Quote from: austonst on July 19, 2012, 09:51:27 PM

Quote from: aq on July 19, 2012, 09:22:34 PM

One of the biggest issues is that once you make a transfer you combine coins from multiple addresses and as a result those can be identified as one wallet. I think casascius proposal addresses this only to some extent. If after mixing coins I again have to combine I have gained nothing.
How about we do it different:
Whenever I want to make a transaction, my client sends this out as a "transaction-indent", other clients that are also about to do a transaction combine their "indent" with mine (adding inputs and outputs) and after a few seconds, we all sign this combined indent to form a transaction.
This would make it impossible to identify a single wallet, because inputs from multiple wallets would end up in a single transaction. And secondary, on one would know which input was the initiator for which output.
Your comments?

The reason this coin mixing strategy reveals that addresses belong to the same wallet is because of addition. Let's say you see a tx with inputs of value 2, 3, 1, and 5. The outputs are of value 5, 5, and 1. It's pretty easy to tell, knowing that this is a mixing tx, that the 2 and 3 came from the same source and that the 1 and 5 came from the same source. We also know that the output of 1 belongs to the owner of the previous 1 and 5 tx's. What we've gained is not knowing who owns each 5 output.

With your proposed solution of just having two transactions per transaction, we still have the same problem. Let's say Alice is paying 3 BTC using inputs of size 2 and 2. Bob has another transaction where he pays 10 BTC with a 3 and a 7.

Inputs: 2 2 3 7
Outputs: 3 1 10

It's still pretty easy to distinguish between the transactions. Clearly, one person owns the 2 and 2 input addresses, and someone else owns the 3 and 7 addresses. We can still tell that addresses are related. With both ideas, the only way to avoid this is to have equally sized inputs (which is difficult when bitcoins are divisible down to 8 decimal places).

Inputs: 1 4 4 2
Outputs: 5 6

Now there's two possible solutions. 1 4 4 2 or 1 4 4 2. Casascius' idea of limiting mixing sizes to 5^n would help ensure that after the first mixing, each output should be of a fixed size. That should help reduce these concerns.

Getting back to the original issue: yes, using this mixing to combine coins would still often show that some of the source addresses are held by the same person. The strength is that that knowledge cannot be used to track future transactions. You become detached from your past, breaking any string of transactions people might be using to track you. Now, if you have 0.3 and 0.7 unspent tx's, and you happen to come across someone else with exactly 0.3 and 0.7, you can make it uncertain that you own both addresses.

Well, my proposal wasn't to mix 2 transactions, but maybe 10, or even 50. And then once you add the change addresses (at least 1 per wallet), it is no longer so easy to figure out what was used for what, and what belongs to what.