<p>Sidenote: bitcoins exist as unspent transaction outputs (UTXOs), so with this in mind the two options you outlined for Alice create two different situations: in situation 1, Alice will have one UTXO. In situation 2, Alice will have 3 UTXOs. The question you've asked involves an analysis of UTXOs, so I thought this was worth mentioning.</p>

<blockquote>
  <p>Can someone observing the Blockchain <strong>deterministically</strong> figure out A1, A2 and A3 belong to same user?</p>
</blockquote>

<p>No, they cannot determine this absolutely in either case. Coinjoining techniques exist that break the heuristic of <em>"all transaction inputs belong to a single user"</em>, and as these techniques are developed and more widely adopted they will make this heuristic even less reliable. I know you said <em>"assume she didn't use these techniques"</em>, but in the real world that assumption may not be valid. </p>

<p>Otherwise your question is more of an assertion: <em>"We must assume coinjoin of any sort does not exist, and therefore all transaction inputs belong to a single user"</em>. A transaction which has multiple users supplying inputs is by definition a <em>joining of coins</em>.</p>

<blockquote>
  <p>If Alice now spends A4 to Bob (sends all amount, she never uses A4 again), can Bob ever figure out that A1, A2 and A3 belonged to Alice?</p>
</blockquote>

<p>Bob can see that A1, A2, and A3 were involved in the same transaction Alice was, but this does not imply she owns all of those addresses. Those addresses could be Alice's, or someone else that sent BTC to Alice. By spending A4 she does not reveal any information in this regard.</p>

<blockquote>
  <p>What privacy will Alice (or someone down the trail, like Bob) lose if she goes for option 2?</p>
</blockquote>

<p>Creating multiple UTXOs for a single address does not give the user more privacy, compared to creating a single UTXO for that address. </p>

<blockquote>
  <p>Is reusing addresses to only receive payments and spending that address only once okay?</p>
</blockquote>

<p>It depends what you mean by 'okay'. It is not good for your privacy, or the privacy of those you interact with, since other users can see more of your financial history, and get a better idea of what other addresses you've transacted with. That is generally the biggest worry of using a singular address, the sort of hypothetical future ECDSA-breaking attack that not revealing your public key protects against (ie: only spend once from an address) is probably less of a concern for most users. </p>

CC BY-SA 4.0
2019-02-11T09:19:21.707Z
2019-02-11T09:19:21.707Z
chytrik
<p>With option 2, most analyses will conclude that Alice owned A1, A2 and A3, because the transactions which spent them have no change address. Typically, you assume that the amount you have held in a TXO never exactly matches the amount you're making as a payment, so transactions usually have change outputs too.</p>

<p>I think you have a little misunderstanding about where bitcoins are held. Bitcoins are not stored in addresses. You don't "spend an address." You spend one or more UTXOs. Each transaction in option 2 creates a separate TXO, even though they share the same address for spending. This means, when the coins associated with A4 get spent in full, the individual TXOs are each inputs for the new transaction, which makes it look more like option 1 (multiple inputs, one output) when spent, like this.</p>

<pre><code>+--------------------+
|A4 (txo1)         B1|
|A4 (txo2)   -&gt;      |
|A4 (txo3)           |
+--------------------+
</code></pre>

<p>Bob can of course, look at each of these inputs and see which transaction they came from, but he can't necessarily determine whether the addresses actually belonged to Alice, or whether it is just likely that is the case. Without some more evidence from further back in the history of the coins, you cannot prove whether Alice owned them initially or received them from somebody else.</p>

CC BY-SA 4.0
2019-02-11T09:00:41.227Z
You are right, I did made a terrible mistake in forming my question. I ought to remove the second question, it's confusing. Although in my mind I meant what you just described in your answer - spending individual UTXOs.
Vijay Chavda
CC BY-SA 4.0
2019-02-11T09:05:28.723Z
Could you kindly elaborate on the fourth point, regarding reusing a fresh address to only receive payments and spend it only once?
Vijay Chavda
CC BY-SA 4.0
2019-02-11T07:09:26.917Z
2019-02-11T07:14:30.580Z
2019-02-11T07:14:30.580Z
Mark H
<p>Alice owns three addresses <code>A1</code>, <code>A2</code>, <code>A3</code>. She decides to collect the coins held by these addresses into a single coin so she generates <em>a fresh new address</em> <code>A4</code> for that.</p>

<p>She has the following two options:</p>

<p><strong>1. Single transaction</strong></p>

<p><code>+--------------+
 |A1          A4|
 |A2    -&gt;      |
 |A3            |
 +--------------+</code></p>

<p><strong>2. Multiple transactions</strong></p>

<p><code>+--------------+
 |A1          A4|
 +--------------+</code></p>

<p><code>+--------------+
 |A2          A4|
 +--------------+</code></p>

<p><code>+--------------+
 |A3          A4|
 +--------------+</code></p>

<hr>

<p>She does not want people to know that <code>A1</code>, <code>A2</code> and <code>A3</code> are owned by her. And she does not intend to use any mixing services. She also don't mind paying more transaction fees as in option 2.</p>

<h2>Option 1</h2>

<p><code>A1</code>, <code>A2</code> and <code>A3</code> can be linked together assuming she did not use any <a href="https://bitcointalk.org/index.php?topic=279249.0" rel="nofollow noreferrer">Coin Join</a> technique.</p>

<h2>Option 2</h2>

<p>It can be seen that <code>A4</code> is reused to receive payments. However <code>A4</code> has never been seen before this transaction.</p>

