Home / Blog / Do CoinJoin Mixes Really Require Equal Transaction Amounts for Privacy? Part Two: Knapsack

Do CoinJoin Mixes Really Require Equal Transaction Amounts for Privacy? Part Two: Knapsack

Do CoinJoin Mixes Really Require Equal Transaction Amounts for Privacy? Part Two: Knapsack

Although Satoshi Nakamoto’s white paper means that privateness was a design aim of the Bitcoin protocol, blockchain evaluation can usually break customers’ privateness. This is an issue. Bitcoin customers may not essentially need the world to know the place they spend their cash, what they earn or how a lot they personal, whereas companies could not wish to leak transaction particulars to opponents — to call some examples.

But there are answers to regain privateness, like CoinJoin. Some of the most well-liked mixing options out there at this time use this trick, together with Wasabi Wallet (which leverages ZeroLink) and Samourai Wallet (which leverages Whirlpool). In each instances, customers chop their cash into equal quantities to combine them with one another. Using equal quantities is taken into account an important step for the combination to be efficient.

Part one of this miniseries coated a brand new mixing protocol in growth for Bitcoin Cash referred to as CashFusion, which challenges the idea that equal quantities are crucial for a profitable combine.

But even in 2017, in a paper analyzing the privateness of non-equal quantity CoinJoins in depth, researchers from RWTH Aachen University and Karlsruhe Institute of Technology proposed an answer to realize privateness by way of CoinJoin with out the necessity to use equal quantities: knapsack mixing.

Author’s be aware: If you have no idea what a CoinJoin transaction is or why equal quantities are assumed crucial for mixing, you need to first learn half one of this miniseries — or at the very least learn the primary two sections of that article.

Mixing Versus Paying

As defined in half one of this miniseries, equal-amount bitcoin mixing most likely affords the perfect achievable privateness on the Bitcoin blockchain at this time. But it does go away customers with unequal-change outputs. These don’t provide the identical stage of privateness and will even be a privateness threat. CashFusion may assist take care of these unequal outputs.

But there’s one other downside. The requirement to make use of equal quantities prevents customers from making precise funds by way of CoinJoin transactions: It’s unlikely service provider would cost the precise quantity required within the CoinJoin. So, as a substitute, equal-amount CoinJoins are actually solely used for mixing: Participants put funds in and get the identical quantity of funds again. Unfortunately, because of this mixing requires further blockchain transactions, which value transaction charges and time.

Researchers Felix Konstantin Maurer (of RWTH Aachen University), Till Neudecker and Martin Florian (each of Karlsruhe Institute of Technology) got down to clear up this downside of their 2017 paper titled “Anonymous CoinJoin Transactions with Arbitrary Values.” They proposed a CoinJoin resolution that could possibly be helpful for precise funds — that’s, it makes use of unequal quantities — whereas nonetheless providing privateness.

Named after the knapsack downside, their resolution is known as knapsack mixing.

Knapsack Mixing

Like CashFusion, the core concept behind knapsack mixing is to generate a CoinJoin transaction that may be puzzled collectively into a number of completely different configurations of potential authentic transactions. Different configurations would hyperlink completely different inputs to completely different outputs, thereby breaking the path of cash on the blockchain.

Knapsack mixing achieves this by chopping the unique outputs from the unique transactions into smaller outputs for the CoinJoin transaction. Furthermore, it makes use of comparatively easy tips to guarantee that the smaller outputs lead to a number of potential configurations being attainable.

Maurer, Neudecker and Florian’s paper consists of three variants of knapsack mixing. The first variant is probably the most fleshed out within the white paper itself. The second and third variations are pretty comparable, the place the third model is known as a superior model of the second model. (The authors of the paper solely got here up with the third model in a late stage of writing the paper; it might have most likely been given a extra distinguished place within the research in any other case.)

Let’s take a look at the completely different variants.

Variant One

To clarify the primary variant of knapsack mixing, let’s take a CoinJoin instance from the primary article on this miniseries. Alice needs to pay Carol three.2 cash and has two inputs price 2.three and 1.four cash, respectively. Meanwhile, Bob needs to pay Dave four cash and has two inputs price three and a couple of cash, respectively.

Simplified, these transactions appear like so:

2.three + 1.four = three.2 + zero.5


three + 2 = four + 1

(The zero.5 BTC and 1 BTC outputs are change.)

Merged collectively, the CoinJoin transaction would then appear like so:

three + 2.three + 2 + 1.four = four + three.2 + 1 + zero.5

As identified within the earlier article, the transactions had been merged, however assuming you realize that there are two payers, the quantities could be puzzled collectively in just one configuration: the unique transactions. As such, it’s trivial to rediscover which inputs paid which outputs, defeating the purpose of constructing a CoinJoin.

Knapsack mixing adjustments this. In brief, it makes use of the worth distinction between the 2 authentic transactions to separate an authentic output from the most important transaction into smaller items. This at the very least ensures that there are two configurations, the place most outputs could possibly be linked to any enter.

Let’s take a look at this step-by-step. First, the overall quantity of the outputs are added up per transaction. For Alice and Carol’s transaction, that is 2.three + 1.four = three.7. For Bob and Dave’s transaction, that is three + 2 = 5. Bob and Dave’s transaction is the most important one.

Next, the distinction between the 2 is calculated: 5 – three.7 = 1.three. Then, this distinction is subtracted from the most important transaction. Bob and Dave’s is the most important transaction, and we’ll cut up the four output, so: four – 1.three = 2.7.

