pull down to refresh

My talk starts at 2:09:10 - Here is the transcript:

Kruw: "I've been working on Wasabi Wallet for the past four years. I run a coinjoin coordinator, and my new project is called "The Black Hole", which is an extension, basically, of all four existing coinjoin protocols that were deployed on Bitcoin. Those are WabiSabi, ZeroLink, JoinMarket, and Payjoin. I'm not going to spend too much time going into detail on each of those, but I'll explain the end goal of this project.

It combines all four protocols into one wallet so that it adapts to the user's needs based on how much privacy they demand, or how much cost they are willing to tolerate, or how long they are willing to wait for a transaction (because each coinjoin protocol has strengths and weaknesses in each of these categories). It's been a struggle to satisfy every user, but once you combine these 4 things, you can just route their payment through whichever coinjoin protocol suits their particular needs at the time.

Wasabi 2.0 uses the WabiSabi protocol which offers you full privacy on Bitcoin. You can protect input to input links, so you don't reveal common input ownership. You can break the input to output links (you can spend privately). The output to output links can be hidden as well, we can batch multiple payments in a coinjoin, anonymize your change output, and not have anything connected together. But the problem with this is that it's slow to coordinate a coinjoin - It takes like 30 minutes. And it's also expensive: When doing a WabiSabi coinjoin, you're going to use about 6 inputs and 6 outputs and pay about 600 vbytes worth of fees. But we can bring that down a lot by optimizing.

ZeroLink is what was used in Wasabi 1.0, Samourai, and Ashigaru (for Whirlpool). We can make Whirlpool transactions that have 1 input and 1 output per user, and that's only 100 vbytes. So when you compare this to WabiSabi, you can bring the cost down by like 85% on your remixes. You still have to do a WabiSabi coinjoin to enter the ZeroLink round because you need a specific denomination, but you don't reveal common input ownership or toxic change like Whirlpool does in their tx0 (because all that is protected by your WabiSabi initial coinjoin).

An additional benefit over the current WabiSabi is with JoinMarket, you get free passive remixes. That's great for normies who don't care about privacy and just want to see number go up. So you save some money consolidating your inputs because the takers pay for that, and you can even earn a little bit of liquidity fees as well.

Payjoin is a convenience feature because you don't always want to wait 30 minutes for a coinjoin round (and it can take even longer). But a payjoin can execute instantly if both the sender and receiver support it. And it's also cheaper, the sender pays for 200 vbytes (or 200-250) in payjoin, whereas WabiSabi is 600, so you're saving a lot as well there."

stutxo: "How do you educate the users about all these different ways to do privacy?"

Kruw: "That's my favorite question actually. My background before Bitcoin was as a professional gamer. So I'm actually designing this implementation as a video game. So the users are not necessarily going to be aware they are using Bitcoin at all, because we can just call the coins "gold coins" instead of Bitcoin, and we can make UTXOs "units", characters like peasants, knights, elves, sorcerers or whatever as they evolve through these different coinjoin protocols. So we can abstract ALL the terminology away and just make it a video game for normies. And that's just one implementation - You can make it grandma friendly where there's just a send and receive button, and there's no way she can mess up her privacy. It just automatically handles it for her in the background, she doesn't even need to know what a UTXO is."

...

niftynei: "That sounds awesome, I love having games to teach people about how to do stuff, so if you can make some sort of game people can play to make their coinjoin privacy better, all the more power to you Kruw, that's a great goal to be going after. Do people still know their minting privacy in the game, even if they don't know what the UTXOs are?"

Kruw: "The UTXO concept is kind of hard to avoid. As long as you just hide the costs from users and say 'this is how much it costs to spend the money' and they just say 'okay I approve', you can just handle coin selection for them."

niftynei: "Got it, okay."

Kruw: "The goal is to completely disable the option to spend coins non-privately. Any coins that are spent have to come from a coinjoin, or go through a coinjoin when you are spending them."

niftynei: "Got it, that makes sense. You mentioned 4 different privacy protocols, was payjoin one of them?"

Kruw: "Yes, so that's what is binding all of these things together because JoinMarket, Wasabi 1.0, and Wasabi 2.0 have payjoin. This already exists and you can send payjoins across one wallet to the other, but no one's ever added a third or fourth protocol onto the same wallet, it's always just been limited to two.

niftynei: "Right, okay,"

Robin Linus: "I didn't quite get the tradeoffs. You said it's time (how long it takes for the coinjoin to settle), the other is fees, and how you deal with the toxic change?"

Kruw: "Yes, so WabiSabi is the strongest overall for these protocols. The coordination problem is inconvenient because you gets hundreds of inputs all into the same round, they all have to sign, and if any of them don't sign you have to restart. So this can take several attempts to get a big transaction through. But with payjoin, you just skip that and have one counterparty. It's "confidential", it's not "private", but it's still a workaround for people who need that instant tx.

Robin: "But the drawback is that the anonymity set is way smaller..."

Kruw: "Right, and to be honest, you should be using Lighting for this scenario anyways, so payjoin is just a fallback. Also, in WabiSabi if you are a huge whale with 100 Bitcoins, you are going to have to remix all day. You're only going to be able to break down part of it per transaction, so it's going to take you like 20 rounds. Whereas with JoinMarket, all the whales have their liquidity sitting idle, and you just buy that liquidity from them, and you get an instant coinjoin for exactly amount you need, THEN you can start using WabiSabi once you've had some basic anonymity set accrued from your JoinMarket transaction."

Robin Linus: "What is JoinMarket again?"

Kruw: "JoinMarket has Makers and Takers. Makers have their liquidity sitting in a hot wallet, and Takers query them and say 'hey, I want to create a coinjoin for half a Bitcoin". The Makers respond "hey, I have half a Bitcoin. If you pay me a little fee for my liquidity or consolidate my inputs for me & pay my mining fees, I'll create a 0.5 BTC output to hide your 0.5 BTC output."

Robin Linus: "So, incentivizing other people to join my coinjoin, because I might have so many coins there might not be enough people to create a coinjoin out of the people who want to do one right now."

Kruw: "Right, so there's a little bit of an incentives problem here because the Taker of the coinjoin ends up paying for like 2,000 vbytes worth of mining fees for all these other people. But in WabiSabi, each user pays for their own mining fees, which is great for Sybil resistance. A Sybil attacker not only has to have a lot of liquidity to start with, they also have to continually pay mining fees to join every round. And even if they join every round, they still can't exclude all the honest users and just single out their target. So it's actually pretty decently Sybil-resistant, WabiSabi doesn't get enough credit for it. By the way, Cross Input Signature Aggregation makes this incredibly overpowered. We're going to outbid all the normies sending non-coinjoined solo payments."

11 sats \ 0 replies \ @OT 25 Aug

I really like this idea! I can imagine an app where all of this is hidden under the hood and is promoted as custodial and free to transact. All while their liquidity is used for coinjoining.

reply
reply