DOCSLIB.ORG

Decentralized Anonymous Payments

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Decentralized Anonymous Payments Decentralized Anonymous Payments by Ian Miers A dissertation submitted to The Johns Hopkins University in conformity with the requirements for the degree of Doctor of Philosophy. Baltimore, Maryland August, 2017 © Ian Miers 2017 All rights reserved Abstract Decentralized payment systems such as Bitcoin record monetary transactions between pseudonyms in an append-only ledger known as a blockchain. Because the ledger is public, permanent, and readable by anyone, a user's privacy depends solely on the difficulty of linking pseudonymous transactions either to each other or to real identities. Both academic work and commercial services have shown that such linking is, in fact, very easy. Anyone at any point in the future can download a user's transaction history and analyze it. In this work, we propose and implement privacy preserving coins, payments, and payment channels that can be built atop a ledger. In particular we propose: Zerocoin A blockchain based protocol for breaking the link between a transaction that receives non-anonymous funds and the subsequent transaction that spends it. Zerocash The successor to Zerocoin, a blockchain based payment system supporting anonymous payments of arbitrary hidden value to other parties. While payments are recorded publicly in the blockchain, they reveal almost nothing else: the ii ABSTRACT recipient learns only the amount paid but not the source and anyone else learns only that a payment of some value to someone took place. Bolt A payment channel protocol that allows two parties to anonymously and se- curely make many unlinkable payments while only posting two messages to the blockchain. This protocol provides for instant payments while providing drastically improved scalability as every transaction is no longer recorded in the blockchain. Primary Reader: Matthew Green Secondary Readers: Abhishek Jain, Aviel Rubin iii Acknowledgments This work would not have been possible without the help of a number of people: friends, family, and collaborators. I would like to thank Avi Rubin for his support and mentorship especially when I started. I would also like to thank my fellow graduate students, Christina Garman, Michael Rushanan, and Gabriel Kaptchuk, both for their ideas and making the lab a home for the past 6 years. I would particularly like to thank my advisor Matthew Green, for getting me started in this, for his advice, his contributions, and above all never being too busy to take the time for us to throw things at a white board. Some of them actually stuck. iv Contents Abstract ii Acknowledgments iv List of Figures xii 1 Introduction 1 1.1 Background and Related Work . 4 1.1.1 Bitcoin, crypto-currencies, and blockchains . 4 1.1.2 E-cash . 5 1.2 Intuition: From public to unlinkable and then anonymous payments and channels . 6 1.2.1 Augmenting direct anonymous payments with anonymous channels . 12 2 Zerocoin 18 2.1 Overview of Bitcoin . 18 2.2 Decentralized E-Cash . 21 2.3 Decentralized E-Cash from Strong RSA . 24 2.3.1 Cryptographic Building Blocks . 24 2.3.2 Our Construction . 26 2.3.3 Security Analysis . 27 2.4 Real World Security and Parameter Choice . 28 v CONTENTS 2.4.1 Anonymity of Zerocoin . 28 2.4.2 Parameters . 28 2.5 Integrating with Bitcoin . 30 2.5.1 Suggestions for Optimizing Proof Verification . 33 2.5.2 Limited Anonymity and Forward Security . 34 2.5.3 Code Changes . 35 2.5.4 Incremental Deployment . 35 2.6 Performance . 37 2.6.1 Microbenchmarks . 37 2.6.2 Block Verification . 38 2.6.3 Discussion . 39 2.7 Previous Work . 40 2.7.1 E-Cash and Bitcoin . 40 2.7.2 Anonymity . 41 2.8 Conclusion and Future Work . 42 3 Zerocash 44 3.1 Introduction . 44 3.1.1 zk-SNARKs . 45 3.1.2 Centralized anonymous payment systems . 46 3.1.3 Decentralized anonymous payment schemes . 47 3.1.4 Zerocash . 53 3.1.5 Paper organization . 54 3.2 Background on zk-SNARKs . 55 3.2.1 Informal definition . 55 3.2.2 Comparison with NIZK . 57 vi CONTENTS 3.2.3 Known constructions and security . 58 3.2.4 zk-SNARK implementations . 