Understanding coinjoin transactions

Entropy

Privacy on Bitcoin

Entropy

The number of interpretations
Entropy
Efficiency
Entropy density
The Boltzmann score
Deterministic links
How do you calculate these indicators?

As we have seen in this section on coinjoins, the homogeneity of UTXOs in both input and output plays a crucial role in enhancing the confidentiality of a Bitcoin transaction. This parameter creates a plausible deniability in the face of blockchain analysis. Several methods can be used to measure this homogeneity, but one of the most effective, in my opinion, is the use of the indicators provided by the Boltzmann tool, developed by the OXT and Samourai Wallet teams, particularly transaction entropy. This is what we examine in detail in this chapter.

Unlike anonsets, which are calculated based on a set of transactions, the indicators presented here focus on a single transaction, whether it is a coinjoin or a more traditional transaction.

The number of interpretations

The first indicator that can be observed in a Bitcoin transaction is the total number of possible interpretations that can be observed when analyzing it from an outside observer. Taking into account the values of the UTXOs involved in the transaction, this indicator shows the number of ways in which inputs can be associated with outputs. In other words, it determines the number of possible interpretations a transaction can elicit from the perspective of an outside observer analyzing it.

For example, a simple payment transaction with one input and two outputs will have only one interpretation: input #0 financed output #0 and output #1. There is no other possible interpretation:

By contrast, a coinjoin structured according to the Whirlpool 5x5 model presents

possible combinations:

A Whirlpool Surge Cycle 8x8 coinjoin has

possible interpretations:

Entropy

From the number of interpretations of a Bitcoin transaction, we can calculate its entropy.

In the general context of cryptography and information, entropy is a quantitative measure of the uncertainty or unpredictability associated with a data source or random process. In other words, entropy measures the difficulty of predicting or guessing a piece of information.

In the specific context of blockchain analysis, entropy is also the name of an indicator, derived from Shannon's entropy and invented by LaurentMT, that can be calculated on a Bitcoin transaction.

When a transaction presents a large number of possible interpretations, it is often more relevant to refer to its entropy. This indicator measures the analysts' lack of knowledge about the exact configuration of the transaction. In other words, the higher the entropy, the more difficult it becomes for analysts to identify the flow of bitcoins between inputs and outputs.

In practice, entropy reveals whether, from an external observer's point of view, a transaction presents multiple possible interpretations, based solely on input and output amounts, without considering other external or internal patterns and heuristics. A high entropy is therefore synonymous with greater confidentiality for the transaction.

Entropy is defined as the binary logarithm of the number of possible combinations. Here's the formula used with

the entropy of the transaction and

the number of possible interpretations:

In mathematics, the binary logarithm (base-2 logarithm) is the inverse operation of the exponentiation of 2. In other words, the binary logarithm of

is the exponent to which

must be raised to obtain

. This indicator is therefore expressed in bits.

Let's take the example of entropy calculation for a coinjoin transaction structured according to the Whirlpool 5x5 model, which, as mentioned in the previous section, has a number of possible interpretations of

Thus, this coinjoin transaction has an entropy of

bits, which is considered very satisfactory. The higher this value, the more diverse interpretations the transaction allows, thereby reinforcing its level of confidentiality.

For a coinjoin 8x8 transaction with

interpretations, the entropy would be:

Let's take another example with a classic payment transaction, with 1 input and 2 outputs: 1b1b0c3f0883a99f1161c64da19471841ed12a1f78e77fab128c69a5f578ccce

In the case of this transaction, the only possible interpretation is: (In.0) > (Out.0; Out.1). Consequently, its entropy is

Efficiency

Based on the transaction's entropy, we can also calculate its efficiency in terms of confidentiality. This indicator evaluates the efficiency of the transaction by comparing it with the optimal transaction that could be envisaged in an identical configuration.

This brings us to the concept of maximum entropy, which corresponds to the highest entropy that a specific transaction structure can theoretically achieve. Transaction efficiency is then calculated by comparing this maximum entropy with the actual entropy of the transaction under analysis.

The formula used is as follows:

: the actual entropy of the transaction expressed in bits;
: the maximum possible entropy for a transaction structure, also expressed in bits;
: transaction efficiency in bits:

For example, for a Whirlpool 5x5 coinjoin structure, the maximum entropy is

This indicator is also expressed as a percentage. The formula used is as follows:

: the number of possible real interpretations;
: the maximum number of possible interpretations of the same structure;
: efficiency expressed as a percentage:

An efficiency of

indicates that the transaction is maximizing its confidentiality potential, depending on its structure.

