Wasabi Wallet 1.0 solved a lot of difficult problems out of the box. Tor was natively integrated, protecting user IP addresses. Block filters were used to synchronize wallets without anyone else learning about the transaction history. The best available zerolink coinjoin protocol with Chaumian blind signatures provided privacy on the blockchain.

However, the Chaumian blind signature protocol had limitations that lead to a bad user experience and excessive blockspace usage. The minimum denomination was too large for many users, denying them access to the service. But for others it was too small, resulting in many coins in the wallet, which is expensive. If a user wanted to consolidate many inputs in the same coinjoin transaction, he had to tell the coordinator which belonged together. Even though the coordinator could not link the inputs of one user to the equal amount output he received, it was public knowledge which non-equal change output the user received.

Some of these concerns were improved with marginal upgrades to the protocol during the Wasabi 1.0 life cycle. However, in order to truly solve these issues, a fundamental solution was required. But at this point, we did not know what technology existed that could be applied at scale.

A group of developers, cryptographers and enthusiasts got together in the Wasabi Research Club, a weekly meeting to define, discuss and solve this complex problem. Initially, a different academic paper was chosen as the topic for each week. We invited the authors of each paper to join us, and many did, giving ample opportunity to ask questions. One of the researchers, usually Aviv Milner, started the call with a short presentation to introduce and summarize the paper. The recordings of these calls are available on the Wasabi Wallet YouTube channel.

A breakthrough moment was when Jonas Nick suggested that keyed verified anonymous credentials might be a great fit for our specific use case. There are numerous different cryptographic schemes in this category, like Brands’ credentials, Mercurial signatures, anonymous credentials light and keyed verified anonymous credentials. The specific paper Jonas brought to our attention was The Signal Private Group System and Anonymous Credentials Supporting Efficient Verifiable Encryption, written by Melissa Chase, Trevor Perrin and Greg Zaverucha.

This cryptography allows a central server to issue tokens which can have many attributes. Each of these attributes can be blindly committed to, then selectively revealed at a later point. These tokens can be transferred anonymously. The trick we use in WabiSabi specifically, is that one attribute of these credentials is a blinded value of sats. Pedersen commitments are used so that the coordinator never learns how many sats one token has attributed, but he can still ensure that nobody is creating more money than he spent.

These anonymous digital bearer certificates are the access rights to the new bitcoin transaction that is being built. The coordinator issues tokens and gives it to anyone who provides an input. And later, any anonymous user who provides such a token, can write an output address and amount to the transaction. These tokens ensure nobody is writing more outputs than inputs, without the users having to sacrifice their privacy to the central server.

At this point, we had a pretty solid idea of the problem and how flexible anonymous eCash tokens can be used to solve it. This was a sufficient advancement to document in a new paper, WabiSabi: Centrally Coordinated CoinJoins with Variable Amounts, which was peer reviewed and published. This paper was finalized mainly by Adam Ficsor, Yuval Kogman, Lucas Ontivero and István András Seres.

A crucial next step was to implement the cryptography that makes the system possible. Lucas Ontivero, Yuval Kogman and David Molnar dedicated months to building, testing and reviewing this critical part of the codebase. An independent security firm was hired to audit the code base and several outside contributors have reviewed it as well. In the following months, Wasabi’s client and server code were upgraded and sometimes entirely rewritten to support this new protocol.

With the protocol designed, the cryptography implemented and the client and server code well on its way, we realized that some of the most difficult questions are still unanswered. Now that the coordinator no longer dictates the minimum value of inputs and what output values to register, what exactly should the client do now? With great power, comes great responsibility. For the first time in the history of bitcoin coinjoin, the client can basically do whatever it wants. This turned out to be rather uncharted territory, with conflicting ideas of how to approach the subject.

Anonymity likes company meaning that it’s a good idea to hide in a crowd. So a coinjoin transaction should have many coins with the exact same amount of sats. However, every transaction should have many different equal amounts. One of Yuval’s many insights was to use low Hamming weight standard denominations. Only a few of these amounts are required to sum up to any arbitrary value. Specifically, these standard denominations are powers of two, powers of three, and 1, 2, and 5 times the powers of ten. Between 5000 sats and 1 bitcoin, there are 41 of these standard denominations. If all clients prefer to create outputs in only those standard denominations, then there are going to be a higher number of equal amount inputs and outputs.