Hence, the 4 outputs from the most important transaction is within the CoinJoin cut up into 1.three and a couple of.7.

This time, the CoinJoin seems like so:

three + 2.three + 2 + 1.four = three.2 + 2.7 + 1.three + 1 + zero.5

Now we get again to puzzling…

Of course, the unique configuration continues to be attainable. It’s simply that Dave now receives two outputs as a substitute of 1.

This would appear like so:

2.three + 1.four = three.2 + zero.5


three + 2 = 2.7 + 1.three + 1

But on high of that, a complete new configuration is now attainable:

2.three + 1.four = 2.7 + 1


three + 2 = three.2 + 1.three + zero.5

As a end result, blockchain analysts can now not hyperlink outputs three.2, 2.7, 1 or zero.5 to any enter with certainty! A boon for privateness, though the CoinJoin transaction didn’t use equal quantities.

To add a brand new transaction to the combination, the worth all earlier transactions (put in another way: the prevailing CoinJoin) can be added up as if it had been one transaction. Then, like the primary time round, the worth distinction between these earlier transactions and the brand new transaction can be used to separate an output. And so forth for the subsequent transaction and any further transaction after that.

Variants Two and Three

While variant one in every of knapsack mixing does a very good job of delinking most outputs from any of the inputs, the inputs themselves can nonetheless be linked to different inputs. These units are the identical for each configurations. This isn’t superb for privateness both.

Knapsack mixing variants two and three are particularly designed to unlink the inputs. Variant two does, nonetheless, require that every one members within the CoinJoin be taught one another’s inputs and outputs, which implies it doesn’t truly provide a lot privateness: Variant three fixes this. Yet, for the aim of the article (which focuses on blockchain privateness), the distinction is sufficiently small to cowl each variants directly.

We’re taking the identical examples as above. Alice needs to pay Carol three.2 cash, and Bob needs to pay Dave four cash.


2.three + 1.four = three.2 + zero.5


three + 2 = four + 1

For variants two and three, a “virtual transaction” is generated. This digital transaction doesn’t in any other case exist, however blockchain analysts can be tricked to suppose that it’d.

To create this digital transaction, one enter from every authentic transaction is taken. Then, the worth of those inputs is added up.

For instance, like so:

1.four + 2 = three.four

The worth of our chosen inputs is three.four. Therefore, the worth of the outputs of the digital transaction should even be three.four.

This is simple to perform. We as soon as once more take an output from the most important authentic transaction, which, in our instance, is once more four. We additionally take a look at the output it was initially matched with on this authentic transaction: 1. Then we cut up the large output (four) in order that one of many halves could be mixed with its authentic match (1) to generate the digital worth (three.four). In this case, that signifies that four is cut up into 2.four and 1.6. (After all, 2.four + 1 = three.four.)

Now, the CoinJoin seems like so:

three + 2.three + 2 + 1.four = three.2 + 2.four + 1.6 + 1 + zero.5

Again, primarily based on this CoinJoin, the unique configuration is in fact nonetheless attainable. It’s simply that Dave as soon as once more receives two outputs as a substitute of 1.

This would appear like so:

2.three + 1.four = three.2 + zero.5


three + 2 = 2.four + 1.6 + 1

But on high of that, a brand new “virtual configuration” can also be attainable:

three + 2.three = three.2 + 1.6 + zero.5


2 + 1.four = 2.four + 1

Not solely do completely different configurations match completely different inputs to completely different outputs, completely different configurations additionally match completely different inputs with one another!

Knapsack Weaknesses

Knapsack mixing, primarily based on a easy trick, affords a big privateness enchancment, particularly in comparison with making regular transactions. 

Still, knapsack mixing isn’t fairly as non-public as equal-amount mixes. Equal-amount mixes basically enable for a most quantity of configurations; essentially greater than even the perfect knapsack combine. And maybe extra notably, knapsack mixing nonetheless permits for some linking of sure inputs and outputs — or at the very least extra doubtless linkages.

Indeed, within the examples above, sure inputs and outputs had been matched in each potential configurations. In variant one, the 1.three output was matched with the three and a couple of inputs both manner. So whereas blockchain evaluation wouldn’t reveal what the unique transactions had been, it’d nonetheless reveal a hyperlink between the three and a couple of inputs and the 1.three outputs. Variants two and three, whereas delinking inputs from one another, enable for much more matches between inputs and outputs.

It’s additionally price declaring knapsack CoinJoin for fee requires further outputs and would, subsequently, nonetheless value extra charges than common transactions and even common CoinJoin transactions would. It may require retailers to offer two addresses when they’re paid, as a substitute of only one.

In different phrases, whereas an enchancment over equal-amount mixing with regards to blockspace effectivity and charges, and an enormous enchancment versus common transaction and even common CoinJoin transactions for privateness, knapsack mixing nonetheless comes with a bit of further problem and price.

Author’s be aware: There is a little more to the knapsack mixing proposal, like how the CoinJoin transaction is constructed. There are additionally a number of extra delicate dangers and trade-offs with regards to privateness, like how customers deal with their cash earlier than and after the combination. For simplicity and readability, this text focuses solely on the central and arguably most fascinating concept behind knapsack mixing: unequal-amount mixing.

About Agent

Check Also

New Details on KuCoin’s Legal Troubles in Singapore

New Details on KuCoin’s Legal Troubles in Singapore Last week, Cointelegraph reported that KuCoin’s major …

Leave a Reply

Your email address will not be published. Required fields are marked *