Entropy density

Entropy is a good indicator for measuring the confidentiality of a transaction, but it depends in part on the number of inputs and outputs in the transaction. To compare the entropy of 2 different transactions with different numbers of inputs and outputs, we can calculate the entropy density. This indicator provides a perspective on the entropy relative to each input or output of the transaction. Density is useful for evaluating and comparing the efficiency of transactions of different sizes.

To calculate it, we simply divide the total entropy of the transaction by the total number of inputs and outputs involved in the transaction:

: entropy density expressed in bits;
: the entropy of the transaction expressed in bits;
: total number of inputs and outputs in the transaction:

Let's take the example of a Whirlpool 5x5 coinjoin:

Let's also calculate the entropy density of an 8x8 Whirlpool coinjoin:

By analyzing the entropy density of these two types of coinjoin, it becomes clear that, even when normalizing entropy by the number of elements, the "Surge Cycle 8x8" coinjoin generates more uncertainty for the analysis.

The Boltzmann score

Another piece of information analyzed in a transaction is the Boltzmann score of each element relative to another. This table displays the matching probabilities between inputs and outputs. This table indicates, through the Boltzmann score, the conditional probability that a specific input is linked to a given output. It is therefore a quantitative measure of the conditional probability that an association between an input and an output in a transaction will occur, based on the ratio of the number of favorable occurrences of this event to the total number of possible occurrences, in a set of interpretations.

Using the example of a Whirlpool coinjoin, the conditional probability table would highlight the chances of a link between each input and output, offering a quantitative measure of the ambiguity of associations in the transaction:

%	Output 0	Output 1	Output 2	Output 3	Output 4
Input 0	34%	34%	34%	34%	34%
Input 1	34%	34%	34%	34%	34%
Input 2	34%	34%	34%	34%	34%
Input 3	34%	34%	34%	34%	34%
Input 4	34%	34%	34%	34%	34%

Clearly, each input has an equal chance of being associated with any output, which reinforces the confidentiality of the transaction.

The Boltzmann score is calculated by dividing the number of interpretations in which a certain event occurs by the total number of interpretations available. Thus, to determine the score associated with input #0 with output #3 (event present in

interpretations), we proceed as follows:

If we take the example of a Whirlpool 8x8 Surge Cycle coinjoin, the Boltzmann table would look like this:

OUT.0	OUT.1	OUT.2	OUT.3	OUT.4	OUT.5	OUT.6	OUT.7
IN.0	23%	23%	23%	23%	23%	23%	23%
IN.1	23%	23%	23%	23%	23%	23%	23%
IN.2	23%	23%	23%	23%	23%	23%	23%
IN.3	23%	23%	23%	23%	23%	23%	23%
IN.4	23%	23%	23%	23%	23%	23%	23%
IN.5	23%	23%	23%	23%	23%	23%	23%
IN.6	23%	23%	23%	23%	23%	23%	23%
IN.7	23%	23%	23%	23%	23%	23%	23%

However, in the case of a simple transaction with a single input and 2 outputs, the situation is different:

%	Output 0	Output 1
Input 0	100%	100%

Here, we see that the probability of each output originating from input #0 is 100%. A lower probability thus reflects greater confidentiality, diluting the direct links between inputs and outputs.

Deterministic links

We can also calculate the number of deterministic links in a transaction. This indicator reveals the percentage of connections between inputs and outputs in the analyzed transaction that are unquestionable, with a probability of 100%. This indicator can then be completed by calculating the ratio of deterministic links. The ratio provides insight into the weight of these deterministic links within the transaction's total links.

For example, a Whirlpool coinjoin transaction has no deterministic links between inputs and outputs, and therefore displays an indicator of 0 links and a ratio of 0%. Conversely, in our second simple payment transaction examined (with one input and two outputs), the indicator indicates that there are two deterministic links, and the ratio reaches 100%. In other words, a zero indicator indicates excellent confidentiality, thanks to the absence of direct and indisputable links between inputs and outputs.

How do you calculate these indicators?

Calculating these indicators manually using the provided equations is relatively straightforward. The difficulty lies mainly in determining the number of possible interpretations of a transaction. For a classic transaction, this calculation can be performed manually. For a coinjoin, however, the task is far more complex.

Previously, there was a Python tool called Boltzmann Calculator, developed by the OXT and Samourai teams, which automatically calculated all these indicators for a Bitcoin transaction:

It was also possible to use the KYCP.org website for these analyses:

Unfortunately, following the arrest of Samourai's founders, these tools are no longer operational.

Now that we've covered coinjoins in detail, we'll look at the other privacy techniques available on Bitcoin in the final section of our course. We'll be examining payjoins, specific pseudo-coinjoin transaction types, static address protocols, as well as measures to enhance confidentiality not at the level of the transactions themselves, but at the level of the network of nodes.

Quiz

btc2045.6

1/5

What does the Boltzmann score represent in the context of Bitcoin transactions?