59 3.3 Definition of a decentralized anonymous payment scheme . 59 3.3.1 Data structures . 60 3.3.2 Algorithms . 61 3.3.3 Completeness . 65 3.3.4 Security . 65 3.4 Construction of a decentralized anonymous payment scheme . 68 3.4.1 Cryptographic building blocks . 68 3.4.2 zk-SNARKs for pouring coins . 70 3.4.3 Algorithm constructions . 72 3.4.4 Completeness and security . 72 3.5 Zerocash . 74 3.5.1 Instantiation of building blocks . 74 3.5.2 Arithmetic circuit for pouring coins . 76 An arithmetic circuit for verifying SHA256's compression function . 77 Arithmetic circuit for POUR ............................ 79 3.6 Integration with existing ledger-based currencies . 81 3.6.1 Semantics of Bitcoin . 82 3.6.2 Integration by replacing the base currency . 82 3.6.3 Integration by hybrid currency . 83 3.6.4 Extending the Bitcoin protocol to support the combined semantics . 85 3.6.5 Additional anonymity considerations . 86 3.7 Experiments . 87 3.7.1 Performance of zk-SNARKs for pouring coins . 87 3.7.2 Performance of Zerocash algorithms . 88 vii CONTENTS 3.7.3 Large-scale network simulation . 89 3.8 Optimizations and extensions . 93 3.8.1 Everlasting anonymity . 94 3.8.2 Fast block propagation . 95 3.8.3 Improved storage requirements . 95 Supporting many coin commitments . 96 Supporting many spent serial numbers . 97 3.9 Related work . 98 3.10 Conclusion . 99 Acknowledgments . 100 4 Bolt 101 4.1 Introduction . 101 4.1.1 Background on Payment Channels . 101 4.1.2 Customers, Merchants, and the Limits of Anonymity for Payment Channels . 103 4.1.3 Overview of our constructions . 105 4.1.4 Comparison to related work . 109 4.1.5 Outline of this paper . 110 4.2 Definitions . 111 4.2.1 Anonymous Payment Channels . 111 4.2.2 Correctness and Security . 113 4.3 Technical Preliminaries . 115 4.4 Protocols . 116 4.4.1 Unidirectional payment channels . 117 Security Analysis . 120 4.4.2 Bidirectional payment channels . 122 viii CONTENTS Security Analysis . 125 4.4.3 Bidirectional Third Party Payments . 126 4.4.4 From Third Party Payments to Payment Networks . 130 4.4.5 Hiding Channel Balances . 130 4.5 Implementation of the Bidirectional scheme . 131 4.5.1 Integration with a Currency . 131 4.5.2 Implementation . 135 4.6 Related Work . ..
Load more

Recommended publications
  • American Bar Association Business Law Section Committee on Derivatives and Futures Law
    American Bar Association Business Law Section Committee on Derivatives and Futures Law Winter Meeting 2018 Naples, Florida Friday, January 19, 2018 10:15 a.m. to 11:30 a.m. NEW PRODUCTS / FINANCIAL TECHNOLOGY Moderator for the Program: Conrad G. Bahlke, Willkie Farr &Gallagher LLP Speakers: Geoffrey F. Aronow, Sidley Austin LLP Debra W. Cook, Depository Trust & Clearing Corporation Katherine Cooper, Law Office of Katherine Cooper Isabelle Corbett, R3 David Lucking, Allen & Overy LLP Brian D. Quintenz, Commissioner, U.S. Commodity Futures Trading Commission ABA BUSINESS LAW SECTION DERIVATIVES & FUTURES LAW COMMITTEE 2018 WINTER MEETING NEW PRODUCTS / FIN TECH PANEL 2017 Developments in US Regulation of Virtual Currencies and Related Products: Yin and Yang January 5, 2018 By Katherine Cooper1 2017 was a year during which virtual currencies began to move into the mainstream financial markets. This generated significant legal and regulatory developments as U.S. regulators faced numerous novel products attempting to blend the old with the new. Although facing so many novel issues, the regulators’ responses tell a familiar story of the struggle to balance the yin of customer protection with the yang of encouraging financial innovation and competition. Below is a summary of 2017 developments from the SEC, CFTC, OCC, FinCEN and the States. I. Securities and Exchange Commission a. Bitcoin Exchange-Traded Products A number of sponsors of proposed Bitcoin exchange traded products had applications for approval pending before the Securities and Exchange Commission at the beginning of 2017. In March 2017, the SEC rejected a proposal backed by Tyler and Cameron Winklevoss.2 The Bats Exchange proposed a rule amendment which would list the shares of the Winklevoss Bitcoin Trust for trading.
