Towards Better Privacy with Monero Malte Mser Based on An Empirical - - PowerPoint PPT Presentation

▶
towards better privacy with monero
SMART_READER_LITE
LIVE PREVIEW

Towards Better Privacy with Monero Malte Mser Based on An Empirical - - PowerPoint PPT Presentation

Mar 16, 2023 581 likes •895 views

Towards Better Privacy with Monero Malte Mser Based on An Empirical Analysis of Traceability in the Monero Blockchain, joint work with Kyle Soska, Ethan Heilman, Kevin Lee, Henry Heffan, Shashvat Srivastava, Kyle Hogan, Jason Hennessey,

slide-1
SLIDE 1

Malte Möser

Towards Better Privacy with Monero

Based on An Empirical Analysis of Traceability in the Monero Blockchain,
 joint work with Kyle Soska, Ethan Heilman, Kevin Lee, Henry Heffan, Shashvat Srivastava,
 Kyle Hogan, Jason Hennessey, Andrew Miller, Arvind Narayanan, and Nicolas Christin.

slide-2
SLIDE 2

2

slide-3
SLIDE 3

Takeaways

▸ Monero improves upon Bitcoin’s privacy

▸ One-time addresses prevent address clustering ▸ Transaction values are hidden ▸ Obfuscation of payment flows

▸ Incorrect use can severely hurt your anonymity ▸ Used for both illegitimate and legitimate purposes

3

slide-4
SLIDE 4

Anonymity

Anonymity is the state of not being identifiable within
 a set of subjects, the anonymity set.

Pfitzmann & Köhntopp 2001

Indistinguishable

4

slide-5
SLIDE 5

Issue 1: Public Reuse of Addresses

6

Send Bitcoin to
 1myaddress001

To: 1myaddress001 To: 1myaddress001

slide-6
SLIDE 6

Issue 1: Public Reuse of Addresses

10

To: 1myaddress001 To: 1myaddress001 To: 1myaddress042 To: 1myaddress612

slide-7
SLIDE 7

Monero Uses Stealth Addresses

12

Send XMR to
 mystealthyaddr

To: g77gwvm8mg

▸ Based on shared secret (ECDH) ▸ Sender embeds information allowing to recover secret ▸ Recipients must try to redeem all outputs on the blockchain

slide-8
SLIDE 8

Issue 2: Values Are Visible

13

Send XMR to
 mystealthyaddr

To: g77gwvm8mg To: 0yqija6fga

1 XMR 10.376289 XMR

slide-9
SLIDE 9

When the Cookie Meets the Blockchain

▸ Each step can leak information to third-party trackers ▸ Timing and value allow to identify corresponding transactions

14

Goldfeder et al. (2018). When the cookie meets the blockchain: Privacy risks of web payments via cryptocurrencies

slide-10
SLIDE 10

Amounts Are Encrypted (Since 2017)

15

Send XMR to
 mystealthyaddr

To: g77gwvm8mg To: 0yqija6fga

?? XMR ?? XMR

slide-11
SLIDE 11

Issue 3: Tracing Payments

16

Bob Alice Hotel

slide-12
SLIDE 12

Output Selection in Bitcoin

each input spends a single output

17

slide-13
SLIDE 13

Output Selection in Monero

each input spends one of multiple outputs

18

linkable ring signature (key image)

slide-14
SLIDE 14

Deduction Technique

initially no mandatory
 number of mixins

19

slide-15
SLIDE 15

Results of Deducibility Attack

▸ 64% of inputs have no mixins ▸ 63% of inputs with mixins are

deducible

21

slide-16
SLIDE 16

How Do You Choose Fake Coins?

23

2 years old 3 months old 2 days old

Most likely to be the
 real coin being spent

slide-17
SLIDE 17

Distributions Do Not Match

Real + Fake Real Ruled-out

24

slide-18
SLIDE 18

The Newest Input Is Usually the Real One

Successful for 80% of all inputs between April 2014 and April 2017

25

slide-19
SLIDE 19

How Can We Fix This?

Sample More “Recent” Mixins

▸ More mixins, more “recent” mixins ▸ Simulation results in our paper

Estimate Empirical Distribution Binned Mixin

Time Probability

26

slide-20
SLIDE 20

Sophisticated Timing Attacks

▸ Bob is one of five suspects to have bought drugs at AlphaBay today ▸ I know Bob bought some XMR exactly 3 months ago

27

2 years old 3 months old 2 days old

slide-21
SLIDE 21

Chain Forks Are a Privacy Hazard

29

Monero MoneroV

slide-22
SLIDE 22

Chain Forks Are a Privacy Hazard

32

Intersection reveals true spend

linked by key image

slide-23
SLIDE 23

Estimating Performance of Guess-Newest

33

Source: Abraham Hinteregger and Bernhard Haslhofer. An Empirical Analysis of Monero Cross-Chain Traceability. (2019)

slide-24
SLIDE 24

Quantifying Privacy-Sensitive Use

▸ Not all transactions

are equally privacy sensitive

▸ Goal: quantify

different usage types

Monero doubles block interval

34

slide-25
SLIDE 25

Estimating Mining Activity

▸ Miners announce

blocks and payouts

▸ Website crawl

▸ # blocks found ▸ # payout txs

▸ 0.44 txs per block

related to mining

36

slide-26
SLIDE 26

AlphaBay

▸ Volume spiked

when AlphaBay started accepting Monero

AlphaBay starts accepting Monero

37

slide-27
SLIDE 27

AlphaBay - Daily Volume (Number of Transactions)

38

1,000 2,000 3,000 4,000 5,000 Jan 2015 Jul 2015 Jan 2016 Jul 2016 Jan 2017

Date Daily volume (nr. of transactions, 7−day avg.)

XMR or BTC BTC only Unidentified

slide-28
SLIDE 28

AlphaBay

▸ Volume spiked

when AlphaBay started accepting Monero

▸ At most 25% of txs

can be deposits at AlphaBay

AlphaBay starts accepting Monero

39

slide-29
SLIDE 29

Cryptocurrency Privacy Inherits the Worst of

▸ Data anonymization

▸ Blockchain data is public ▸ Weakness can be exploited retroactively

▸ Communication anonymity

▸ Behavior of some users influences anonymity of others ▸ “Anonymity loves company”

  • cf. Goldfeder, Kalodner, Reisman & Narayanan (2018)

40

slide-30
SLIDE 30

Summary

▸ Monero improves upon the limited privacy of Bitcoin

▸ Correct use of technology is paramount ▸ It’s hard to patch a broken system

▸ Illicit business tends to be early adopters of new technologies

▸ Many legitimate uses that are less visible

41