DanGould

Keybase proof

I hereby claim:

• I am dangould on github.
• I am nart (https://keybase.io/nart) on keybase.
• I have a public key ASAuyI7eufmiPGgeNuQ-e2h6jpXlvLAOPoAl9pyrNMXdvAo

To claim this, I am signing this object:

DanGould

bitcoin privacy related bookmarks

protocols

• CoinShuffle: Practical Decentralized Coin Mixing for Bitcoin | SpringerLink
• Blindcoin: Blinded, Accountable Mixes for Bitcoin | SpringerLink
• P2P Mixing and Unlinkable P2P Transactions
• P2P Mixing and Unlinkable Transactions
• Anonymous CoinJoin Transactions with Arbitrary Values
• Sci-Hub | Sybil-Resistant Mixing for Bitcoin | 10.1145/2665943.2665955

DanGould

  BIP: ???
  Layer: Applications
  Title: Payjoin Version 2: Serverless Payjoin
  Author&#58; Dan Gould <[email protected]>
  Status&#58; Draft
  Replaces&#58; 78
  Type&#58; Standards Track
  Created&#58; 2023&#45;08&#45;08
  License&#58; BSD&#45;2&#45;Clause

DanGould

What is the Payjoin SDK and How does it work?

The Payjoin SDK/rust-payjoin is the most well-tested and flexible library for BIP 78 Payjoin and related privacy practices.

The primary crate, payjoin, is runtime-agnostic. Data persistence, chain interactions, and networking may be provided by custom implementations or copy the reference payjoin-client + bitcoind, nolooking + LND integration, or bitmask-core + BDK integrations.

The following is a breakdown of the existing documentation and its application to the payjoin-client reference implementation.

Send a Payjoin

DanGould

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQGNBGUvDgsBDADCxJxC1u7Syo1JB85mT/St3S8moBssWFXr1TM/oUyKBY92lK/8
Y0hrUqlulYItK2V59HGrXZFiZIPc+1MlFhR747XhpX+g8un6OJxYC0tShA5OM8oj
eQrKcDyqtKyW8vsE8sjXYNDw5OvexsaiZMbaUiXsk5LS58cNQmF8gUp5twEOOQcV
xHj8ZaR9LLe37XR7eE+hcsOb7G8CHzr6DulSi1ARJRLcB++GlM20C8WpaT5CnetA
DmkxUgZKsRKn/NXazsjaJ407l46+H8uGvkvq72toCfk1foBFbScP6aR04W/zBFml
GM+pvX6gV8VH9Oh4imZ5NR5pZU/N7GiX6df1cteJR5FM11obNBnKPYFM2X0N7l93
SK2azir8hs5j+wfETmkit4d66QNBb3Dv4/CP+1IKv9Cx5ixyM6KyeSWCKO4uVlng
PBriQ8HUbc59Pj+jJ3MERT8+oU24NnMZQ1fopFEX8OQd0ETAKCG9MBijRavSu7HX

DanGould

Unneccesary Input Heuristic

PayJoins help bitcoin users preserve their privacy because they bring ambiguity into blockchain analysis. Today's PayJoins are blockchain entries that are many-input and 2-output transactions. So the fact that multiple users can contribute inputs to one transaction breaks [the oldest assumption in blockchain analysis]. Still, lesser known "unecessary input heuristics" identify potential PayJoins:

UIH 1: One output is smaller than any input; Assume that output is change

Today's PayJoin clients avoid creating transactions that conform to UIH 1. This heuristic assumption is usually right. The heuristic assumes wrong if the change output is of much higher value than the payment, which is unusual. BTCPayServer code will not create these types of transactions.

UIH 2: The largest output is funded without the smallest

DanGould

Quantifying Payjoin Privacy

Goals

• bolster the assumption that bitcoin is fungible
• escape Unnecessary Input Heuristic (UIH) & pre-tracked TXOs
• avoid introducing new heuristics

Key

DanGould

BIP 21 Implementations

java

• sparrow wallet: https://github.com/sparrowwallet/drongo/blob/9808164a2951929faf0976b4f2b4df5ea8a83194/src/main/java/com/sparrowwallet/drongo/uri/BitcoinURI.java#L25
• bitcoinj: https://github.com/bitcoinj/bitcoinj/blob/32e9145722d5469ed8827d027d127a8cce0ce437/core/src/main/java/org/bitcoinj/uri/BitcoinURI.java#L46

c#

NBitcoin: https://github.com/MetacoSA/NBitcoin/blob/cf5d6dc8f4c0cb756c9ccdcd07809424630b6c86/NBitcoin/Payment/BitcoinUrlBuilder.cs#L21