0

In the field of cryptocurrency design, there is a critical question of whether we can build, or have already built, a cryptocurrency that both (1) is highly efficient at scale (i.e., capable of providing fast low-fee transactions to many users), and (2) affords its users "privacy."

For (1), I would define highly efficient at scale in a functional sense by benchmarking against the average transaction time and fee of Solana or other suitably efficient cryptocurrency for a given whole-network transaction rate or similar metric of network activity. For example, I would say that cryptocurrency C satisfies (1) if and only if its long-time geometric means of transaction time and fee at a transaction rate R are both at or below the corresponding values for Solana.

For (2), I see privacy as meaning, at a minimum, that (2.a) the transacted amounts are accessible only to the sender and recipient and (2.b) there is no way to identify a user except by detective work external to the cryptocurrency network (such as sending subpoenas to exchanges, searching physical property, etc.). Note that for both (2.a) and (2.b) I make two assumptions that are frequently implicit in reasoning about cryptocurrency design: I assume that the network is exactly as specified, so man-in-the-middle attacks are excluded. I also assume that transfers of private information external to the cryptocurrency network—such as through spoofing, keylogging, collusion, hacks of company databases, and so on—do not occur.

Property (2.a) has been called confidentiality, and property (2.b) has been called anonymity.

I am not an expert in individual cryptocurrencies, but as of November 2023 it appears that

  • Solana satisfies (1) and (2.a) but not (2.b).
  • Monero, Secret Network, and perhaps several other "privacy coins" satisfy (2.a) and (2.b) but seem less capable of satisfying (1).
  • Many other cryptocurrencies appear to satisfy neither (1) nor (2.a) nor (2.b).

Any thoughtful additions or refinements to this summary would be appreciated.

My question is this: Can we achieve (2.b) for Solana (or any other cryptocurrency that satisfies (1) and (2.a)) simply by designing wallets and other cryptocurrency accounts to create a new public key for each transaction? Relatedly, is it technically possible and reasonable to use a new public key for each transaction at scale?

1 Answer 1

0

This is more of a design / opinion question, but it's technically possible to build anonymity on top of confidentiality.

Since amounts are encrypted, you can obfuscate the senders using a ring-signature model, as in Monero, coupled with multiple 0 transfers. So if I want to send you 10 tokens, the amount 10 is encrypted under one real transfer to your account, and then I also do many transfers of 0 to many other accounts. Since everything is encrypted, it's impossible to tell which one contains the non-zero amount, and every transfer samples from a set of senders and a set of recipients.

If you have many senders and many receivers, it will be impossible for someone to see what's happening from the outside:

  • the amount is encrypted
  • the true sender is one in a set, impossible to know which one
  • the true recipient is also one in a set, impossible to know which one
2
  • Innovative idea. Thanks. For disadvantages: Would this add many trivial transactions to the blockchain (making computations on the blockchain more expensive)? Could a sleuth figure out, up to some probability, some of the true senders by searching for duplicate senders among similar recipients (e.g., two vendors that have many of the same clients)? Does the approach you describe offer a way to obscure wallet balances?
    – SapereAude
    Commented Nov 28, 2023 at 17:06
  • All of the other transactions would still be important, since you're adding zero ciphertexts in order to obfuscate the non-zero transfer. It wouldn't make each computation more expensive, but it would require more overall work to do one non-zero transfer, since you have all of the zero transfers. The idea is to have a big enough set of senders and recipients so that it's impossible to figure out where the real one lies. And yes, all of this assumes that balances are encrypted.
    – Jon C
    Commented Nov 29, 2023 at 12:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.