Privacy and Anonymity CS 1951 L Spring 2019

Privacy and Anonymity CS 1951 L Spring 2019 Maurice Herlihy Brown University

Wikileaks Says … 2

Wired Says … 3

Why Privacy? Alice is paid in BTC 14. 1212 every week Should everyone know her salary? 4

Why Privacy? Gaming console company … Pays a VR headset consultant … Should competitors know? 5

Why Privacy? But crime, drugs, terrorism, etc? Cannot target only worthy uses of privacy! Society is full of privacy compromises 6

This lecture is based on Chapter 6 of the Princeton Bitcoin Book 7

Anonymity I just emptied your Bitcoin wallet, LOL Interacting with no name at all 8

Pseudonymity Hi, I’m 3 leet-haxxor 84! Interacting under a name, just not yours 9

Bitcoin Addresses Hash of public key Not your name, … But still a pseudonym. . Even if you use lots of different addresses, They can of often be linked 10

Linkability Every Bitcoin transaction is public Visible to everyone Repeated interactions can be linked to each other And maybe directly to you 11

Pseudonymous is not Private You order a latte at a coffee shop And pay in Bitcoin The barista has a link between you and that address And from that address to prior addresses… 12

Side Channel Attacks In a Le. Caré novel, Smiley notices that encrypted transmissions intercepted from anonymous Soviet mole paused while a colleague was on vacation Timing, amounts, patterns can link addresses 13

Unlinkability It should be hard to link … Different addresses of same party Different transactions of same party Payment sender to (ultimate) recipient 14

Anonymity Set of transactions that … The adversary cannot distinguish … From yours. Precise, but tricky … Depends on adversary’s powers 15

Let’s De-Anonymize Bitcoin I’m Alice 3 5 6 16

Let’s De-Anonymize Bitcoin 3 5 6 I want to buy that 8 BTC 17

Let’s De-Anonymize Bitcoin 3 txn 8 5 6 8 BTC 18

Adversary Sees 3 txn 8 5 19

Adversary Sees 3 txn 8 5 These two addresses probably controlled by same party! 20

Let’s De-Anonymize Bitcoin 3 5 6 I like that better 8. 5 BTC 21

Let’s De-Anonymize Bitcoin 3 5 6 txn 8. 5 0. 5 8. 5 BTC 22

Adversary Sees 3 txn 6 8. 5 0. 5 23

Adversary Sees 3 txn 6 8. 5 0. 5 One of those outputs is change for the inputs’ owner! 24

Adversary Sees Some early wallets would always put the change in the same position, LOL 3 txn 6 8. 5 0. 5 25

Many such addresses can Working Backwards be linked to a single party! 26

Uses heuristics to link bitcoin transactions Industrial scale “idioms of use” E. g. change address often new … Merchant address seen before

Re-Identifation Attack How to connect addresses with institutions? Buy stuff Join mining pool Engage wallet services Join gambling sites 28

From Meiklejohn et al. Clusters, color-coded by industry

Linking to Real-World People Direct transactions “Dusting Attack” AML/KYC compliance Carelessness: e. , g. , request donations to static address 30

Dusting Attack Airdrop! 31

Dusting Attack 10 -8 Give everyone a tiny sum (each with a unique address) 32

Dusting Attack It’s so annoying to have all these UTXOs … 100 0 10 -8 33

Dusting Attack I have you now, my pretty! I have just linked your address with you! 100 0 txn 1000+ 10 -8 34

AML/KYC Anti Money Laundering Know Your Customer Financial institutions are required to find out who you are Trade BTC all you like, but when you convert to fiat, your identity becomes known 35

Network-Level Attacks Txns flow through P 2 P network Nodes can collude to identify parties First node to announce transaction is probable source Identify origin IP address Partial solution: Tor network hides IP address, not 36 ideal

Let’s Re-Anonymize Bitcoin Use intermediary to obfuscate ownership 37

On-Line Wallets Deposit one address … Get back another. But they have to keep KYC/AML records No better than traditional banks Much worse, if hacked 38

Mixing Services On-line services Send them your bitcoins Give the mixer a destination address Hopefully, mixer sends your coins to that address Simultaneously with others in anonymity set 39

You Trust … They don’t keep records They don’t keep your coins They don’t give you “tainted” coins Anonymity set not too small 40

Best Practices Use a sequence of mixers You are OK if at least one discards records 41

Seriously, dude? Best Practices Use standard “chunk” amount 42

Seriously, dude? Best Practices Use standard “chunk” amount 43

Beware of Fees 3 2. 99 3 3 2. 99 1 3 2. 98 9 44

Mixing Services Today 45

Mixing Services Today Low usage Dodgy reputation Small anonymity sets 46

Decentralized Mixers 47

Decentralized Mixers Peer-to-Peer No Theft Better anonymity maybe More aligned with BTC philosophy? 48

Coin. Join Single transaction 49

Coin. Join Protocol Find Peers who want to mix Exchange input, output addresses Construct transaction Send it around, collect signatures, validate Boadcast the transaction 50

Find Peers who Want to Mix Services that match up interested parties Unlike mixer services, cannot steal your funds Cannot compromise identity Sometimes charge fees 51

Exchange Input, Output Addresses Tricky … No one should know input-to-output mapping Maybe use Tor Or special-purpose anon routing 52

