CoinShuffle: Practical Decentralized Coin Mixing for Bitcoin

[coinzcoinzcoinz]

Is this system better than DarkCoin (which is not CoinJoin like many people believe)?

[1713969198]

1713969198

[1713969198]

1713969198

[1713969198]

1713969198

[mr_random]

Is this system better than DarkCoin (which is not CoinJoin like many people believe)?

Has the DarkCoin mixing algorithm been made open source?

[coinzcoinzcoinz]

Is this system better than DarkCoin (which is not CoinJoin like many people believe)?

Has the DarkCoin mixing algorithm been made open source?

Kristov Atlas reviewed it, you might want to read it. Or wait a week, since open source is in a week.

[CoinHeavy]

Is anyone aware of ongoing blockchain forensics tracking notable coins?
Have pretty much all stolen/hacked/scammed coins been obfuscated via mixing/shuffling?

[kingscrown]

paper looks pretty solid

[rocks]

Is a full working version of coinshuffle being developed? The research site says the current version was just a proof of concept for testing and not usable for real coins.

[instagibbs]

Is a full working version of coinshuffle being developed? The research site says the current version was just a proof of concept for testing and not usable for real coins.

Amir says it's being worked on for Dark Wallet.

[oriolpont]

Is a full working version of coinshuffle being developed? The research site says the current version was just a proof of concept for testing and not usable for real coins.

Amir says it's being worked on for Dark Wallet.

I thought they were implementing CoinJoin instead. EDIT: true, Amir confirmed that: https://www.reddit.com/r/Bitcoin/comments/2ijsw1/the_coming_of_darkwallet/cl2qow6

On the other hand, I see a problem with CoinShuffle. The participants are supposed to sign their messages "with their addresses"; this assumes that the inputs they provide were paid to standard P2PH addresses, but they cannot use outputs sent to P2SH (those starting with a 3, e.g., "multi sig" addresses). Participants could still be required to reveal their script and then sign their handshaking rounds with a key contained there (if there is any).

[LondonMP]

Fibrecoin developed and released a privacy solution that is based on CoinShuffle
https://bitcointalk.org/index.php?topic=737771.msg10834848#msg10834848

[Joshuar]

Is this system better than DarkCoin (which is not CoinJoin like many people believe)?

Dark uses coinjoin. A system like this would eliminate Dark and all the other altcoins using coinjoin.

[rocks]

Is a full working version of coinshuffle being developed? The research site says the current version was just a proof of concept for testing and not usable for real coins.

Amir says it's being worked on for Dark Wallet.

I thought they were implementing CoinJoin instead. EDIT: true, Amir confirmed that: https://www.reddit.com/r/Bitcoin/comments/2ijsw1/the_coming_of_darkwallet/cl2qow6

On the other hand, I see a problem with CoinShuffle. The participants are supposed to sign their messages "with their addresses"; this assumes that the inputs they provide were paid to standard P2PH addresses, but they cannot use outputs sent to P2SH (those starting with a 3, e.g., "multi sig" addresses). Participants could still be required to reveal their script and then sign their handshaking rounds with a key contained there (if there is any).

Darkwallet's webpage still lists coinjoin as their shuffling method. Anyone know the status of Dark Wallet's coinshuffle implementation or any other implementations?
https://www.darkwallet.is/

[TwinWinNerD]

NXT has implemented CoinShuffle now. It will be available in the next major release (1.6.x)

[CohibAA]

I've followed the JoinMarket project which I recently discovered, but I just came across this.  Is this project still active, and if so, where can I find current information?  How would this compare to JoinMarket transactions?

[jl777]

Jumblr implements a fully decentralized coinshuffle. The fee is 0.1% for bitcoin, it should work for other coins also, but bitcoin shuffling is the only one that matters.

I am looking for someone to head up the marketing for this. It just went into testing this weekend.

It uses the InstantDEX/SuperNET network for the directory, but the actual coinshuffle is all between the participating nodes.

James

[TimRuffing]

I've followed the JoinMarket project which I recently discovered, but I just came across this.  Is this project still active, and if so, where can I find current information?  How would this compare to JoinMarket transactions?

Quoting myself:

I've just started a collaboration with Kristov Atlas. We will write a BIP draft including a more detailed, development-oriented specification of the protocol including all the nitty-gritty details. We also plan talk to wallet developers and I will definitively write some code as soon as a reasonable version of the BIP is there. Contributions and collaborations are welcome in all stages, of course.

