Understanding the challenges of other advanced confidentiality techniques

Payment mini-coinjoin

Privacy on Bitcoin

Payment mini-coinjoin

The Stonewall transaction
What are the objectives of a Stonewall transaction?
The Stonewall transaction x2
What are the objectives of a Stonewall x2 transaction?
What's the difference between Stonewall and Stonewall x2?
When should Stonewall and Stonewall x2 transactions be used?
How do I use Stonewall and Stonewall x2 transactions?

When you want to carry out a payment transaction while maintaining a certain degree of confidentiality, Payjoin is a good option. However, as we've just seen, Payjoin requires the recipient's involvement. So, what do you do if the recipient refuses to participate in a pay join, or if you simply prefer not to involve them? One alternative is to use a Stonewall or Stonewall x2 transaction. Let's take a closer look at these two types of transactions.

The Stonewall transaction

Stonewall is a specific form of Bitcoin transaction designed to increase user confidentiality when spending by imitating a pseudo-coinjoin between two people, without actually being one. In fact, this transaction is not collaborative. A user can build it on their own, using only the UTXOs they own as inputs. You can create a Stonewall transaction for any occasion without needing to synchronize with another user or the recipient.

The Stonewall transaction works as follows: as input to the transaction, the issuer uses 2 UTXOs that belong to him. Upon output, the transaction produces 4 UTXOs, 2 of which are identical in amount. The other 2 UTXOs will constitute the change. Of the two outputs of the same amount, only one will actually be sent to the payee.

So there are only 2 roles in a Stonewall transaction:

The issuer, who makes the payment;
The recipient, who may be unaware of the specific nature of the transaction and simply expects payment from the sender.

Let's take an example to understand this transaction structure. Alice goes to Bob the baker to buy her baguette, which costs 4,000 sats. She wants to pay in Bitcoin, while maintaining some form of confidentiality regarding her payment. So she decides to build a Stonewall transaction for the payment.

By analyzing this transaction, we can see that Bob the baker actually received 4,000 sats in payment for the baguette. Alice used 2 UTXOs as inputs: one for 10,000 sats and one for 15,000 sats. In outputs, she has recovered 3 UTXOs: one for 4,000 sats, one for 6,000 sats, and one for 11,000 sats. Alice therefore has a net balance of -4,000 sats on this transaction, which corresponds to the price of the baguette.

In this example, I have intentionally omitted the mining fees to simplify the explanation. In reality, transaction costs are borne entirely by the issuer.

What are the objectives of a Stonewall transaction?

The Stonewall structure introduces a significant amount of entropy to the transaction, blurring the lines of chain analysis. Seen from the outside, such a transaction might be interpreted as a mini-coinjoin between two people. But in reality, it's a payment. This method, therefore, creates uncertainties in chain analysis or even leads to false leads.

Let's take the example of Alice at Bob the baker's. The transaction on the blockchain would look like this:

An outside observer relying on common chain analysis heuristics might wrongly conclude that "two people have made a small coinjoin, with one UTXO each in input and two UTXOs each in output". Analyzing this transaction from the outside does not lead to the application of the CIOH, as the presence of two outputs of the same amount suggests a coinjoin pattern. From an external perspective, the CIOH is therefore not applicable in this specific case.

This interpretation is inaccurate because, as you know, one UTXO was sent to Bob the baker; the two UTXO inputs came from Alice, and she recovered three change outputs.

And what's particularly interesting about the structure of the Stonewall transaction is that, from the point of view of an outside observer, it resembles that of a Stonewall x2 transaction in every way.

The Stonewall transaction x2

Stonewall x2 is another specific form of Bitcoin transaction that also aims to increase user confidentiality when making a spend, but this time by collaborating with a third person not involved in that spend. This method works like a pseudo-coinjoin between two participants, while simultaneously making a payment to a third person.

The operation of the Stonewall x2 transaction is relatively simple: we use a UTXO in our possession to make the payment and enlist the help of a third party who also contributes a UTXO belonging to them. The transaction results in four outputs: two of equal amounts, one directed to the payee's address, and the other to an address belonging to the collaborator. A third UTXO is returned to another address belonging to the collaborator, enabling them to recover the initial amount (a neutral action for them, modulo the mining costs), and a final UTXO is returned to an address belonging to us, which constitutes the payment change.

