<p>Regardless of the maximum size of a single transaction, a CJ anonymity set can be made arbitrarily large (bounded, of course, by participants) by building a multi-stage switching network out of joins.</p>

<p>This was described in the <a href="https://bitcointalk.org/index.php?topic=279249.0" rel="nofollow noreferrer">original coinjoin post</a>:</p>

<blockquote>
  <p>In particular, if you can build transactions with m participants per transaction you can create a sequence of m*3 transactions which form a three-stage <a href="http://en.wikipedia.org/wiki/Clos_network" rel="nofollow noreferrer">switching network</a> that permits any of m^2 final outputs to have come from any of m^2 original inputs (e.g. using three stages of 32 transactions with 32 inputs each 1024 users can be joined with a total of 96 transactions).  This allows the anonymity set to be any size, limited only by participation.</p>
</blockquote>

<p>There is no atomiticy required between these transactions-- other than if some users drop out the anonymity set will be less than expected.</p>

CC BY-SA 4.0
2018-07-31T03:45:20.747Z
2018-07-31T03:45:20.747Z
G. Maxwell
<p>You assumed inputs and outputs were the same size, which they're not. A typical input is 148 bytes, an output is 34. Hence, the maximum anonymity set is 549 inputs to 549 outputs.</p>

<p>I didn't do the maths for SW type outputs, but they'd allow a larger anonymity set, assuming other limits like sig ops (signature operations) and hashing operations are respected.</p>

CC BY-SA 3.0
2017-07-26T22:34:47.040Z
> You assumed inputs and outputs were the same size  
I did not assume, they just don't matter. I simply went with a 1in2out 220byte and 2in2out 360byte tx estimation. Your estmation is 1in1out. Which will likely never happen in a CJ transaction, because CJ transactions must have a common output denomination, therefore a change output is inevitable in almost every case.
nopara73
CC BY-SA 3.0
2017-07-27T08:43:17.587Z
But using small transactions as a basis is not correct either, since there's a fixed 10 bytes overhead per transaction, no matter the number of participants.
alcio
CC BY-SA 3.0
2017-07-28T04:32:02.490Z
Indeed, that'd result 5% (in case of 220 bytes tx) and 2.5% (in case of 360 bytes tx) anonimity set increase.
nopara73
CC BY-SA 3.0
2017-07-25T12:17:16.027Z
2017-07-25T12:17:16.027Z
alcio
<p>I found the only limiting factor is the maximum standard transaction size which is <code>100k bytes</code>.<br>
The most common transactions we are concerned with are <code>1 input, 2 outputs</code> and the second most common are be <code>2 inputs 2 outputs</code> transactions and the sizes of these transactions are about <code>220 byte</code> and <code>360 byte</code>.<br>
therefore the maximum achievable anonimity set would go from <code>270</code> to <code>450</code> <code>(100k/360=270, 100k/220=450)</code>.  </p>

<ol>
<li>Am I correct so far?  </li>
<li>Is there any more limiting factors?  </li>
<li>Does SegWit elevate the size of the signature out of the calculation of maximum standard transaction size, therefore resulting around <code>30%</code> more anonimity sets? (Signatures are <code>71 bytes</code> on average.) So in this case <code>351</code> to <code>468</code>.</li>
</ol>

CC BY-SA 3.0
2017-07-25T02:16:24.287Z
For future reference, meta is only for questions about Bitcoin StackExchange itself.
Nick ODell
CC BY-SA 3.0
2017-07-25T03:17:09.520Z
My bad. This explains why I couldn't add proper tags.
nopara73
<transactions><privacy><coinjoin>
What is the maximum anonimity set of a CoinJoin transaction?
nopara73
# What is the maximum anonimity set of a CoinJoin transaction?

(Asked by: username_0 on 2017-07-25)

I found the only limiting factor is the maximum standard transaction size which is `100k bytes`.  
The most common transactions we are concerned with are `1 input, 2 outputs` and the second most common are be `2 inputs 2 outputs` transactions and the sizes of these transactions are about `220 byte` and `360 byte`.  
therefore the maximum achievable anonimity set would go from `270` to `450` `(100k/360=270, 100k/220=450)`.

1. Am I correct so far?
2. Is there any more limiting factors?
3. Does SegWit elevate the size of the signature out of the calculation of maximum standard transaction size, therefore resulting around `30%` more anonimity sets? (Signatures are `71 bytes` on average.) So in this case `351` to `468`.

**Tags:** transactions, privacy, coinjoin

> **Comments:**
> **username_1**: For future reference, meta is only for questions about Bitcoin StackExchange itself.  
> **username_0**: My bad. This explains why I couldn't add proper tags.  

---

## 2 answers

### Answer by username_2 on 2018-07-31. Score: 2 | Accepted answer

Regardless of the maximum size of a single transaction, a CJ anonymity set can be made arbitrarily large (bounded, of course, by participants) by building a multi-stage switching network out of joins.

This was described in the [original coinjoin post](https://bitcointalk.org/index.php?topic=279249.0):

> In particular, if you can build transactions with m participants per transaction you can create a sequence of m\*3 transactions which form a three-stage [switching network](http://en.wikipedia.org/wiki/Clos_network) that permits any of m^2 final outputs to have come from any of m^2 original inputs (e.g. using three stages of 32 transactions with 32 inputs each 1024 users can be joined with a total of 96 transactions). This allows the anonymity set to be any size, limited only by participation.

There is no atomiticy required between these transactions-- other than if some users drop out the anonymity set will be less than expected.


---

### Answer by username_3 on 2017-07-25. Score: 0

You assumed inputs and outputs were the same size, which they're not. A typical input is 148 bytes, an output is 34. Hence, the maximum anonymity set is 549 inputs to 549 outputs.

I didn't do the maths for SW type outputs, but they'd allow a larger anonymity set, assuming other limits like sig ops (signature operations) and hashing operations are respected.

> **Comments:**
> **username_0**: > You assumed inputs and outputs were the same size   I did not assume, they just don't matter. I simply went with a 1in2out 220byte and 2in2out 360byte tx estimation. Your estmation is 1in1out. Which will likely never happen in a CJ transaction, because CJ transactions must have a common output denomination, therefore a change output is inevitable in almost every case.  
> **username_3**: But using small transactions as a basis is not correct either, since there's a fixed 10 bytes overhead per transaction, no matter the number of participants.  
> **username_0**: Indeed, that'd result 5% (in case of 220 bytes tx) and 2.5% (in case of 360 bytes tx) anonimity set increase.  

---

