server is trusted and A is passive then we can achieve taint resistance 2 1 3 2 1

σ1 σ2 σ3

SLIDE 68

Constructing taint-resistant protocols

24

could be:

private communication
IRC (+Tor)
central server

if server is trusted and A is passive then we can achieve taint resistance if server is passively corrupted then we can achieve (1-ε)-taint resistance 2 1 3 2 1

σ1 σ2 σ3

SLIDE 69

Constructing taint-resistant protocols

24

could be:

private communication
IRC (+Tor)
central server

if server is trusted and A is passive then we can achieve taint resistance if server is passively corrupted then we can achieve (1-ε)-taint resistance (like CoinShuffle [RM-SK14]) if an active A controls τ fraction of n parties then we can achieve (1-nτn-1)-taint resistance 2 1 3 2 1

σ1 σ2 σ3

SLIDE 70

Analyzing taint-resistant protocols

25

SLIDE 71

Analyzing taint-resistant protocols

25

participated in 108 transactions ourselves

SLIDE 72

Analyzing taint-resistant protocols

26

implemented simple subset-sum algorithm: (roughly) if sum of input values is output value, input addresses might be in taint set for output address

SLIDE 73

Analyzing taint-resistant protocols

26

(Atlas,Coinjoin Sudoku)

implemented simple subset-sum algorithm: (roughly) if sum of input values is output value, input addresses might be in taint set for output address

SLIDE 74

Analyzing taint-resistant protocols

26

(Atlas,Coinjoin Sudoku)

implemented simple subset-sum algorithm: (roughly) if sum of input values is output value, input addresses might be in taint set for output address active adversary knows addresses and knows coinjoins

SLIDE 75

Analyzing taint-resistant protocols

26

(Atlas,Coinjoin Sudoku)

implemented simple subset-sum algorithm: (roughly) if sum of input values is output value, input addresses might be in taint set for output address active adversary knows addresses and knows coinjoins passive adversary knows no addresses and guesses coinjoins

SLIDE 76

Sanity check: Ground truth output taint

27

10 20 30 40 −1.0 −0.5 0.0 0.5 1.0 Number of input public keys MCC

m & s=2

n & s=2 c & s=2

SLIDE 77

Sanity check: Ground truth output taint

27

10 20 30 40 −1.0 −0.5 0.0 0.5 1.0 Number of input public keys MCC

m & s=2

n & s=2 c & s=2

(due to a quirk in the SharedCoin system)

SLIDE 78

Sanity check: Ground truth output taint

27

10 20 30 40 −1.0 −0.5 0.0 0.5 1.0 Number of input public keys MCC

m & s=2

n & s=2 c & s=2

(due to a quirk in the SharedCoin system) (accurate)

SLIDE 79

Active adversaries: Coinjoin output taint

28

10 20 30 40 10 20 30 40 Number of input public keys Size of set S

m & s=2

m & s=4 n & s=2 n & s=4 c & s=2 c & s=4

SLIDE 80

Active adversaries: Coinjoin output taint

28

10 20 30 40 10 20 30 40 Number of input public keys Size of set S

m & s=2

m & s=4 n & s=2 n & s=4 c & s=2 c & s=4

how many possible subsets?

SLIDE 81

Active adversaries: Coinjoin output taint

28

10 20 30 40 10 20 30 40 Number of input public keys Size of set S

m & s=2

m & s=4 n & s=2 n & s=4 c & s=2 c & s=4

how many possible subsets? (didn’t capture behavior)

SLIDE 82

Active adversaries: Coinjoin output taint

28

10 20 30 40 10 20 30 40 Number of input public keys Size of set S

m & s=2

m & s=4 n & s=2 n & s=4 c & s=2 c & s=4

(less confident) how many possible subsets? (didn’t capture behavior)

SLIDE 83

Passive adversaries: “Coinjoin” output taint

29

10 20 30 40 10 20 30 40 Number of input public keys Size of set S

m & s=2

m & s=4 n & s=2 n & s=4 c & s=2 c & s=4

SLIDE 84

Passive adversaries: “Coinjoin” output taint

29

10 20 30 40 10 20 30 40 Number of input public keys Size of set S

m & s=2

m & s=4 n & s=2 n & s=4 c & s=2 c & s=4

(less confident)

SLIDE 85

Passive adversaries: “Coinjoin” output taint

29

10 20 30 40 10 20 30 40 Number of input public keys Size of set S

m & s=2

m & s=4 n & s=2 n & s=4 c & s=2 c & s=4

(less confident) passive adversary is much less confident than active one!

SLIDE 86

Outline

30

Cryptographic background Taint resistance Achieving taint resistance Conclusions Background Conclusions

SLIDE 87

Conclusions

31

How much anonymity does Bitcoin really provide?

does Coinjoin

in theory, a lot! addresses are not linked to identity in practice, maybe not so much

SLIDE 88

Conclusions

31

How much anonymity does Bitcoin really provide?

does Coinjoin

in theory, a lot! addresses are not linked to identity in practice, maybe not so much in theory, can achieve perfect taint resistance

SLIDE 89

Conclusions

31

How much anonymity does Bitcoin really provide?

does Coinjoin

in theory, a lot! addresses are not linked to identity in practice, maybe not so much in theory, can achieve perfect taint resistance in practice, depends on auxiliary information

SLIDE 90

Conclusions

31

How much anonymity does Bitcoin really provide?

does Coinjoin

in theory, a lot! addresses are not linked to identity in practice, maybe not so much in theory, can achieve perfect taint resistance in practice, depends on auxiliary information