Progress pill
Understanding coinjoin transactions

Zerolink and Chaumian coinjoins

Privacy on Bitcoin

Zerolink and Chaumian coinjoins

  • Chaum's blind signatures
  • Chaumian coinjoins
  • Who invented the coinjoin concept?
  • Zerolink
The privacy provided by a coinjoin is earned by the size of the group in which our UTXO is hidden. This means finding as many participants as possible. It's perfectly possible to create a coinjoin manually, but this is a complex process that won't yield any significant anonsets.
This is why coinjoin coordinators have developed on Bitcoin. Their role is to connect various users with each other and transmit the necessary information to facilitate the collaborative transaction.
But how can we ensure that the coordinator never has access to users' bitcoins? And despite the fact that he's the person building the coinjoin transaction, how can we prevent him from linking users' inputs and outputs, which could constitute a confidentiality leak?

Chaum's blind signatures

Modern coinjoin implementations utilize David Chaum's blind signatures to prevent information leakage. Let's take a quick look at how these blind signatures work.
Chaum's blind signatures are a form of digital signature in which the issuer of a signature does not know the content of the message he is signing. But the signature can then be verified against the original message. This technique was developed by cryptographer David Chaum in 1983.
Let's consider the example of a company that wishes to authenticate a confidential document, such as a contract, without revealing its contents. The company applies a masking process that cryptographically transforms the original document in a reversible way. This modified document is sent to a certification authority, which affixes a blind signature without being aware of the underlying content. After receiving the signed document, the company unmasks the signature. The result is an original document authenticated by the authority's signature, without the authority ever having seen the original content.
Chaum's blind signatures can therefore certify the authenticity of a document without knowing its content, thus guaranteeing both the confidentiality of the user's data and the integrity of the signed document.

Chaumian coinjoins

So-called "Chaumian" coinjoins combine the use of Tor and David Chaum's blind signatures to ensure that the coordinator can't know which output belongs to which user.
The coinjoin transaction construction process involves 3 main stages: input registration, output registration, and transaction signature. Let's look at this process through the example of Alice, one of the coinjoin participants. All the other participants follow the same steps as Alice, each on their own.
Step 1: Input registration
  • Alice transmits to the coordinator the UTXO she wishes to use as input to the transaction, as well as the masked receive address she wishes to use as output to receive her bitcoins. The coordinator, therefore, has no way of knowing Alice's address. It only sees her masked version:
  • The coordinator checks the validity of the inputs, then signs Alice's masked address with his private key. He returns the blind signature to Alice:
Step 2: Outputs registration
  • Alice can unmask her address, now signed by the coordinator's private key. She will establish a new connection under a different Tor identity. The coordinator can't identify that it's Alice who's connecting under this new identity:
  • Alice sends the unmasked address and signature to the coordinator (who still doesn't know it's Alice):
Step 3: Signing the transaction
  • In the same way, the coordinator retrieves unmasked outputs from all participants. Thanks to the associated signatures, he can check that each anonymously submitted output has been signed by his private key beforehand, thus guaranteeing their legitimacy. He is then ready to build the coinjoin transaction and sends it to the participants for signature:
  • Alice, like the other participants, checks that her input and output are correctly included in the transaction constructed by the coordinator. If everything is satisfactory, she sends the signature that unlocks her input script to the coordinator:
  • After collecting signatures from all coinjoin participants, the coordinator can broadcast the transaction on the Bitcoin network, so that it can be added to a block.
In this system, the coordinator is unable to link an input to a specific output. Furthermore, he can't appropriate participants' funds, as he never has access to the private keys required to unlock their UTXOs. Throughout the process, until the end of step 3, he also has no access to the signatures. When Alice and the other participants sign the global transaction, after checking that everything is correct, the coordinator can no longer modify the transaction, including the outputs, without invalidating it. This prevents the coordinator from stealing bitcoins.
Finally, when registering their output in the transaction, the coinjoin users wish to have guarantees similar to those of a citizen voting in an election. There is a duality between the public and private aspects of these actions. On the one hand, there's what you want to keep private: for the voter, they do not want their ballot to be linked to their identity; for the coinjoin user, they do not want their output to be associated with their input. Indeed, if the coordinator, or any other party, manages to establish a link between an input and an output, the coinjoin loses all interest. As explained above, the coinjoin must function as a break in the history of a coin. This stop occurs precisely because of the impossibility of associating a specific input with a specific output in the coinjoin transaction (forward anonset) and vice versa (backward anonset).
On the other hand, there's the public aspect: the voter wants to ensure that their ballot is included in the ballot box; similarly, the coinjoin user wants to ensure that their output is included in the coinjoin transaction. Indeed, coinjoin participants absolutely must be able to verify the presence of their output before signing the transaction; otherwise, the coordinator could steal the funds.
It is precisely these 2 public and private aspects, enabled by the use of David Chaum's blind signatures, that guarantee participants in Chaumian coinjoins that their bitcoins will not be stolen, and that their funds cannot be traced.

