13

I was reading the Serenity PoC2. The part quoted below grabbed my attention.

Does it imply full anonymity for Ethereum transactions should I decide to use the ring signature mixer?

Ring signature mixer – part of the test.py script now includes creating an instance of a ring signature verification contract which is designed as a mixer: five users send their public keys in alongside a deposit of 0.1 ETH, and then withdraw the 0.1 ETH specifying the address with a linkable ring signature, simultaneously guaranteeing that (i) everyone who deposited 0.1 ETH will be able to withdraw 0.1 ETH exactly once, and (ii) it’s impossible to tell which withdrawal corresponds to which deposit. This is implemented in a way that is compliant with the gas checker, providing the key advantage that the transaction withdrawing the 0.1 ETH does not need to be sent from an additional account that pays gas (something which a ring signature implementation on top of the current ethereum would need to do, and which causes a potential privacy leak at the time that you transfer the ETH to that account to pay for the gas); instead, the withdrawal transaction can simply be sent in by itself, and the gas checker algorithm can verify that the signature is correct and that the mixer will pay the miner a fee if the withdrawal transaction gets included into a block.

Improve this question

4 Answers 4

Reset to default
6

Nope. Nothing in blockchain is fully anonymous. Just very difficult to track down. Almost to the point of not worth trying to unless you did something really bad and there's proof it came from your address. And even then. Linking address to identity is difficult in and of itself.

Improve this answer
1
  • Technically speaking it is anonymizing, just not fully anonymizing. This is a statistical based approach to anonymity, they can never prove, per se, the connection, only approximate the connection. It is valid obfuscation, just not total obfuscation.
    – Albert Renshaw
    Commented Jan 20, 2021 at 5:47
7

Everybody knows what addresses were inputs to the ring. So when you withdraw, everybody knows your output address is linked to one of the input addresses. But nobody knows which one.

This is an improvement over the usual situation where funds can be traced from address to address. It's helpful in some situations. Say you have an address which as been linked to your real identity (perhaps because you used an exchange, made a purchase of something that was mailed to you, etc). Now you want to donate to wikileaks without the government knowing. You can deposit funds from the known address into the ring, make the donation, and nobody knows it came from you (though you should be careful not to deposit and spend the same amount, since transaction values aren't hidden).

This isn't as good as zcash, where the "ring" is effectively everyone using the currency and even the transaction values are hidden. So I wouldn't call it "completely anonymous," just "more anonymous."

Improve this answer
5

The property of anonymity offered by ring signature mixers is more like what you would intuitively think of as 'plausible deniability', or 'anonymity with respect to an anonymity set'.

The actual definition of anonymity is given as an adversary having only negligibly greater advantage of connecting the true input-output address pair than if he were to guess entirely at random.

If there are n similar value transactions going into the mixer, the chances of an eavesdropper correctly identifying which address you sent to would be 1/n. If you're doing something super illegal and/or you live in a horrible country, you'll need n to be very high before you're comfortable with the level of anonymity you get. If you just want to foil any attempts of taint analysis or other blockchain analysis, you might be comfortable with n>3 or similar.

Improve this answer
0

If contracts get ability to pay for their own calls then ring signature mixer becomes a good cheap and working tool. The mixing probability won't be negligible in the best case you will get 1/N probability where N is number of unique people who used this contract. Unfortunately this probability linearly depends on the size of a ring, so to get a good probability you have to invest a lot. As we all know the best is an enemy of good, such mixer will definitely be useful even so it won't provide absolute anonymity.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.