We'll provide more information, including a mailing list, soon.

Regarding JoinMarket, I'm not sure. It seems that it is not so sophisticated as CoinShuffle, but that's rather a first guess. Is there a technical description of how it works under the hood? I can only find descriptions of how to use it.
Also, JoinMarket seems to understand the problem as a economic one and someone is gets fees for enabling the mixing. CoinShuffle is different here, the participants just pay the single transactions fee for the CoinJoin transaction, which is very low and can even be split among all participants. But there is no party that gets an additional mixing fee (on top of the transaction fee).

[smoothie]

I was just pointed here from the joinmarket IRC and wonder if there is anything to add to the OP? Is there code being worked on? Is it production ready?

Bitcoin needs improved fungibility and it needs it yesterday. I remember how back in the days of BitcoinSpinner a trade partner told me that I had $xxx going through my address, which I wasn't aware at that point, and bip44 only marginally improves the situation. Most people using bitcoin today, assuming privacy, will have a surprise once they realize how horrible the bitcoin privacy actually is.

I see a couple of issues with this approach:

1. You need other participants in order to use coinshuffle. What happens when no one at the moment wants to coinshuffle X amount of Bitcoins with you? Do you just wait around?

2. Given the huge political hurdle of adding anything at the bitcoin protocol level..I presume this is not going to be at the protocol level?

Bitcoin will never truly be fungible until changes at the protocol level are made for all bitcoins in existence.

[giszmo]

Quoting myself:

I've just started a collaboration with Kristov Atlas. We will write a BIP draft including a more detailed, development-oriented specification of the protocol including all the nitty-gritty details. We also plan talk to wallet developers and I will definitively write some code as soon as a reasonable version of the BIP is there. Contributions and collaborations are welcome in all stages, of course.

We'll provide more information, including a mailing list, soon.

Regarding JoinMarket, I'm not sure. It seems that it is not so sophisticated as CoinShuffle, but that's rather a first guess. Is there a technical description of how it works under the hood? I can only find descriptions of how to use it.
Also, JoinMarket seems to understand the problem as a economic one and someone is gets fees for enabling the mixing. CoinShuffle is different here, the participants just pay the single transactions fee for the CoinJoin transaction, which is very low and can even be split among all participants. But there is no party that gets an additional mixing fee (on top of the transaction fee).

Hi TimRuffing and Kristov Atlas,

sorry for having missed this last post somehow in my other comment.

I'd really love to help with such a reference implementation, with a wallet-integration-perspective. At Mycelium we see fungibility as a very urgent issue and having worked on a JoinMarket Proxy myself, I feel like JoinMarket might be a dead end precisely due to what CoinShuffle claims to solve. At least from the Wallet-perspective.

For this, I wonder what harm would be done if the current state of implementation was already public for others to tinker with.

I'm particularly interested in ease of integration with wallets and my focus in Joinmarket there was to not share private keys with the mixing module, which in the link above was a server but for mobile wallets could be an app working like the orbot TOR proxy locally on the device.

[USB-S]

This loos nice, but if we need to change the core protocol for this, than I'm not really down. We have several altcoins to do exactly this.

[giszmo]

This loos nice, but if we need to change the core protocol for this, than I'm not really down. We have several altcoins to do exactly this.

It's one of it's properties to not need a protocol change. All the blinding and shuffling happens outside of the protocol and then all parties sign the resulting transaction which again is just a regular coinjoin transaction.

The reason they are working on a BIP is probably to standardize the process, not to hard-fork bitcoin.

[gmaxwell]

I feel like JoinMarket might be a dead end precisely due to what CoinShuffle claims to solve.

That is remarkably inexplicable to me.  JM is very actively developed by a community of developers. It was created with basically no anti-DOS mechanisms, though the original CJ post (technically the "appendix" post I made right below it) went over several different anti-DOS mechanisms, because it's perfectly reasonable to get something working before making it strong-- especially since JM's main motivation is gumming up automated analysis more than itself providing strong privacy.

But it's quite straight-forward to add in strong anti-DOS and better privacy, on top of a working and vibrant system; doubly so in that the coinshuffle description provides no special structural immunity to those dos attacks: the same anti-dos mechanisms are needed.  You shouldn't let that fact that a single person in the JM space is advocating one anti-dos method that would harm casual usage as at all indicative of ... well, anything.