    [Show full text]
  • Rev. Rul. 2019-24 ISSUES (1) Does a Taxpayer Have Gross Income Under
    26 CFR 1.61-1: Gross income. (Also §§ 61, 451, 1011.) Rev. Rul. 2019-24 ISSUES (1) Does a taxpayer have gross income under § 61 of the Internal Revenue Code (Code) as a result of a hard fork of a cryptocurrency the taxpayer owns if the taxpayer does not receive units of a new cryptocurrency? (2) Does a taxpayer have gross income under § 61 as a result of an airdrop of a new cryptocurrency following a hard fork if the taxpayer receives units of new cryptocurrency? BACKGROUND Virtual currency is a digital representation of value that functions as a medium of exchange, a unit of account, and a store of value other than a representation of the United States dollar or a foreign currency. Foreign currency is the coin and paper money of a country other than the United States that is designated as legal tender, circulates, and is customarily used and accepted as a medium of exchange in the country of issuance. See 31 C.F.R. § 1010.100(m). - 2 - Cryptocurrency is a type of virtual currency that utilizes cryptography to secure transactions that are digitally recorded on a distributed ledger, such as a blockchain. Units of cryptocurrency are generally referred to as coins or tokens. Distributed ledger technology uses independent digital systems to record, share, and synchronize transactions, the details of which are recorded in multiple places at the same time with no central data store or administration functionality. A hard fork is unique to distributed ledger technology and occurs when a cryptocurrency on a distributed ledger undergoes a protocol change resulting in a permanent diversion from the legacy or existing distributed ledger.
    [Show full text]
  • Crypto-Asset Markets: Potential Channels for Future Financial Stability
    Crypto-asset markets Potential channels for future financial stability implications 10 October 2018 The Financial Stability Board (FSB) is established to coordinate at the international level the work of national financial authorities and international standard-setting bodies in order to develop and promote the implementation of effective regulatory, supervisory and other financial sector policies. Its mandate is set out in the FSB Charter, which governs the policymaking and related activities of the FSB. These activities, including any decisions reached in their context, shall not be binding or give rise to any legal rights or obligations under the FSB’s Articles of Association. Contacting the Financial Stability Board Sign up for e-mail alerts: www.fsb.org/emailalert Follow the FSB on Twitter: @FinStbBoard E-mail the FSB at: [email protected] Copyright © 2018 Financial Stability Board. Please refer to: www.fsb.org/terms_conditions/ Contents Executive Summary ................................................................................................................... 1 1. Introduction ......................................................................................................................... 3 2. Primary risks in crypto-asset markets ................................................................................. 5 2.1 Market liquidity risks ............................................................................................... 5 2.2 Volatility risks .........................................................................................................
    [Show full text]
  • Blockchain Law: the Fork Not Taken
    Blockchain Law The fork not taken Robert A. Schwinger, New York Law Journal — November 24, 2020 I shall be telling this with a sigh Somewhere ages and ages hence: Two roads diverged in a wood, and I— I took the one less traveled by, And that has made all the difference. — Robert Frost Is the token holder — often the holder of some form of digital currency — always free to choose which branch of the fork to take? A blockchain is often envisioned as a record of a single continuous Background: ‘Two roads diverged in a sequential series of transactions, like the links of the metaphorical chain from which the term “blockchain” derives. But sometimes yellow wood’ the chain turns out to be not so single or continuous. Sometimes situations can arise where a portion of the chain can branch off A blockchain fork occurs when someone seeks to divide a into a new direction from the original chain, while the original chain blockchain into two branches by changing its source code, which also continues to move forward separately. This presents a choice is possible to do because the code is open. For those users who for the current holders of the digital tokens on that blockchain choose to upgrade their software, the software then “rejects about which direction they wish to follow going forward. In the all transactions from older software, effectively creating a new world of blockchain, this scenario is termed a “fork.” branch of the blockchain. However, those users who retain the old software continue to process transactions, meaning that But is the tokenholder—often the holder of some form of digital there is a parallel set of transactions taking place across two currency—always free to choose which branch of the fork to different chains.” See generally N.
