How to Squeeze a Crowd: Reducing Bandwidth in Mixing Cryptocurrencies

Several popular cryptocurrencies incorporate privacy features that "mix" real transactions with cover traffic in order to obfuscate the public transaction graph. The underlying protocols, which include CryptoNote and Monero's RingCT, work by first identifying a real transaction output (TXO), sampling a number of cover outputs, and transmitting the entire resulting set to verifiers, along with a zero knowledge (or WI) proof that hides the identity of the real transaction. Unfortunately, many of these schemes suffer from a practical limitation: the description of the combined input set grows linearly with size of the anonymity set. In this work we propose a simple technique for efficiently sampling cover traffic from a finite (and public) set of known values, while deriving a compact description of the resulting transaction set. This technique, which is based on programmable hash functions, allows us to dramatically reduce transaction bandwidth when large cover sets are used.We refer to our construction as a recoverable sampling scheme, and note that it may be of independent interest for other privacy applications. We present formal security definitions; prove our constructions secure; and show how these constructions can be integrated with various currencies and different cover sampling distributions.

I. Introduction

Cryptocurrencies such as Bitcoin suffer from well-known privacy limitations. These stem from the fact that each transaction on the currency's public ledger is explicitly linked to one or more preceding transaction outputs from which funds originate. A number of academic works [?], [?], [?], [?], [?] and for-profit companies [?], [?] have demonstrated that sensitive payment information can be extracted from the resulting public transaction graph.