These developments are why Wabisabi has improved upon the original Zerolink protocol of Wasabi 1.0 and how Wasabi 2.0, powered by Wabisabi are breaking records everyday for facilitating some of the largest coinjoins ever while provided even the newest Bitcoin user access to the highest level of privacy.

The post The History of WabiSabi appeared first on Wasabi Wallet - Blog.

This newest iteration promises more privacy at less cost for the user. The zkSNACKs coordinator in Wasabi Wallet 2.0 offers an initial coordinator fee of 0.3% which only fresh UTXOs will pay. Remixes (even after one transaction), Wasabi Wallet 1.0 coinjoin outputs and UTXOs of 0.01 BTC or less pay no coordinator fees in Wasabi Wallet 2.0 coinjoins.

We know you’ve all been impatiently waiting so we’ve compiled a concise list of some of the newest features in Wasabi Wallet 2.0. Read more about it below.

Wasabi Wallet 2.0 Welcome Screen

After the Wallet has been downloaded and installed users are greeted by a completely revamped User Interface and color scheme that welcomes them to the wasabi experience and outlines the project’s core values.

Loading Your Wallet

The login screen has been completely redesigned/revamped since the TestNet release. The border of the wallet has been changed and the previous sliding sidebar on the left has been replaced with a sleek transparent design.

Wasabi 1.0 users who have upgraded to Wasabi Wallet 2.0 will be able to access their wallets using their previous login information, new users will be presented with the following prompts:

Create a New Wallet

After the user has selected the ‘create a new wallet’ option  from the ‘Add Wallet’ prompt, they will then be able to:

• Name the wallet and create a password
• Write down the numbered recovery words in the correct numbered order
• Confirm recovery words by entering particular words in the sequence they were given.
• Choose a coinjoin strategy

Connecting to hardware wallet
The user can connect a hardware wallet to Wasabi

Import a wallet
Import an existing wallet to Wasabi

Recover a wallet
Recover an existing wallet using the Recovery Words

Loading the wallet

Initiates the Auto-start coinjoin countdown – a feature which usually starts within the first 15 minutes of loading your wallet. However, the user can start coinjoin immediately after the wallet has loaded by clicking on the ‘play’ button.

Coinjoin Strategy

There are 3 default coinjoin profiles meaning that they have specific default settings regarding the coinjoins. The user can choose which one it prefers or create their own customized one. The defaults are:

• Minimize costs
• Maximize speed
• Maximize privacy

The customize feature allows you to adjust the settings for the coinjoin

• Enable/disable Automatically start coinjoin
• Anonymity score target (2-300)
• Coinjoin time preference (hours, days, weeks, months).

The wallet home page displays the user’s balance, the privacy progress, the current exchange rate (BTC/USD) and the transaction history list. Users loading newly created wallets will have an empty wallet with a Privacy Progress of 100%.

Privacy progress indicates the percentage of progress in making your entire wallet private/making the coins in your wallet private. Users will have a privacy progress of 100% when there are no coins in their wallets.

Discreet Mode (formerly known as Privacy Mode) hides all the sensitive information on your screen by changing the numbers to hash symbols.

Other options on the Wallet Home Screen include:

Wallet Info (wallet fingerprint, derivation path & key information)

Wallet Settings (coinjoin related settings & Verify Recovery Words)

Wallet Statistics  (UTXO count, balance, address & key gap information)

Sending Bitcoin with Wasabi Wallet 2.0

• To send bitcoin, users need to click on the Send button in the upper right corner of the wallet’s home page.
• Enter the address you want to send bitcoin to or use your webcam to scan the QR code (available for Windows only).
• Enter the amount of bitcoin or dollar value you would like to send. The wallet automatically calculates and converts this amount to the amount of bitcoin that will be sent.