    [Show full text]
  • The Lightning Network 25 January 2018
    The Lightning Network 25 January 2018 BitMEX Research Filtering out the hype with unbiased, evidence-based reports on the crypto-coin ecosystem. BitMEX Research is also active on Twitter and Reddit. research.bitmex.com (Source: Flickr) Abstract Previous reports: In this piece, we explain the motivation behind the creation of the Mining Incentives, Part 3: Short Term vs. Long Term Lightning Network and why its scaling characteristics are superior to what (17/01/2018) we have today, potentially resulting in a transformational improvement. A Complete History of Bitcoin’s Consensus Forks We describe some of the basic technical building blocks that make (28/12/2017) Lightning possible. We then examine some of its limitations, including the Bitcoin Gold: Investment Flow downsides of inferior security compared to transacting on-chain and why Data (21/12/2017) this makes Lightning potentially unsuitable for larger-value payments. Public Companies with Exposure to the Crypto Space (13/12/2017) Update: Bitcoin Cash Investment Flow Data (01/12/2017) Research – The Lightning Network 25 January 2018 1 The motivation behind the Lightning Network Blockchain-based payment systems typically work in a “broadcast to everyone” mode, in that when one makes a payment, one needs to broadcast the transaction to all participants in the network. Nodes in such a system must: • Store the transaction indefinitely, • Verify the transaction, and • Relay the transaction. Miners, meanwhile, are required to engage in an energy-intensive competitive process to determine if the transaction makes it into the ledger, just in case a conflicting transaction occurs. There isn’t even special treatment for the recipient of the payment.
    [Show full text]
  • Review Articles
    review articles DOI:10.1145/3372115 system is designed to achieve common Software weaknesses in cryptocurrencies security goals: transaction integrity and availability in a highly distributed sys- create unique challenges in responsible tem whose participants are incentiv- revelations. ized to cooperate.38 Users interact with the cryptocurrency system via software BY RAINER BÖHME, LISA ECKEY, TYLER MOORE, “wallets” that manage the cryptograph- NEHA NARULA, TIM RUFFING, AND AVIV ZOHAR ic keys associated with the coins of the user. These wallets can reside on a local client machine or be managed by an online service provider. In these appli- cations, authenticating users and Responsible maintaining confidentiality of crypto- graphic key material are the central se- curity goals. Exchanges facilitate trade Vulnerability between cryptocurrencies and between cryptocurrencies and traditional forms of money. Wallets broadcast cryptocur- Disclosure in rency transactions to a network of nodes, which then relay transactions to miners, who in turn validate and group Cryptocurrencies them together into blocks that are ap- pended to the blockchain. Not all cryptocurrency applications revolve around payments. Some crypto- currencies, most notably Ethereum, support “smart contracts” in which general-purpose code can be executed with integrity assurances and recorded DESPITE THE FOCUS on operating in adversarial on the distributed ledger. An explosion of token systems has appeared, in environments, cryptocurrencies have suffered a litany which particular functionality is ex- of security and privacy problems. Sometimes, these pressed and run on top of a cryptocur- rency.12 Here, the promise is that busi- issues are resolved without much fanfare following ness logic can be specified in the smart a disclosure by the individual who found the hole.
