The State of Privacy in Cryptocurrency
Fungibility is an important prerequisite for money. While Bitcoin is the most widely adopted blockchain network, it has issues with fungibility and privacy – something that prevents it from being adopted as money. Pretty much all other cryptocurrencies also possess this weakness.
Aspects of Privacy in a Cryptocurrency
Privacy can relate to several things when talking about cryptocurrencies. The first aspect relates to your identity.
Identities
Most cryptocurrencies are pseudonymous, meaning that they are not totally anonymous as real-world identities are not linked to bitcoin addresses. Instead, there is just a public key and private key that users use to spend Bitcoins.
However, the biggest on-ramp to bitcoin are centralized exchanges, which request personal identity data and in this way, identities can be linked to bitcoin addresses. A whole host of blockchain analytics companies have popped up to de-anonymise bitcoin users.
Transactions
Another aspect of privacy relates to transactions. A bank note is currently more fungible than bitcoin since you cannot tell who used the banknote or what transactions it was involved in beforehand, while with Bitcoin’s transparent blockchain, you can see the entire transaction history. The sender’s and recipient’s addresses and transaction amounts are engraved into the blockchain forever.
While several improvements have been proposed to improve Bitcoin’s privacy, such as Confidential Transactions and Schnorr Signatures, these have not been implemented yet.
The use of CoinJoin through the Wasabi wallet does attempt to provide fungibility, but mixing coins can be seen as suspicious and cannot be plausibly denied if you mixed coins. The problem with CoinJoin is that there is a minimum 0.1 BTC limit, effectively making this form of privacy expensive to many users.
Network State
Then there is the privacy of the network’s state, where with Bitcoin (and most other cryptocurrencies), you can see the entire state of the network, including addresses, transactions and the amounts stored in addresses. This had led to cryptocurrency “rich lists” being tracked and published online.
Consequences of Inadequate Fungibility
The consequences of weak privacy or the absence of fungibility can impede Bitcoin’s use as a currency and distort the market. As mentioned already, rich lists can be used to try and identify wealthy coin holders. Kidnappings of people linked to the Bitcoin space have occurred in the past, and will continue to occur as long as it remains full transparent.
The lack of fungibility can also distort the bitcoin market. For instance, some crypto exchanges blacklist coins that are closely linked to illicit activities. If someone paid you in bitcoin and they were using it nefariously, you may get punished for their misdeeds.
Similarly, the issue of taint also affects prices of bitcoin – making ‘clean’ bitcoin trade at a premium and ‘dirty’ bitcoin trade at a discount, which is exemplified by a recent Tweet that claimed freshly mined bitcoin always sells for a premium.
As a result of the increasing scrutiny on the Bitcoin network and other transparent chains, several altcoins were created to address the fungibility shortcomings of the world’s most popular cryptocurrency.
Existing Privacy Coins
In this section, we provide a short overview of the three most promising candidates for a fungible cryptocurrency, including Monero, Zcash and Grin/Beam.
Monero (XMR)
CryptoNote, a protocol entirely separate from Bitcoin’s codebase, was developed sometime in 2013/2014 as a reaction to Bitcoin’s lack of privacy. The CryptoNote protocol led to the emergence of Monero, the only fungible cryptocurrency on the market today, which has improved on its offering over time.
The main methods used by Monero to ensure fungibility is known as RingCT, which is a combination of ring signatures and confidential transactions, and stealth addresses, which takes care of the recipients privacy by creating one-time addresses for each transaction.
Ring signatures are a method of obfuscating transactions by mixing with other transactions, where other transactions act as a decoy. The Monero network currently has a fixed ring size of 11, telling us that 10 decoys are sent with each transaction that you make.
The state of the Monero network is not transparent, as the transaction amounts, histories, balance of wallets, timestamps and the origin of transactions cannot be observed. As a result, XMR is completely fungible as every transaction is private by default. However, Monero users can opt-out of the mandatory privacy by using viewkeys.
While Monero is the leader in fungibility, there are still some aspects of privacy that could be improved. Native support of Tor and I2P is to be included in an upcoming release, which will mitigate the leakage of metadata that could be used in timing attacks on monero users.
Zcash (ZEC)
While Zcash provides a very high anonymity set, the network only has opt-in privacy. With Zcash there are transparent transactions, which are very similar to Bitcoin transactions, and then there are shielded transactions (or z-transactions) – which provides complete privacy.
