Bitcoin and Cryptocurrency Technologies

Figure 6.8. Series of mixes​.​We begin with a user who has a coin or input address that we assume the
adversary has managed to link to them. The user sends the coin through various mixes, each time
providing a freshly generated output address to the mix. Provided that at least one of these mixes
destroys its records of the input to output address mapping, and there are no side-channel leaks of
information, an adversary won’t be able to link the user’s original coin to their final one.
Uniform transactions. ​If mix transactions by different users had different quantities of bitcoins, then
mixing wouldn’t be very effective. Since the value going into the mix and coming out of a mix would
have to be preserved, it will enable linking a user’s coins as they flow through the mix, or at least
greatly diminish the size of the anonymity set.
Instead, we want mix transactions to be uniform in value so that linkability is minimized. All mixes
should agree on a standard ​chunk size​, a fixed value that incoming mix transactions must have. This
would increase the anonymity set as all transactions going through ​any​mix would look the same and
would not be distinguishable based on their value. Moreover, having a uniform size across all mixes
would make it easy to use a series of mixes without having to split or merge transactions.
In practice, it might be difficult to agree on a single chunk size that works for all users. If we pick it to
be too large, users wanting to mix a small amount of money won’t be able to. But if we pick it to be
too small, users wanting to mix a large amount of money will need to divide it into a huge number of
chunks which might be inefficient and costly. Multiple standard chunk sizes would improe
performance, but also split the anonymity sets by chunk size. Perhaps a series of two or three
increasing chunk sizes will provide a reasonable tradeoff between efficiency and privacy.
Client side should be automated. ​In addition to trying to link coins based on transaction values, a
clever adversary can attempt various other ways to de-anonymize, for example, by observing the
timing of transactions. These attacks can be avoided, but the precautions necessary are too complex
and cumbersome for human users. Instead, the client-side functionality for interacting with mixes
should be automated and built into privacy-friendly wallet software.
180