    [Show full text]
  • Blockchain & Cryptocurrency Regulation
    Blockchain & Cryptocurrency Regulation Third Edition Contributing Editor: Josias N. Dewey Global Legal Insights Blockchain & Cryptocurrency Regulation 2021, Third Edition Contributing Editor: Josias N. Dewey Published by Global Legal Group GLOBAL LEGAL INSIGHTS – BLOCKCHAIN & CRYPTOCURRENCY REGULATION 2021, THIRD EDITION Contributing Editor Josias N. Dewey, Holland & Knight LLP Head of Production Suzie Levy Senior Editor Sam Friend Sub Editor Megan Hylton Consulting Group Publisher Rory Smith Chief Media Officer Fraser Allan We are extremely grateful for all contributions to this edition. Special thanks are reserved for Josias N. Dewey of Holland & Knight LLP for all of his assistance. Published by Global Legal Group Ltd. 59 Tanner Street, London SE1 3PL, United Kingdom Tel: +44 207 367 0720 / URL: www.glgroup.co.uk Copyright © 2020 Global Legal Group Ltd. All rights reserved No photocopying ISBN 978-1-83918-077-4 ISSN 2631-2999 This publication is for general information purposes only. It does not purport to provide comprehensive full legal or other advice. Global Legal Group Ltd. and the contributors accept no responsibility for losses that may arise from reliance upon information contained in this publication. This publication is intended to give an indication of legal issues upon which you may need advice. Full legal advice should be taken from a qualified professional when dealing with specific situations. The information contained herein is accurate as of the date of publication. Printed and bound by TJ International, Trecerus Industrial Estate, Padstow, Cornwall, PL28 8RW October 2020 PREFACE nother year has passed and virtual currency and other blockchain-based digital assets continue to attract the attention of policymakers across the globe.
    [Show full text]
  • Blockchain and Cryptocurrency in Africa a Comparative Summary of the Reception and Regulation of Blockchain and Cryptocurrency in Africa
    Blockchain and Cryptocurrency in Africa A comparative summary of the reception and regulation of Blockchain and Cryptocurrency in Africa 2018 Baker McKenzie, Johannesburg IMPORTANT DISCLAIMER: The material in this report is of the nature of general comment only. It is not offered as legal advice on any specific issue or matter and should not be taken as such. Readers should refrain from acting on the basis of any discussion contained in this report without obtaining specific legal advice on the particular facts and circumstances at issue. While the authors have made every effort to provide accurate and up-to-date information on laws and policy, these matters are continuously subject to change. Furthermore, the application of these laws depends on the particular facts and circumstances of each situation, and therefore readers should consult their lawyer before taking any action. Information contained herein is as at November 2018. CONTENTS PREFACE ............................................................................................................................................1 GEOGRAPHICAL OVERVIEW ....................................................................................................... 2 COUNTRY PROFILES ..................................................................................................................... 3 1. Botswana ................................................................................................................................................................... 3 2. Ghana .........................................................................................................................................................................4
    [Show full text]
  • How to Not Get Caught When You Launder Money on Blockchain?
    How to Not Get Caught When You Launder Money on Blockchain? Cuneyt G. Akcora1, Sudhanva Purusotham2, Yulia R. Gel2 Mitchell Krawiec-Thayer3, Murat Kantarcioglu2 1University of Manitoba, 2 UT Dallas, 3 Monero Research Lab 65 Chancellor Circle Winnipeg, MB, Canada R3T 2N2 [email protected], fSudhanva.Purushotham, ygl, [email protected], [email protected] Abstract transactions and circumvent existing AI-based money laun- dering techniques. Our insights, however, are intended not to The number of blockchain users has tremendously grown in assist criminals to obfuscate their malicious activities but to recent years. As an unintended consequence, e-crime trans- motivate the AI community for further research in this area actions on blockchains has been on the rise. Consequently, public blockchains have become a hotbed of research for de- of critical societal importance and, as a result, to advance veloping AI tools to detect and trace users and transactions the state of art methodology in the AI-based cryptocurrency that are related to e-crime. money laundering detection. We argue that following a few select strategies can make In the remainder of this paper, we first identify tech- money laundering on blockchain virtually undetectable with niques that can be used by criminals to launder money on most of the currently existing tools and algorithms. As a re- blockchain and then empirically show why these techniques sult, the effective combating of e-crime activities involving would be effective in hiding patterns used by potential AI cryptocurrencies requires the development of novel analytic models. methodology in AI. 2 Related Work 1 Introduction The success of Bitcoin (Nakamoto 2008) has encouraged Cryptocurrencies have emerged as an important rapidly hundreds of similar digital coins (Tschorsch and Scheuer- evolving financial tool that allows for cross-border transac- mann 2016).
