Quote from: Realpra on March 22, 2015, 10:46:54 AM

Quote from: gmaxwell on March 20, 2015, 07:41:04 PM

In the big splashy CoinJoin post I simplified it down a model where there was someone acting like a 'server' that did the join, but I'd described it a year before in a more complex form that had perfect privacy and DOS resistance (though of course privacy is limited to the anonymity set size; though by building a CLOS network it can be arbitrarily large).

Well as has been recently shown someone could make a bunch of clients acting as servers for coinjoin transactions and gather a lot of data so the current simple version is a bit too simple I think.

I think you should describe your complex version a bit more in detail. Its also not entirely without consequence if an algorithm is very complex, it leaves room for error if no one understands it.

HTTPS is great example of this, yes people just click a button, but the security doesn't work because the certificate system is flawed.

If gmaxwell is referring to what I think he is, the way it works is roughly:
1. Parties connect to the server over an anonymous connection (e.g. over Tor) and request a blind signature on their outputs; they also submit their inputs.
2. From a fresh anonymous (e.g. over a new Tor circuit) connection, they send their real output. The server sees its signature and knows that this is one of the blinded ones from step (1).
3. They repeat step (2) for each of their outputs.

Once the server has as many unblinded outputs as it signed blinded ones, it can construct the merged transaction and submit it to the original parties from step (1) for signing.