<blockquote>
  <p>Community, what is the current state of privacy related BIPs?</p>
</blockquote>

<ul>
<li>CoinJoin related ones:

<ul>
<li>Adam Gibson's <a href="https://gist.github.com/AdamISZ/2c13fb5819bd469ca318156e2cf25d79" rel="nofollow noreferrer">SNICKER draft</a>, which permits a simple unidirectional CoinJoin construction.</li>
<li><a href="https://github.com/bitcoin/bips/blob/master/bip-0079.mediawiki" rel="nofollow noreferrer">BIP 79</a>, Bustapay, a standard for CoinJoined payments.</li>
</ul></li>
<li>P2P improvements:

<ul>
<li><a href="https://github.com/bitcoin/bips/blob/master/bip-0156.mediawiki" rel="nofollow noreferrer">BIP 156</a>, Dandelion: routing newly broadcast transactions a few hops before broadcasting.</li>
<li><a href="https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c51486325587c52" rel="nofollow noreferrer">Draft for BIP 324</a>: encryption of the P2P layer, making transaction origin harder to find for passive attackers</li>
<li><a href="https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-September/017323.html" rel="nofollow noreferrer">Draft for Erlay BIP</a>: (less directly privacy focused) introduces a lower-bandwidth, less directed, transaction broadcast mechanism</li>
</ul></li>
<li>Consensus rules:

<ul>
<li>My own <a href="https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-May/016914.html" rel="nofollow noreferrer">draft for BIP-taproot</a></li>
</ul></li>
</ul>

<p>The first set of these are not consensus or protocol changes to Bitcoin's network. They're merely standards that wallet can choose to implement to improve privacy of their own transactions. There are many more techniques that may or may not be implemented by wallets which aren't written up as formal BIPs, see this great article on the Bitcoin.it wiki by Chris Belcher with an overview: <a href="https://en.bitcoin.it/wiki/Privacy" rel="nofollow noreferrer">https://en.bitcoin.it/wiki/Privacy</a></p>

<blockquote>
  <p>Anything on the roadmap by core devs to be deployed on main chain within the next year?</p>
</blockquote>

<p>Privacy is a complex topic, and while there are some things possible at the protocol level where core developers may be more involved, there is far more to be done at the wallet level. The taproot proposal is an example of a protocol level change: it aims to improve a different type: on-chain policy privacy. This is the problem that the type of scripts your wallet chooses to use on the network reveals what kind of things it is doing (e.g. Multisig, Lightning, 2FA, ...). The goal of Taproot is to make sure that in cooperative cases, all transaction outputs and inputs look indistinguishable. This is completely distinct from the type of privacy leak that CoinJoin-style approaches (which expose linkage between transactions).</p>

<p>As for when it might activate on the network, I doubt anyone can tell you. That is up to the community.</p>

<blockquote>
  <p>And regarding mimblewimble: you are aware i assume on the latest researcher claims about broken privacy model of mimble wimble?</p>
</blockquote>

<p>I think that's a highly confused statement. Mimblewimble itself does not provide any privacy improvement. It is an improved designed over Confidential Transactions (which <em>is</em> a privacy technique, hiding transaction amounts), making it more scalable and enabling non-interactive CoinJoin.</p>

<p>If you look at the <a href="https://github.com/mimblewimble/docs/wiki/MimbleWimble-Origin" rel="nofollow noreferrer">original Mimblewimble paper</a> by Tom Elvis Jedusor, or the <a href="https://download.wpsoftware.net/bitcoin/wizardry/mimblewimble.pdf" rel="nofollow noreferrer">more formal paper</a> by Andrew Poelstra, you'll see that privacy is only mentioned in the context of what is provided by CT, or enabled by CoinJoin.</p>

<p>CoinJoin itself is not broken, but how it is used matters a lot. In correct usage, participants interact privately to jointly construct a single transaction, which, when revealed to the public, cannot be disassembled into the individual participants' contributions. What happened in a particular Mimblewimble implementation was they use CoinJoin <em>on the public network</em>. It should be obvious that this does not grant any privacy to anyone observing the network, as they can easily see all individual contributions to transactions. This is not a bad idea either, but it's only a scalability gain. For privacy, CoinJoin needs to happen elsewhere too.</p>

<p>So again: CoinJoin is not broken; it helps when used right. Mimblewimble or its privacy is also not broken - Confidential Transactions and the ability for non-interactive CoinJoin are great. Mimblewimble also enables non-interactive CoinJoin, which happens to be usable as a scalability improvement as well, but when done publicly, does not improve privacy.</p>

