Does Wasabi wallet coordinate their coinjoins on their servers?

[markcolls]

Joinmarket coordinates its coinjoins via IRC. How does Wasabi wallet coordinate their coinjoins? If they are coordinating the coinjoin on servers they control then isn't it possible to know which output address belongs to who? Also, the same goes for IRC. If we look at the IRC logs couldn't we tell which output address belongs to which contributor?

[NeuroticFish]

From what I've read they have a server that does this for a small fee.
I'll quote the relevant part from the doc, but I think that you should read it all from bitcoin wiki: https://en.bitcoin.it/wiki/Wasabi_Wallet
Also from what I've read on that same page, Wasabi uses ToR.
I don't know how Joinmarket works, there I can't help.

Users' wallets connect to a server which coordinates the CoinJoin, that is run by the zkSNACKs Ltd. company. The company sponsors the development of Wasabi Wallet and makes its income by taking a fee (0.003% * anonymity set) from each CoinJoin transaction.

[ABCbits]

If they are coordinating the coinjoin on servers they control then isn't it possible to know which output address belongs to who?

Good question, but coordinator wouldn't know which output belongs to whom because it uses Chaumian CoinJoin. Here's short explanation from Wasabi docs.

A Chaumian CoinJoin is a special type of CoinJoin that utilizes Chaumian [or Schnorr] blind signatures to prevent the central coordinator from spying on the linkage between inputs and outputs.

If you're interested with how it works in detail, check https://github.com/zkSNACKs/WabiSabi or https://docs.wasabiwallet.io/using-wasabi/CoinJoin.html#zerolink-protocol-step-by-step

[markcolls]

If they are coordinating the coinjoin on servers they control then isn't it possible to know which output address belongs to who?

Good question, but coordinator wouldn't know which output belongs to whom because it uses Chaumian CoinJoin. Here's short explanation from Wasabi docs.

A Chaumian CoinJoin is a special type of CoinJoin that utilizes Chaumian [or Schnorr] blind signatures to prevent the central coordinator from spying on the linkage between inputs and outputs.

If you're interested with how it works in detail, check https://github.com/zkSNACKs/WabiSabi or https://docs.wasabiwallet.io/using-wasabi/CoinJoin.html#zerolink-protocol-step-by-step

How can we be sure that Wasabi is using Chaumian CoinJoin? Couldn't they be saying they are using Chaumian CoinJoin, but are using a different kind of coinjoin and recording which outputs belong to whom?

[cosmofly]

If they are coordinating the coinjoin on servers they control then isn't it possible to know which output address belongs to who?

Good question, but coordinator wouldn't know which output belongs to whom because it uses Chaumian CoinJoin. Here's short explanation from Wasabi docs.

A Chaumian CoinJoin is a special type of CoinJoin that utilizes Chaumian [or Schnorr] blind signatures to prevent the central coordinator from spying on the linkage between inputs and outputs.

If you're interested with how it works in detail, check https://github.com/zkSNACKs/WabiSabi or https://docs.wasabiwallet.io/using-wasabi/CoinJoin.html#zerolink-protocol-step-by-step

How can we be sure that Wasabi is using Chaumian CoinJoin? Couldn't they be saying they are using Chaumian CoinJoin, but are using a different kind of coinjoin and recording which outputs belong to whom?

Wow, this is getting more stressful. Wasabi wallet has really shown their shady in recent transactions. I realize that people in their community are having the same question and admins are still unable to answer it clearly.
So if you have money left in Wasabi, withdraw it before any bad news hits you. This crypto market can happen anything, so safety is foremost.

[nopara73]

How can we be sure that Wasabi is using Chaumian CoinJoin? Couldn't they be saying they are using Chaumian CoinJoin, but are using a different kind of coinjoin and recording which outputs belong to whom?

It does not matter what code the coordinator runs, because the client ensures it doesn't expose information.

Here's a brief explanation by gmaxwell:

> Using chaum blind signatures: The users connect and provide inputs (and change addresses) and a cryptographically-blinded version of the address they want their private coins to go to; the server signs the tokens and returns them. The users anonymously reconnect, unblind their output addresses, and return them to the server. The server can see that all the outputs were signed by it and so all the outputs had to come from valid participants. Later people reconnect and sign. - https://bitcointalk.org/index.php?topic=279249.0

Also it may be interesting to note that we'll move away from blind signatures in the future. You may have noticed that this scheme is quite limiting, so we're in the middle of researching a new protocol that isn't: https://github.com/zkSNACKs/WabiSabi/