<p>In the following I focus on Confidential Transactions (instead of the extension Confidential Assets) for simplicity, but all of what I say is also true for Confidential Assets.</p>

<p><strong>Yes</strong>, it's possible to use cryptographic protocols to organize the CoinJoin transaction in a privacy-preserving manner. The <a href="https://eprint.iacr.org/2017/238.pdf" rel="nofollow noreferrer">ValueShuffle</a> protocol is designed for exactly this purpose. </p>

<p>ValueShuffle indeed makes sure that no third party (e.g., a server facilitating the CoinJoin) learns the involved amounts (or assets). But its privacy guarantees go beyond this requirement: In a nutshell, ValueShuffle makes sure that the amounts of your inputs and output, and the relationship between inputs and output remain private not only to third parties but also to the other the participants of the CoinJoin.</p>

<p>See the <a href="https://eprint.iacr.org/2017/238.pdf" rel="nofollow noreferrer">ValueShuffle paper</a> for all the details and limitations. Disclaimer: I'm one of the authors.</p>

<p>Your intuition that CoinJoin and Confidential Transactions are a good match is correct.
More concretely, we can exploit two important synergies.</p>

<ol>
<li>If we have Confidential Transactions, CoinJoins with different output amounts are suddenly possible. This eliminates one of the major restrictions of CoinJoin in practice.</li>
<li>The combination of CoinJoin and Confidential Transaction makes it possible to mix multiple payments instead of merely mixing self-sends (if the payer additionally has a mechanism to get more than one possible address of the payee). As a result, you can mix and pay with your coins in a single transaction. This is much better than CoinJoins without Confidential Transactions, where you first need to perform a mixing transaction and only after mixing you can perform an actual payment in a second transaction. This means that CoinJoining your payments will actually be cheaper (in terms of blockchain space and thus transaction fees) than performing payments individual. This provides a great incentive for doing CoinJoins. This is remarkable because privacy usually comes at a cost -- but in a scenario where Confidential Transactions are already available, CoinJoin comes with a discount.</li>
</ol>

<p><a href="https://www.youtube.com/watch?v=BPNs9EVxWrA&amp;feature=youtu.be&amp;t=5069" rel="nofollow noreferrer">My talk at Scaling Bitcoin 2017</a> provides a more detailed explanation on the advantages of combining CoinJoin and Confidential Transactions.</p>

CC BY-SA 4.0
2020-05-06T18:32:51.897Z
2020-05-06T18:32:51.897Z
real-or-random
<p>My thoughts:
Liquid uses confidential asset and tx. Therefore the asset type and amount is hiding from chain analysis. However the utxo's still carry history. This history could potentially lead chain analysers to form educated guesses of the assets. This would be far more difficult if a coinjoin mix (batching really) had occured. Coinjoins (batching) with confidential assets and tx would be extremely powerful.</p>

<p>My guestion:
If a 3rd party gathered people's txs and batched them into one single tx. Would this 3rd party be able to see every input and output's asset type and amount? Or is there some fancy crypto where the 3rd can construct the tx without knowing <em>any of that</em>?</p>

<confidential-transactions><liquid>
Is a privacy preserving coin mixer possible on Liquid?
Bertram Lund
# Is a privacy preserving coin mixer possible on Liquid?

(Asked by: username_0 on 2020-05-03)

My thoughts:
Liquid uses confidential asset and tx. Therefore the asset type and amount is hiding from chain analysis. However the utxo's still carry history. This history could potentially lead chain analysers to form educated guesses of the assets. This would be far more difficult if a coinjoin mix (batching really) had occured. Coinjoins (batching) with confidential assets and tx would be extremely powerful.

My guestion:
If a 3rd party gathered people's txs and batched them into one single tx. Would this 3rd party be able to see every input and output's asset type and amount? Or is there some fancy crypto where the 3rd can construct the tx without knowing *any of that*?

**Tags:** confidential-transactions, liquid


---

## 1 answers

### Answer by username_1 on 2020-05-06. Score: 2 | Accepted answer

In the following I focus on Confidential Transactions (instead of the extension Confidential Assets) for simplicity, but all of what I say is also true for Confidential Assets.

**Yes**, it's possible to use cryptographic protocols to organize the CoinJoin transaction in a privacy-preserving manner. The [ValueShuffle](https://eprint.iacr.org/2017/238.pdf) protocol is designed for exactly this purpose.

ValueShuffle indeed makes sure that no third party (e.g., a server facilitating the CoinJoin) learns the involved amounts (or assets). But its privacy guarantees go beyond this requirement: In a nutshell, ValueShuffle makes sure that the amounts of your inputs and output, and the relationship between inputs and output remain private not only to third parties but also to the other the participants of the CoinJoin.

See the [ValueShuffle paper](https://eprint.iacr.org/2017/238.pdf) for all the details and limitations. Disclaimer: I'm one of the authors.

Your intuition that CoinJoin and Confidential Transactions are a good match is correct.
More concretely, we can exploit two important synergies.

1. If we have Confidential Transactions, CoinJoins with different output amounts are suddenly possible. This eliminates one of the major restrictions of CoinJoin in practice.
2. The combination of CoinJoin and Confidential Transaction makes it possible to mix multiple payments instead of merely mixing self-sends (if the payer additionally has a mechanism to get more than one possible address of the payee). As a result, you can mix and pay with your coins in a single transaction. This is much better than CoinJoins without Confidential Transactions, where you first need to perform a mixing transaction and only after mixing you can perform an actual payment in a second transaction. This means that CoinJoining your payments will actually be cheaper (in terms of blockchain space and thus transaction fees) than performing payments individual. This provides a great incentive for doing CoinJoins. This is remarkable because privacy usually comes at a cost -- but in a scenario where Confidential Transactions are already available, CoinJoin comes with a discount.

[My talk at Scaling Bitcoin 2017](https://www.youtube.com/watch?v=BPNs9EVxWrA&feature=youtu.be&t=5069) provides a more detailed explanation on the advantages of combining CoinJoin and Confidential Transactions.


---