<blockquote>
  <p>Now, I think the current BIPs have all somehow a mimblewimble-like or CoinJoin-Like approach to solving privacy, right??</p>
</blockquote>

<p>You don't "solve" privacy. Privacy is a goal to achieve, but it's multifaceted, and isn't solved by a single piece of technology. Significant parts of privacy are about education and incentives, not a magic bullet technology that suddenly hides everything.</p>

<p>Also, to the best of my knowledge nobody has seriously proposed Mimblewimble in Bitcoin.</p>

<blockquote>
  <p>Would above quote from BOgatty also apply to the current privacy BIPs (or to the majority of them)? Without claiming whether it is a flaw or not, just the basic fact: do the currently leading privacy BIPs have this approach of "putting transactions into a single CoinJoin"?</p>
</blockquote>

<p>No, because it doesn't apply to CoinJoin. It applies to the use of a scalability improvement inherent to Mimblewimble implementations, which has been misrepresented by some as a privacy gain.</p>

<blockquote>
  <p>Would be nice if someone can clarify the state of privacy with Bitcoin, or the future state.</p>
</blockquote>

<p>It's hard, but we'll get there.</p>

CC BY-SA 4.0
2019-11-22T01:42:04.317Z
2019-11-22T01:49:41.147Z
2019-11-22T01:49:41.147Z
Pieter Wuille
<p>Community,
what is the current state of privacy related BIPs? Anything on the roadmap by core devs to be deployed on main chain within the next year?  IF yes, could you link me to this BIP(s)?</p>

<p>And regarding mimblewimble: you are aware i assume on the latest researcher claims about broken privacy model of mimble wimble? This guy's analysis looks convincing. </p>

<blockquote>
  <p>"As Bogatty put it, all transactions on Mimblewimble are put into a
  single CoinJoin, which leaves anonymity set with all the transactions
  being located on one block. Unlike other privacy cryptocurrency
  networks and cons which shield their anonymity sets and transactions,
  Mimblewimble has this inherent flaw, and he was able to exploit it and
  access those transaction details."</p>
</blockquote>

<p>quote from: <a href="https://insidebitcoins.com/news/litecoin-ceo-defends-mimblewimble-against-privacy-critics/242702" rel="nofollow noreferrer">https://insidebitcoins.com/news/litecoin-ceo-defends-mimblewimble-against-privacy-critics/242702</a></p>

<ul>
<li><p>Now, I think the current BIPs have all somehow a mimblewimble-like or CoinJoin-Like approach to solving privacy, right??</p></li>
<li><p>Would above quote from BOgatty also apply to the current privacy BIPs (or to the majority of them)? Without claiming whether it is a flaw or not, just the basic fact: do the currently leading privacy BIPs have this approach of "putting transactions  into a single CoinJoin"?</p></li>
</ul>

<p>Would be nice if someone can clarify the state of privacy with Bitcoin, or the future state. </p>

<p>Thanks</p>

<bitcoin-core><bitcoin-core-development><privacy><bip><mimblewimble>
Bitcoin privacy - current state of privacy BIPs - is mimblewimble broken?
johnsmiththelird
# Bitcoin privacy - current state of privacy BIPs - is mimblewimble broken?

(Asked by: username_0 on 2019-11-22)

Community,
what is the current state of privacy related BIPs? Anything on the roadmap by core devs to be deployed on main chain within the next year? IF yes, could you link me to this BIP(s)?

And regarding mimblewimble: you are aware i assume on the latest researcher claims about broken privacy model of mimble wimble? This guy's analysis looks convincing.

> "As Bogatty put it, all transactions on Mimblewimble are put into a
> single CoinJoin, which leaves anonymity set with all the transactions
> being located on one block. Unlike other privacy cryptocurrency
> networks and cons which shield their anonymity sets and transactions,
> Mimblewimble has this inherent flaw, and he was able to exploit it and
> access those transaction details."

quote from: <https://insidebitcoins.com/news/litecoin-ceo-defends-mimblewimble-against-privacy-critics/242702>

* Now, I think the current BIPs have all somehow a mimblewimble-like or CoinJoin-Like approach to solving privacy, right??
* Would above quote from BOgatty also apply to the current privacy BIPs (or to the majority of them)? Without claiming whether it is a flaw or not, just the basic fact: do the currently leading privacy BIPs have this approach of "putting transactions into a single CoinJoin"?

Would be nice if someone can clarify the state of privacy with Bitcoin, or the future state.

Thanks

**Tags:** bitcoin-core, bitcoin-core-development, privacy, bip, mimblewimble


---

## 1 answers

### Answer by username_1 on 2019-11-22. Score: 2

> Community, what is the current state of privacy related BIPs?