Three different roles are thus defined in Stonewall x2 transactions:

The issuer, who makes the actual payment;
The recipient, who may be unaware of the specific nature of the transaction and simply expects payment from the sender;
The collaborator, who makes bitcoins available in order to cast doubt on the analysis of the transaction, while recovering his funds in full at the end (a neutral action for him, modulo the mining costs).

Let's go back to our example with Alice, who is at Bob the baker's to buy her baguette, which costs 4,000 sats. She wants to pay in Bitcoin while maintaining a certain level of confidentiality regarding her payment. So she calls on her friend Charles, who will help her in this process.

Analyzing this transaction, we can see that Bob the baker actually received 4,000 sats in payment for the baguette. Alice used 10,000 sats as input and recovered 6,000 sats as output, resulting in a net balance of -4,000 sats, which corresponds to the price of the baguette. As for Charles, he provided 15,000 sats as input and received two outputs: one of 4,000 sats and the other of 11,000 sats, resulting in a balance of 0.

In this example, I've intentionally left out the fees to make it easier to understand. In reality, mining fees are generally shared equally between the issuer of the payment and the contributor.

What are the objectives of a Stonewall x2 transaction?

Similar to the Stonewall structure, the Stonewall x2 structure introduces significant entropy to the transaction, complicating the chain analysis. Seen from the outside, such a transaction can be interpreted as a little coinjoin between two people. But in reality, it's a payment. This method, therefore, creates uncertainties in chain analysis or even leads to false leads.

Let's take the example of Alice, Bob the baker, and Charles. The transaction on the blockchain would look like this:

An outside observer relying on common chain analysis heuristics might wrongly conclude that "Alice and Charles have performed a small coinjoin, with one UTXO each in input and two UTXOs each in output". Again, analyzing this transaction from the outside does not lead to the application of the ICOH, as the presence of two outputs of the same amount suggests a coinjoin pattern. From an external perspective, the CIOH is therefore not applicable in this specific case.

This interpretation is incorrect because, as you know, one UTXO has been sent to Bob the baker, Alice has only one change output, and Charles has two.

And once again, what's particularly interesting about the structure of the Stonewall x2 transaction is that, from the point of view of an outside observer, it resembles that of a Stonewall transaction in every way.

What's the difference between Stonewall and Stonewall x2?

A StonewallX2 transaction works exactly like a Stonewall transaction, except that the former is collaborative, whereas the latter is not. As we have seen, a Stonewall x2 transaction involves the participation of a third party (Charles), who is external to the payment, and who will make his bitcoins available to enhance the transaction's confidentiality. In a classic Stonewall transaction, the role of the collaborator is taken on by the sender.

From an external perspective, the transaction pattern remains the same.

The fact that these two transaction structures share exactly the same pattern means that even if an outside observer manages to identify a "Stonewall(x2)" pattern, he won't have all the information. He won't be able to determine which of the two UTXOs of the same amount corresponds to the payment. Furthermore, he won't be able to determine whether the two UTXOs with inputs come from two different people (Stonewall x2) or whether they belong to a single person who has merged them (Stonewall).

This last point is due to the fact that Stonewall x2 transactions follow exactly the same pattern as Stonewall transactions. Seen from the outside, and without additional contextual information, it's impossible to differentiate a Stonewall transaction from a Stonewall x2 transaction. The former are not collaborative transactions, whereas the latter are. This adds even more doubt to the analysis of one of these transactions.

When should Stonewall and Stonewall x2 transactions be used?

The logic should be as follows when you want to use a confidentiality tool for an expense:

As a priority, we can choose to make a payjoin.
If the merchant does not support payjoins, a collaborative transaction can be made with another person outside the payment using the Stonewall x2 structure.
If you can't find anyone to make a Stonewall x2 transaction, you can make a Stonewall only transaction, which will mimic the behavior of a Stonewall x2 transaction.

How do I use Stonewall and Stonewall x2 transactions?

Stonewall transactions are available on Sparrow Wallet as well as on Ashigaru, whereas Stonewall x2 is currently supported only by Ashigaru.

It is also possible to carry out this type of transaction manually from any Bitcoin wallet software.

In the next chapter, we'll take a look at another confidentiality technique that's relatively unknown but very useful as a complement to what we've already studied.

Ashigaru - StonewallUnderstanding and using Stonewall transactions on Ashigaru

Sparrow Wallet - StonewallUnderstanding and using Stonewall transactions on Sparrow

Ashigaru - Stonewall x2Understanding and using Stonewall x2 transactions on Ashigaru

Quiz

btc2046.2

1/5

What is the role of the collaborator in a Stonewall x2 transaction?