    [Show full text]
  • Segwit2x –
    SegWit2x – A New Statement The Overwhelming power of SegWit2x In order to safeguard the community from an undesired chain split, the upgrade should be overwhelming, but it’s not enough. It should also ‘appear’ as overwhelming. People, businesses and services needs to be certain about what is going to happen and the risks if they won’t follow. My impression is that still too many speaking english people in the western world think the upgrade will be abandoned before or immediately after block 494784 is mined, thus they are going to simply ignore it. That could lead to unprepared patch up and confusion, while naïve users risk to harm themselves. For this reason and for the sake of the Bitcoin community as a whole, we need to show again, clearly and publicly the extent of the support to SegWit2x. We also need to commit ourselves in a widespread communication campaign. I know this is not a strict technical matter, but it could help a lot avoiding technical issues in the future. What we have to do First, we need a new statement from the original NYA signers and all the business, firms and individuals who joined the cause later. That statement should be slightly different from the original NYA though, and I am explaining why. We all know that what Bitcoin is will be ultimately determined by market forces, comprehensive of all the stakeholders involved: businesses, miners, users, developers, traders, investors, holders etc. Each category has its own weight in the process, and everybody has incentives in following the market.
    [Show full text]
  • MYBTGWALLET SCAM the Dark Side of the Fork
    MYBTGWALLET SCAM The dark side of the fork Intro After Bitcoin Cash fork on Aug. 1st, Bitcoin was involved in two other forks between October and November: before the so disputed Segwit2x announced fork, on Oct. 24th a new crypto was launched. Bitcoin Gold was a new greedy chance for Bitcoin owners to earn some free money: importing mnemonic seeds or private keys belonging to a BTC wallet in a BTG one they had the opportunity to redeem their free BTG. This was possible through local BTG clients or through some web services such as MyBTGWallet.com, a website listed directly on BTG official webpage. This particular case turned in a scam that stole an impressive number of Bitcoin from “unexperienced” users. The Scam Site MyBTGWallet scam worked in a very simple way: users imported the mnemonic seed of their BTC wallet on the scam page providing in this way the scammer with the private keys needed to steal the balance of bitcoin still on the wallet and any other cryptocurrencies stored on the same wallet (e.g. Ethereum or Litecoin in case it was a multicurrency wallet). MyBTGWallet page The site used a clever trick to save the mnemonic seed into the cookies of the browser and then siphoned the cookies via a google tracking javascript having this way access to all seeds checked on the website. 2 The numbers The website was used by many bitcoin holders after the fork happened. The scammers progressively moved the stolen funds to other bitcoin addresses. Thanks to open source intelligence activities, we were able to create the clusters of the stolen bitcoin and determine that the number of compromised addresses is almost 4500.
    [Show full text]
  • The Lightning Network - Deconstructed and Evaluated
    The Lightning Network - Deconstructed and Evaluated Anti-Money Laundering (AML) and Anti-Terrorist Financing (ATF) professionals, especially those working in the blockchain and cryptocurrency environment, may have heard of the second layer evolution of Bitcoin's blockchain - the Lightning Network, (LN). This exciting new and rapidly deploying technology offers innovative solutions to solve issues around the speed of transaction times using bitcoin currently, but expandable to other tokens. Potentially however, this technology raises regulatory concerns as it arguably makes, (based on current technical limitations), bitcoin transactions truly anonymous and untraceable, as opposed to its current status, where every single bitcoin can be traced all the way back to its coinbase transaction1 on the public blockchain. This article will break down the Lightning Network - analyzing how it works and how it compares to Bitcoin’s current system, the need for the technology, its money laundering (ML) and terrorist financing (TF) risks, and some thoughts on potential regulatory applications. Refresher on Blockchain Before diving into the Lightning Network, a brief refresher on how the blockchain works - specifically the Bitcoin blockchain (referred to as just “Bitcoin” with a capital “B” herein) - is required. For readers with no knowledge or those wishing to learn more about Bitcoin, Mastering Bitcoin by Andreas Antonopoulos2 is a must read, and for those wishing to make their knowledge official, the Cryptocurrency Certification Consortium, (C4) offers the Certified Bitcoin Professional (CBP) designation.3 Put simply, the blockchain is a growing list of records that can be visualized as a series of blocks linked by chains. Each block contains specific information - in Bitcoin’s case, a list of transactions and their data, which includes the time, date, amount, and the counterparties4 of each transaction.
    [Show full text]