* CoinJoin related ones:
  + Adam Gibson's [SNICKER draft](https://gist.github.com/AdamISZ/2c13fb5819bd469ca318156e2cf25d79), which permits a simple unidirectional CoinJoin construction.
  + [BIP 79](https://github.com/bitcoin/bips/blob/master/bip-0079.mediawiki), Bustapay, a standard for CoinJoined payments.
* P2P improvements:
  + [BIP 156](https://github.com/bitcoin/bips/blob/master/bip-0156.mediawiki), Dandelion: routing newly broadcast transactions a few hops before broadcasting.
  + [Draft for BIP 324](https://gist.github.com/jonasschnelli/c530ea8421b8d0e80c51486325587c52): encryption of the P2P layer, making transaction origin harder to find for passive attackers
  + [Draft for Erlay BIP](https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-September/017323.html): (less directly privacy focused) introduces a lower-bandwidth, less directed, transaction broadcast mechanism
* Consensus rules:
  + My own [draft for BIP-taproot](https://lists.linuxfoundation.org/pipermail/bitcoin-dev/2019-May/016914.html)

The first set of these are not consensus or protocol changes to Bitcoin's network. They're merely standards that wallet can choose to implement to improve privacy of their own transactions. There are many more techniques that may or may not be implemented by wallets which aren't written up as formal BIPs, see this great article on the Bitcoin.it wiki by Chris Belcher with an overview: <https://en.bitcoin.it/wiki/Privacy>

> Anything on the roadmap by core devs to be deployed on main chain within the next year?

Privacy is a complex topic, and while there are some things possible at the protocol level where core developers may be more involved, there is far more to be done at the wallet level. The taproot proposal is an example of a protocol level change: it aims to improve a different type: on-chain policy privacy. This is the problem that the type of scripts your wallet chooses to use on the network reveals what kind of things it is doing (e.g. Multisig, Lightning, 2FA, ...). The goal of Taproot is to make sure that in cooperative cases, all transaction outputs and inputs look indistinguishable. This is completely distinct from the type of privacy leak that CoinJoin-style approaches (which expose linkage between transactions).

As for when it might activate on the network, I doubt anyone can tell you. That is up to the community.

> And regarding mimblewimble: you are aware i assume on the latest researcher claims about broken privacy model of mimble wimble?

I think that's a highly confused statement. Mimblewimble itself does not provide any privacy improvement. It is an improved designed over Confidential Transactions (which *is* a privacy technique, hiding transaction amounts), making it more scalable and enabling non-interactive CoinJoin.

If you look at the [original Mimblewimble paper](https://github.com/mimblewimble/docs/wiki/MimbleWimble-Origin) by Tom Elvis Jedusor, or the [more formal paper](https://download.wpsoftware.net/bitcoin/wizardry/mimblewimble.pdf) by Andrew Poelstra, you'll see that privacy is only mentioned in the context of what is provided by CT, or enabled by CoinJoin.

CoinJoin itself is not broken, but how it is used matters a lot. In correct usage, participants interact privately to jointly construct a single transaction, which, when revealed to the public, cannot be disassembled into the individual participants' contributions. What happened in a particular Mimblewimble implementation was they use CoinJoin *on the public network*. It should be obvious that this does not grant any privacy to anyone observing the network, as they can easily see all individual contributions to transactions. This is not a bad idea either, but it's only a scalability gain. For privacy, CoinJoin needs to happen elsewhere too.

So again: CoinJoin is not broken; it helps when used right. Mimblewimble or its privacy is also not broken - Confidential Transactions and the ability for non-interactive CoinJoin are great. Mimblewimble also enables non-interactive CoinJoin, which happens to be usable as a scalability improvement as well, but when done publicly, does not improve privacy.

> Now, I think the current BIPs have all somehow a mimblewimble-like or CoinJoin-Like approach to solving privacy, right??

You don't "solve" privacy. Privacy is a goal to achieve, but it's multifaceted, and isn't solved by a single piece of technology. Significant parts of privacy are about education and incentives, not a magic bullet technology that suddenly hides everything.

Also, to the best of my knowledge nobody has seriously proposed Mimblewimble in Bitcoin.

> Would above quote from BOgatty also apply to the current privacy BIPs (or to the majority of them)? Without claiming whether it is a flaw or not, just the basic fact: do the currently leading privacy BIPs have this approach of "putting transactions into a single CoinJoin"?

No, because it doesn't apply to CoinJoin. It applies to the use of a scalability improvement inherent to Mimblewimble implementations, which has been misrepresented by some as a privacy gain.

> Would be nice if someone can clarify the state of privacy with Bitcoin, or the future state.

It's hard, but we'll get there.


---