Who invented the coinjoin concept?

It's difficult to determine who first introduced the coinjoin idea to Bitcoin and who conceived the idea of utilizing David Chaum's blind signatures in this context. It's often thought that it was Gregory Maxwell who first mentioned it in a message on BitcoinTalk in 2013:
"Using Chaum's blind signatures: Users log in and provide inputs (and exchange addresses) as well as a cryptographically blinded version of the address to which they wish to send their private UTXOs; the server signs the tokens and sends them back. Users reconnect anonymously, unmask their output addresses, and send them back to the server. The server can verify that all outputs have been signed by it and, consequently, that all outputs originate from valid participants. Later, people reconnect and sign in" Maxwell, G. (2013, August 22). CoinJoin: Bitcoin privacy for the real world. BitcoinTalk Forum. https://bitcointalk.org/index.php?topic=279249.0
However, there are other earlier mentions, both for Chaum signatures as UTXOs of mixing, as well as for coinjoins. In June 2011, Duncan Townsend presented on BitcoinTalk a mixer that uses Chaum signatures in a manner quite similar to modern Chaumian coinjoins.
In the same thread, we can find a message from hashcoin in response to Duncan Townsend to improve his mixer. The process described in this message is exactly what coinjoins are all about. A similar system is also mentioned in a message from Alex Mizrahi in 2012, where he advised the creators of Tenebrix, one of the first altcoins that served as the basis for later creating Litecoin. Even the term "coinjoin" itself is said not to have been coined by Greg Maxwell, but to have come from an idea by Peter Todd.

Zerolink

Zerolink is a comprehensive mixing protocol that incorporates Chaumian coinjoins and various strategies to protect users' anonymity against several forms of chain analysis, in particular by minimizing errors associated with wallet management. This protocol was introduced by nopara73 and TDevD in 2017.
As its name suggests, the principle behind Zerolink is to create coinjoin transactions, which ensure that the links between inputs and outputs cannot be traced. This is achieved by ensuring that all outputs have perfectly identical amounts.
A crucial preventive measure taken by Zerolink is to keep unmixed UTXOs completely separate from mixed UTXOs by using separate cryptographic key sets or even separate wallets. This differentiates the "pre-mix" wallet, intended for UTXOs before mixing, from the "post-mix" wallet, reserved for UTXOs that have been mixed.
This rigorous separation of UTXOs serves above all to prevent accidental associations between a mixed UTXO and an unmixed UTXO. Indeed, if such links occur, the effectiveness of the coinjoin on the mixed UTXO is compromised without the user being aware of it, thus jeopardizing the confidentiality of a UTXO whose history they thought they had broken. These links can occur either through address reuse on the securing of a mixed UTXO with an unmixed one, or through the application of CIOH (Common-Input-Ownership Heuristic), if the user consumes mixed and unmixed UTXOs as inputs to the same transaction. By separating the pre-mix and post-mix wallets, we avoid such accidental associations and protect the user against unintentional errors.
This separation also allows for the application of distinct rules between pre-mix and post-mix wallets at the wallet software level. For example, in the post-mixing wallet, the software can prohibit the merging of UTXOs into inputs to prevent the application of CIOH, which would compromise the user's anonset. It is also possible to standardize the use of scripts and transaction options (such as RBF reporting, for example) to prevent identification by wallet fingerprints.
Currently, Whirlpool is the only coinjoin implementation that rigorously applies the Zerolink protocol. In the next chapter, we'll take a look at the various coinjoin implementations that exist, and the advantages and disadvantages of each.
Quiz
Quiz1/5
What cryptographic method is used to prevent the coordinator from linking the inputs and outputs in a coinjoin?