Quote from: sundance on August 24, 2014, 03:18:48 PM

Sure I see where you're going with that, laurentmt. And agreed that entropy is less for BCM/Join than for native Joins, # of players being equal.

Yup. I suck at poker ! Wink

Quote from: sundance on August 24, 2014, 03:18:48 PM

That said, BCM is intended to make it easier to mix against larger, more diverse sets of players, and the number of mix participants is a random variable

100% agree about the value of BCM as a decentralized solution to address scalability and heterogeneity of inputs.

Quote from: sundance on August 24, 2014, 03:18:48 PM

so one could argue that the entropy comparison should be a probabilistic calculation where the expected # of players for a Join in BCM is equal to the # of players in the native join. Some txns in BCM will have fewer, some will have more.

To be honest, I don't feel comfortable with a probabilistic calculation. I tend to think that all measures of anonymity should be done on specific instances of mix(es) and not on averaged or probabilistic mix(es). This is the only way for users to be sure of their level of anonymity.

Note that this remark also worths for my use of entropy which is a measure at tx level. For perfect coinjoins (all inputs with same value, all outputs with same value) this measure is ok. But for coinjoins with different input/output values, the degree of anonymity is not the same for all players and we should have a more local measure (at txout level). Work in progress...

Quote from: sundance on August 24, 2014, 03:18:48 PM

Entropy analysis does cover the combinatorial dimension of semantic security, assuming the adversary knows all information known to any participant until the Join. Still, there are a few other dimension that I think should be taken into account.

100% agree

Quote from: sundance on August 24, 2014, 03:18:48 PM

If we're willing to allow consideration for the common case (1) separately from the worst case (3), then with (1) BCM has something that native doesn't: the times in which the transactions occur can vary, so much so that other mix transactions can be interspersed in between transactions of this mix. There can be other non-mix transactions that look like mix transactions as well.

Definitely one of the strengths of BCM. Interspersed txs could be a solution to increase entropy of coinjoin mixes.
[Note: In my previous post, I suggested to chain coinjoin txs to increase entropy. It can help but it doesn't work for all cases (like a coinjoin tx with only 2 inputs and 2 outputs)]