Denial of Service Peer might not sign transaction Peer might spend coin before transaction broadcast Fix: fees, bonds, blame protocols? 53

Best Practices Still Apply to Coin. Join! Mix multiple times Use fixed-size chunk amounts Beware of fees reducing that chunk 54

Paranoia Strikes Deep you Coin. Join transaction 55

Merge Avoidance 3 5 6 I want to buy that 8 BTC 56

Merge Avoidance 3 txn 3 5 txn 5 6 I need to be careful about combining outputs 8 BTC 57

What about Ethereum? https: //github. com/yaronvel/smart_contracts/tree/master/mixer 58

Ethereum Mixer I’m Alice’s anonymous address I’m Alice I’m Bob’s anonymous address Mixer Contract total: 0 claimed: 0 59

Initially 1000 ETH 1 ETH Mixer Contract total: 0 claimed: 0 60

Day 1 Take my 1000 ETH Mixer Contract deposited: total: 10000 claimed: 0 Alice: 1000 Anon 0: 0 Bob: 0 Anon 1: 0 61

Day 1 Take my 1000 ETH Mixer Contract deposited: total: 20000 claimed: 0 Alice: 1000 Anon 0: 0 Bob: 1000 Anon 1: 0 62

1 ETH deposit Register me for 1000 Day 2 (Honest) Mixer Contract deposited: total: 20000 claimed: 1000 Alice: 1000 Anon 0: 1001 Bob: 1000 Anon 1: 0 63

Day 2 (Honest) 1 ETH deposit Register me for 1000 Mixer Contract deposited: total: 20000 claimed: 2000 Alice: 1000 Anon 0: 1001 Bob: 1000 Anon 1: 1001 64

Day 2 (Honest) 1 ETH deposit Register me for 1000 Mixer Contract deposited: total: 20000 claimed: 2000 Alice: 1000 Anon 0: 1001 Bob: 1000 Anon 1: 1001 65

Day 2 (Honest) Total and claimed values match, so all is well Mixer Contract deposited: total: 20000 claimed: 2000 Alice: 1000 Anon 0: 1001 Bob: 1000 Anon 1: 1001 66

Day 2 (Honest) Total and claimed values match, so all is well Mixer Contract deposited: total: 20000 claimed: 2000 Alice: 1000 Anon 0: 1001 Bob: 1000 Anon 1: 1001 67

Day 3 (Honest) Withdraw 1001 ETH Mixer Contract deposited: total: 20000 claimed: 2000 Alice: 1000 Anon 0: 1001 Bob: 1000 Anon 1: 1001 68

Day 2 (Dishonest) 1 ETH deposit Register me for 1000 Mixer Contract deposited: total: 20000 claimed: 1000 Alice: 1000 Anon 0: 1001 Bob: 1000 Anon 1: 0 69

Day 2 (Dishonest)1 ETH deposit Register me for 1000 Mixer Contract deposited: total: 20000 claimed: 2000 Alice: 1000 Anon 0: 1001 Bob: 1000 Anon 1: 1001 70

ETH deposit Day 21 (Dishonest) Register me for 1000 Mixer Contract total: 2000 deposited: 0 Alice: 1000 claimed: 2000 claimed: 0 Anon 0: 1001 Bob: 1000 Anon 1: 1001 Anon 2: 1001 71

Day 2 (Dishonest) Total and claimed values do not match, abort! Mixer Contract total: 2000 deposited: total: 20000 Alice: 1000 Bob: 1000 claimed: 2000 Anon 0: 1001 Anon 1: 1001 Anon 2: 1001 72

Day 3 (Dishonest) Give my deposit to Alice Mixer Contract total: 2000 deposited: 0 Alice: 1001 claimed: 2000 claimed: 0 Anon 0: 0 Bob: 1000 Anon 1: 1001 Anon 2: 1001 73

Day 3 (Dishonest) Give my deposit to Bob Mixer Contract total: 2000 deposited: 0 Alice: 1001 claimed: 2000 claimed: 0 Anon 0: 0 Bob: 1001 Anon 1: 0 Anon 2: 1001 74

Day 3 (Dishonest) (mumble) Mixer Contract total: 2000 deposited: 0 Alice: 1001 claimed: 2000 claimed: 0 Anon 0: 0 Bob: 1001 Anon 1: 0 Anon 2: 1001 75

Day 4 (Dishonest) Withdraw 1001 ETH Mixer Contract total: 2000 deposited: 0 Alice: 1001 claimed: 2000 claimed: 0 Anon 0: 0 Bob: 1001 Anon 1: 0 Anon 2: 1001 76

Finally I got my money back I lost 1 ETH I got my money back Mixer Contract total: 2000 deposited: 0 Alice: 1001 claimed: 2000 claimed: 0 Anon 0: 0 Bob: 1001 Anon 1: 0 Anon 2: 1001 77

But my anonymous address was revealed Finally But my anonymous address was revealed Mixer Contract total: 2000 deposited: 0 Alice: 1001 claimed: 2000 claimed: 0 Anon 0: 0 Bob: 1001 Anon 1: 0 Anon 2: 1001 78

Ideas we covered in this lecture Anonymity vs Pseudnymity Linkability: heuristics, side-channels, etc. Dusting Attack AML / KYC Mixers, central, P 2 P, best practices Ethereum Mixer Contract