Privacy Flashcards
Unlinkability
Two transactions of individual cant be linked together
Anonymity of transactions
transaction cant be linked to entity
Heuristic 1
If multiple utxos are used for the input of a new transaction they probably belong together
Heuristic2
If a utxo belongs to address A and it is used in a transaction where coins are sent to an address B which already existed and another new address A’ than A’ is probably the change and belongs with A
Address unlinkability in bitcoin
An attack A should not be able to significantly outperform a random answer
What is a mixer
Mixers are entities that mix transactions via a mixing address. Problem is that the mixing entity cannot be trusted and thus could steal coins
Coinjoin
n users transfer funds from n inputs to n output addresses in a single transaction signed by every users key.
=> no user would sign if their transaction if its own output address is not present
CrytoNote
Application layer protocol which can be integrated with decentralized currencies:
To prevent sender identification senders output are grouped with output of others
Sender needs to assure network that he possesses atleast one of the private keys that corresponds to group of public keys+
Receiver anonymity is achieved by creating unique key for each transaction based on secrets from sender and receiver
Zerocoin
Zero Knowledge Proof protocol
prevent linking between input and output
are proven in zero knowledge to have originated from a valid and unspent btc
Bitcoins have to be minted to become zerocoins
Interactive Zero Knowledge Proof
Send, receive messages and perform private computations of t rounds (value challenge response scheme). Verifier cant learn anything from protocol and could simulate proof themself
Properties of ZKP
Verifier accepts proof if assertion is true, parties follow protocol
if fact is false verifier rejects proof if parties follow protocol
Ali babas cave
Proof that you know secret door by repeatedly coming out of the correct side of the cave
Protocol ZKP
- Alice picks random k and sends commitment C = f(k) to Bob
- Bob picks Challenge 0 or 1 and sends to Alice
- Alice computes Response y = k if challenge = 0 y = k + s mod n if challenge 1
- Bob checks f(y) = C if challenge = 0 C * S if challenge = 1
zkp for auth
Completeness: A prover will be able to convice with prob of 1
Soundness: Alice can only answer 1 of 2 challenges correctly
ZK: Pairs of (C,y) can be simulated by B alone by choosing y at random then defining C = f(y) or C = f(y)/S
Non interactive ZKPs
Make protocol non-interactive by making challenge of the verifier depend on value of the challenge (hash of message and challenge). Then make send m r s with r = g^s y^(-h(m||r)
