Privacy¶
A coinjoin hides which input paid for which output. joinstr adds a few rules on top so that the coordination layer does not undo that.
What each party sees¶
| Party | Sees | Does not see |
|---|---|---|
| Chain observer | One transaction with equal outputs, one per peer | Which input belongs to which output |
| Relay | Encrypted events, their timing and the Tor exit they came from | Pool contents, addresses or PSBTs |
| Other peers | Every output address and every signed input | Which output belongs to which input |
| Pool creator | The same as other peers | Anything more, apart from knowing they created the pool |
Peers see all outputs and all inputs because each one has to check and sign the full transaction. What they cannot see is the link between them, as long as a peer's output and input messages cannot be tied together.
How the link is kept hidden¶
New keys. The pool has its own nostr key pair. Every joining peer uses a new key for the join request. No long lived nostr identity is attached to a pool.
Encryption. After the join, every message is encrypted to the pool key. Only peers holding the pool's private key can read it.
Tor circuits. With the tor transport, clients send each nostr operation through a new Tor circuit by using a random SOCKS user name. The output message and the input message of a peer leave from different Tor exits, so the relay cannot match them by IP address.
Fresh output addresses. Clients take an unused address for every output. The Electrum plugin also refuses an input from an address that already takes part in another pool.
No change. There is no change output that could be traced back to an input.
Equal outputs. All outputs have the same value, so amounts do not reveal who owns which output.
VPN transport¶
The Electrum plugin and the Android app also offer a vpn transport. The pool names a Riseup VPN gateway and every peer connects through it, so all peers share one exit IP address. The relay sees the same IP address for every peer and cannot tell them apart by it. A VPN pool also means trusting the VPN provider with your traffic. Tor is the default and the recommended choice.
What joinstr does not protect against¶
- Timing. A relay sees when messages arrive. Messages sent on new circuits but at predictable times give it some signal.
- Your wallet backend. An Electrum server learns which addresses your wallet asks about. Use your own server, or your own Bitcoin Core node, for the best privacy.
- Spending carelessly. Merging a coinjoin output with older coins, or sending it to an address that identifies you, links it again.
- Small pools. A pool with two peers hides you among two. More peers give a larger anonymity set.
- Sybil peers. If the other peers in a pool are all the same person, they know which output is yours. aut-ct makes this more expensive.