Bitcoin and Anonymity Bitcoin and Anonymity

39 Pages·2017·3.52 MB·English

by  Riccardo Bettati

Cryptocurrency Technologies Bitcoin and Anonymity
Bitcoin and Anonymity

•  Anonymity Basics

•  How to de-anonymize Bitcoin

•  Mixing

•  Decentralized Mixing

•  Zerocoin and Zerocash

•  Tor and the Silk Road

Bitcoin and Anonymity

•  Anonymity Basics

•  How to de-anonymize Bitcoin

•  Mixing

•  Decentralized Mixing

•  Zerocoin and Zerocash

•  Tor and the Silk Road

1
Cryptocurrency Technologies Bitcoin and Anonymity
Some say Bitcoin provides Anonymity

Others say it doesn’t

2
Cryptocurrency Technologies Bitcoin and Anonymity
Let’s get the Terminology straight

•  Literally: anonymous = “without a name”

•  Recall: Bitcoin addresses are public key hashes rather
than real identities

•  Computer scientists call this pseudonymity

Anonymity in Computer Science

anonymity = pseudonymity + unlinkability

Different interactions of the same user with the
system should not be linkable to each other.

3
Cryptocurrency Technologies Bitcoin and Anonymity
Pseudonymity vs. Anonymity: Examples

Reddit: pick a long-term pseudonym

vs.

4Chan: make posts with no attribution at al
l
Why care about Unlinkability?

1.  Many Bitcoin services require real identity.

2.  Linked profiles can be de-anonymized by a
variety of side channels.

4
Cryptocurrency Technologies Bitcoin and Anonymity
Defining Unlinkability in Bitcoin

Hard to link different addresses of the same user.

Hard to link different transactions of the same user.

Hard to link sender of a payment to its recipient.

Quantifying Anonymity

Observation: Complete unlinkability (among all addresses/
transactions) is hard!

Vanilla Measure for “partial” Anonymity:

Anonymity Set: The crowd that one attempts to “blend”
into.

Q: How to calculate anonymity set?

•  Define adversary model.

•  Reason carefully about what adversary knows, does not
know, and cannot know.

5
Cryptocurrency Technologies Bitcoin and Anonymity
Why Worry about Anonymity?

Observation: Block chain based currencies are
totally, publicly, and permanently traceable

Without anonymity, privacy in such currencies is
much worse than traditional banking!

So, what about Money Laundering?
!
Money Laundering is a legitimate worry.

So, why is not more done about it?
!
“Cashing-Out” Problem: bottleneck is with moving
large flows into and out of Bitcoin.

Not unique to Bitcoin!

Improving Anonymity does not solve cashing-out
problem.

6
Cryptocurrency Technologies Bitcoin and Anonymity
Can we keep only the good Uses?

Observation:

Uses that are very different morally are pretty much
the same technologically.

This is a common problem in
computer security and privacy.

Similar Dilemma
:
Anonymous communication Used by:

network
– Normal people

– Journalists & activists

Sender and receiver of – Law enforcement

message are unlinkable

– Malware

– Child pornographers

?

Coming to you courtesy of
? the U.S. Government:

?
– U.S. State Dept.

– ONR

– others . . .

7
Cryptocurrency Technologies Bitcoin and Anonymity
Anonymous e-Cash: History

Proposed by David Chaum in 1982

Crypto

magic
!
Based on Blind Signatures:

Two-party protocol to create digital signature
without signer knowing what she signs.

Under the Hood: Blind Signatures with RSA

Recall:
Blind RSA Signature:

•  public key (e, N)

•  private key (d, N)
•  pick random blinding factor r

•  N is public modulus

(detail: gcd(r, N) = 1)

•  compute

•  plaintext m
m’ = mre (mod N)

•  cyphertext c

•  signing authority signs m’

Encryption:
s’ = (m’)d (mod N)

c = me (mod N)

•  extract signature:

Decryption/signing
s = s’ * r-1 (mod N)

m = cd (mod N)
•  why?!

s = s’*r-1 = (m’)dr-1 = mdredr-1 = mdrr-1 = md (mod N
)
8
Cryptocurrency Technologies Bitcoin and Anonymity
Anonymous e-Cash via Blind Signatures

Withdraw anonymous coin
User Balance Spent coins
… … …
{317038628684424}

190
31703862…

Deposit coin # 317038628684424
… …

{317038628684424}

56

OK

Bank cannot link the two users

Anonymity & Decentralization

Q: How to “de-scroogify” e-Cash?

Interactive Protocols with bank are hard to
decentralize.

Decentralization often achieved via public
traceability to enforce security

– e.g., publicly post transactions to avoid
double-spending.

9
Cryptocurrency Technologies Bitcoin and Anonymity
Bitcoin and Anonymity

•  Anonymity Basics

•  How to de-anonymize Bitcoin

•  Mixing

•  Decentralized Mixing

•  Zerocoin and Zerocash

•  Tor and the Silk Road

Example: Wikileaks

10