search

MyHush / hush3

Hush: Speak And Transact Freely
https://myhush.org
Other
15 stars 13 forks source link

Sapling Consolidation leaks metadata and reduces anonset! #91

Closed leto closed 4 years ago

leto commented 4 years ago

Currently all consolidation tx's have 1 zout, which is not good. This leaks the metadata that the sum of the amounts of all zins become the amount of one single zutxo.

Additionally, sapling consolidation works to constantly reduce the anonset, by making transactions that spend many more zutxos then they create. Since exchanges are the users most likely to use this and they have the busiest wallets, it does seem that they will actively and automatically reduce the anonset by enabling Sapling Consolidation. For instance, a consolidation tx of 45 zins and 1 zout will reduce the anonset by 44 in a single tx.

Hush's solution to this will be to add Sietch outputs to sapling consolidation tx's, and probably change some of the hardcoded constants (such as a max of 45 zinputs).

https://github.com/myhush/sietch

This commit shows where we need to modify sapling consolidation code:

https://github.com/MyHush/hush3/commit/9b0d9865285ed02b812d43580b6d5609ff060d12

CryptoForge commented 4 years ago

That's a very good plan for the outputs and one that I had in mind to do as well for the same reasons. I noticed you had something similar in place for other transaction types.

I'm interested to see what you come up with for the max zinputs. There were several thoughts that went into this. I wanted a number that was high enough to consolidate quickly, but low enough not to leak metadata upon a dust attack, tie up system resources since it's an automated function, or create large transactions that wouldn't be accepted by the network at 0 fee. Also the number of inputs should be randomized as to further minimize leakage.

If you're looking at constants you might also want to look at how often the process it triggered.

leto commented 4 years ago

Our latest code will only consolidate between 3 and 8 zinputs at a time, at the default fee, while also padding the zouts to 8, making them look exactly like our normal Sietch-enabled z_sendmany transactions. This sacrifices some speed to consolidate (about 6 times slower) and pays tx fees, but it feels worth the privacy benefits. Now consolidation tx's cannot be easily identified via their input arity and fee, and they don't leak metadata about where all the value is going.

@CryptoForge thanks for your great work :+1: