So What’cha Want? ECC Update (funding edition)

I don’t want to derail this thread, but the strategy of “make a new t-address for each receiving transaction” provides no actual privacy. I’ll briefly describe why, and what the problems are.

There are two issues here: first, the detection of funds. The light client protocol was not initially built with support for the transparent protocol - transparent support was essentially “hacked in” later on, and as a consequence, a wallet reveals its “interest” in a transparent address to the light wallet server when it queries to check whether funds have been received on that address. This can be mitigated via checking over TOR, but this also isn’t sufficient because if the wallet queries for multiple addresses at once, the light wallet server can then know that the same wallet controls all of those addresses, linking them.

The second issue here is that when spending funds received on transparent addresses, unless funds received on each address are shielded independently and in such a way that no observer of the chain can use timing information of those transactions to cluster them, those addresses end up linked together when the funds received by them are used as inputs to a shielding transaction.

Fixing the former requires changes to lightwalletd and its use by the ecosystem; however, lightwalletd currently has no maintainers. So we are pinning our hopes on Zaino to move us forward on this front. But then, the second issue remains; while it’s possible to use auto-shielding functionality to reduce the burden here somewhat, the UX of this is kind of horrible because in order to avoid temporal correlations, you have to set up the auto-shielding to take place over a long period of time, using a Poisson process to randomly choose when to perform the shielding operations. Having a mandatory delay of hours to make the transparent funds accessible is gross.

Basically, rotation of transparent addresses provides no actual privacy, and anyone in the Bitcoin world who is claiming that it does so is lying to you. Use the shielded protocols instead.

The zcash_client_backend library has just been updated with complete address rotation support in service of making it possible to recover funds from fully transparent wallets. We still have to decide exactly how we want to approach the issue of whether to support transparent address rotation, given that for it to be used securely, it will impose a substantial UX cost.

5 Likes