Quote from: stdset on May 23, 2017, 05:11:46 AM

Quote from: dinofelis on May 23, 2017, 05:05:16 AM

In bitcoin, there is no way to do CoinJoin trustlessly - at least at the protocol level.

Why so? A link?
To me it looked quite simple:

Quote from: Bitcoin wiki

The signatures, one per input, inside a transaction are completely independent of each other. This means that it's possible for Bitcoin users to agree on a set of inputs to spend, and a set of outputs to pay to, and then to individually and separately sign a transaction and later merge their signatures. The transaction is not valid and won't be accepted by the network until all signatures are provided, and no one will sign a transaction which is not to their liking.
No risk of theft at any point.

Yes, you are right, I confused the anonymity, and the fund security. With coinjoin "done by hand", there is always an entity that has to construct the transaction, and of course that entity knows which output and which input go together, but you are right that there's no risk for the funds themselves, if you can check yourself that to your input you need to sign, corresponds an output you wanted with the right amount.

There's nothing that would stop the "central mixer" to propose a tree of coinjoin mixings to the users, in the same way DASH does automatically with master nodes, and monero does implicitly without need for user agreement in ring signatures.