Zcash’s privacy is based on zk-SNARKs, allowing for the creation of transactions that obfuscate the sender, recipient and amount sent. However, the use of shielded transactions is very low at present, with estimates of less than 60 shielded transactions per month – at the upper limit.
Since all shielded transactions provide the anonymity set for all other shielded transactions, the low uptake of z-transactions means that Zcash has not yet reached its potential as a privacy coin.
In fact, as long as most of the network remains transparent, Zcash is not fungible as you can tell the difference between transparent Zcash coins and shielded Zcash coins. Of course, the Zcash team say they will phase out transparent transactions, but the timeframe is unclear.
Grin
Grin is a relatively new coin that is based on the MimbleWimble protocol which was proposed in 2016. While Grin is much better at scaling and privacy than bitcoin, it is not as fungible as Monero.
One of the main advantages of Grin is that transactions are aggregated into blocks, hiding the receiver and sender and obfuscating the transaction amount using Confidential Transactions. There is also the use of the Dandelion protocol which ensures that users IP addresses are not leaked and makes statistical analysis of IP addresses impractical, and along with the use of CoinJoin (which is not mandatory), the privacy guarantees provided are quite strong compared to Bitcoin.
However, the weakness of Grin is that miners and other nodes can see the individual transactions that have been published before they have been aggregated. Consequently, an adversary could potentially closely monitor the transactions being published on the network to produce what is known as a transaction graph by blockchain analytics companies.
Decred Announces New Privacy Feature
On August 28, Decred released a blog post outlining their approach to privacy. In a prior blog post providing an overview of the privacy coin landscape, the Decred team produced a useful assessment of privacy for the most fungible coins on the market, shown below.
Source: Decred
One of the issues with privacy is that it doesn’t just depend on the guarantees provided by the blockchain network itself, how the user interacts with the protocol and how easy it is to transact privately is also a key issue.
As the chart above shows, the least complex privacy solution is Dash, but offers low privacy. Those coins that provide higher levels of privacy are more complicated and harder to execute for an average user.
Decred introduced their privacy feature, announcing it will be based on CoinShuffle++ to provide an easy way to transact with moderate privacy, making it slightly more attractive than either Bitcoin or Dash for private transactions. It is expected that 12.5 percent of all Decred coins will make use of the recently introduced privacy feature.
What is CoinShuffle++?
CoinShuffle++ was first proposed in 2016 as a peer-to-peer mixing protocol to improve the fungibility of bitcoin. Users are not required to trust a central mixing service and works in a similar way to CoinJoin, where participants submit output addresses to be included in a single transactions to obfuscate their transactions histories.
The innovation behind CoinShuffle++ is that users can submit an output address without others knowing the specific address they submitted. Therefore, all participants will know which address will be receiving bitcoins, but they will not know from which addresses they have come from.
How does Decred’s Privacy Feature Work?
Essentially, Decred’s privacy is done through a mixing protocol, CoinShuffle++, that runs on a smart contract, where a centralized server is used to do the matching.
The feature is currently live on the Decred network (through command-line wallets only) and the team are intending to develop this privacy feature more over time, as the reliance on a centralized server is not ideal – but allows the team to test the feature and implement at least some form of privacy on the blockchain.
While Decred’s privacy is opt-in, making it susceptible to the same weakness as Zcash or Bitcoin, the blog posts highlights future work on privacy, including adding confidential transactions and support for post-quantum cryptography to ensure the soundness of the mixing method used by Decred.
While Decred is not going the full nine yards with privacy, it is encouraging to see an altcoin project take the initiative to introduce features that are not on Bitcoin yet and attempt to improve the privacy guarantees for their users. The math and concepts are easy to understand and was implemented with 100’s of lines of code compared to thousands of lines of code for other privacy implementations.
As shown below, Decred has positioned itself with a unique trade-off between privacy and ease of use as compared to existing protocols – ensuring medium privacy while preventing the complexity from being too high.
Source: Decred
Since announcing the launch of the mixing feature, the Decred network is already mixing coins of a total value of about $31,000 and at a cost of less than 10 cents. It will be interesting to see how Decred’s approach will pan out, especially since governance is on-chain, meaning that network participants will be able to have a say on the future of privacy mechanisms.