<h3>Questions on Option 2:</h3>

<ol>
<li><p>Can someone observing the Blockchain <strong>deterministically</strong> figure out <code>A1</code>, <code>A2</code> and <code>A3</code> belong to same user?</p></li>
<li><p><strike>If Alice now spends <code>A4</code> to Bob (sends all amount, she never uses <code>A4</code> again), can Bob ever figure out that <code>A1</code>, <code>A2</code> and <code>A3</code> belonged to Alice?</strike></p></li>
<li><p>What privacy will Alice (or someone down the trail, like Bob) lose if she goes for option 2?</p></li>
<li><p>Is reusing addresses to only receive payments and spending that address only once okay?</p></li>
</ol>

<address><privacy><address-reuse><mixing><coinjoin>
Single "Multiple Inputs Tx" vs Multiple "Single Input Tx"
Vijay Chavda
# Single "Multiple Inputs Tx" vs Multiple "Single Input Tx"

(Asked by: username_0 on 2019-02-11)

Alice owns three addresses `A1`, `A2`, `A3`. She decides to collect the coins held by these addresses into a single coin so she generates *a fresh new address* `A4` for that.

She has the following two options:

**1. Single transaction**

`+--------------+
|A1 A4|
|A2 -> |
|A3 |
+--------------+`

**2. Multiple transactions**

`+--------------+
|A1 A4|
+--------------+`

`+--------------+
|A2 A4|
+--------------+`

`+--------------+
|A3 A4|
+--------------+`

---

She does not want people to know that `A1`, `A2` and `A3` are owned by her. And she does not intend to use any mixing services. She also don't mind paying more transaction fees as in option 2.

## Option 1

`A1`, `A2` and `A3` can be linked together assuming she did not use any [Coin Join](https://bitcointalk.org/index.php?topic=279249.0) technique.

## Option 2

It can be seen that `A4` is reused to receive payments. However `A4` has never been seen before this transaction.

### Questions on Option 2:

1. Can someone observing the Blockchain **deterministically** figure out `A1`, `A2` and `A3` belong to same user?
2. If Alice now spends `A4` to Bob (sends all amount, she never uses `A4` again), can Bob ever figure out that `A1`, `A2` and `A3` belonged to Alice?
3. What privacy will Alice (or someone down the trail, like Bob) lose if she goes for option 2?
4. Is reusing addresses to only receive payments and spending that address only once okay?

**Tags:** address, privacy, address-reuse, mixing, coinjoin


---

## 2 answers

### Answer by username_1 on 2019-02-11. Score: 1 | Accepted answer

Sidenote: bitcoins exist as unspent transaction outputs (UTXOs), so with this in mind the two options you outlined for Alice create two different situations: in situation 1, Alice will have one UTXO. In situation 2, Alice will have 3 UTXOs. The question you've asked involves an analysis of UTXOs, so I thought this was worth mentioning.

> Can someone observing the Blockchain **deterministically** figure out A1, A2 and A3 belong to same user?

No, they cannot determine this absolutely in either case. Coinjoining techniques exist that break the heuristic of *"all transaction inputs belong to a single user"*, and as these techniques are developed and more widely adopted they will make this heuristic even less reliable. I know you said *"assume she didn't use these techniques"*, but in the real world that assumption may not be valid.

Otherwise your question is more of an assertion: *"We must assume coinjoin of any sort does not exist, and therefore all transaction inputs belong to a single user"*. A transaction which has multiple users supplying inputs is by definition a *joining of coins*.

> If Alice now spends A4 to Bob (sends all amount, she never uses A4 again), can Bob ever figure out that A1, A2 and A3 belonged to Alice?

Bob can see that A1, A2, and A3 were involved in the same transaction Alice was, but this does not imply she owns all of those addresses. Those addresses could be Alice's, or someone else that sent BTC to Alice. By spending A4 she does not reveal any information in this regard.

> What privacy will Alice (or someone down the trail, like Bob) lose if she goes for option 2?

Creating multiple UTXOs for a single address does not give the user more privacy, compared to creating a single UTXO for that address.

> Is reusing addresses to only receive payments and spending that address only once okay?

It depends what you mean by 'okay'. It is not good for your privacy, or the privacy of those you interact with, since other users can see more of your financial history, and get a better idea of what other addresses you've transacted with. That is generally the biggest worry of using a singular address, the sort of hypothetical future ECDSA-breaking attack that not revealing your public key protects against (ie: only spend once from an address) is probably less of a concern for most users.


---

### Answer by username_2 on 2019-02-11. Score: 2

With option 2, most analyses will conclude that Alice owned A1, A2 and A3, because the transactions which spent them have no change address. Typically, you assume that the amount you have held in a TXO never exactly matches the amount you're making as a payment, so transactions usually have change outputs too.

I think you have a little misunderstanding about where bitcoins are held. Bitcoins are not stored in addresses. You don't "spend an address." You spend one or more UTXOs. Each transaction in option 2 creates a separate TXO, even though they share the same address for spending. This means, when the coins associated with A4 get spent in full, the individual TXOs are each inputs for the new transaction, which makes it look more like option 1 (multiple inputs, one output) when spent, like this.

```
+--------------------+
|A4 (txo1)         B1|
|A4 (txo2)   ->      |
|A4 (txo3)           |
+--------------------+

```

Bob can of course, look at each of these inputs and see which transaction they came from, but he can't necessarily determine whether the addresses actually belonged to Alice, or whether it is just likely that is the case. Without some more evidence from further back in the history of the coins, you cannot prove whether Alice owned them initially or received them from somebody else.

> **Comments:**
> **username_0**: You are right, I did made a terrible mistake in forming my question. I ought to remove the second question, it's confusing. Although in my mind I meant what you just described in your answer - spending individual UTXOs.  
> **username_0**: Could you kindly elaborate on the fourth point, regarding reusing a fresh address to only receive payments and spend it only once?  

---