Before Sending transactions, the wallet provides a Transaction Preview that gives a summary of your transaction. This  includes:

-The amount of BTC you are sending
-The address you are sending the BTC to
-Who could know about this transaction (only if non-private coins are used)
-The estimated transaction confirmation time
-The transaction fee

Privacy Suggestions

To avoid change, users will have a single transaction with no transaction change returning to their wallets. Thus creating a smaller digital footprint on the blockchain and making your transactions a bit more private. Users can avoid change by sending more or sending less bitcoin than originally intended.

Get suggestions to avoid privacy leaks by having no change in the transaction

The wallet tries to maintain coins with differing denominations and tries to find the best coin combinations that will produce the least difference for the target amount.

Receiving Bitcoin with Wasabi Wallet 2.0

To receive bitcoin, users need to click on the Receive button in the upper right corner of the wallet’s home page. Label the address by entering the name of the entity or person you are receiving bitcoin from and then click the continue button to generate the receive address.

All previously generated bitcoin addresses which haven’t been used yet, are displayed at  Unused Receive Addresses.

Advanced Features

The Wallet Coins displays all the wallets’ utxo’s. The user can see all related information of the UTXO: confirmed, coinjoining, amount, anonymity score and the labels.

In the Wallet Coins, it is possible to select specific UTXOs.

Wallet Settings

The wallet settings consist of two tabs:

General

This allows you to manage your wallet’s privacy and appearance.

• Light/dark mode
• Run wasabi when the computer starts
• Run Wasabi  in the background when the window is closed
• Automatically copy address
• Automatically paste address
• Network anonymization
• Terminate Tor when Wasabi shuts down
• Fee display unit (display fee in BTC or sats)

Bitcoin

• Network: Main, TestNet & RegTest
• (EXPERIMENTAL) Run Bitcoin Knots on startup: this downloads the entire blockchain and allows you to run a full node
• Local Bitcoin Core/Knots version: display current version
• Bitcoin P2P Endpoint: connect to full node
• Dust Threshold: coins under the dust threshold won’t appear, 0.00005000 BTC by default

For a more detailed visual walkthrough of Wasabi Wallet 2.0’s new features check out this video by btcdragonlord.

Download Wasabi Wallet 2.0 here .

The post Wasabi Wallet 2.0 Feature List appeared first on Wasabi Wallet - Blog.

Anyone could participate with any coin, without the system refusing their participation in any way. Wasabi has never discriminated against any coin’s origin. Anyone can participate.

But there were some limitations with the initial implementation of its coordinator. Inputs were registered at the same time using one request with Wasabi Wallet’s coordinator. This is a privacy concern because this way, the coordinator knows when some coins are originating from the same wallet. Coins coinjoined this way were possible to link together on the input side but are still private on the output side (so long as the user did their due diligence with UTXO management).

This burden of heavy UTXO management is bad for the user experience because everyone must remember their coins, name them and then be wary of how they are spent.

Linkability is a problem everywhere. But with the latest development in Wasabi Wallet 2.0, many things have changed and privacy given to the user through the use of its tool is far superior to the original Wasabi Wallet.

With Wasabi Wallet 2.0, you need far fewer steps to coinjoin larger amounts. It also leaves much less bloat on the Bitcoin Blockchain when you are finished because you don’t have to coinjoin again and again to increase your privacy and you don’t have to rely on breaking down your initial transactions to special amounts just to take part in limited output coinjoins.

The previous requirement to have 0.1 BTC as minimum amount for coinjoin is no longer present within WabiSabi, everyone will now have access to a service that is affordable and easy to use to achieve good privacy. It is truly the pleb compatibility that is now here with WasbiSabi.

With WabiSabi it doesn’t really matter where your coin originates from, you can merge without having to think twice about it. Of course, you can still put a tinfoil hat on and coinjoin with any strategy, but the automated process in the wallet should be fairly sufficient to give you the best privacy that Wasabi Wallet can give.

Strategies that the tinfoil hat users use are probably the best because if you are going to mix KYC’d coins first and then mix with other already mixed coins, then you can merge your coins without revealing that you have coins originating from somewhere else.

With the hard work and dedication of the bitcoiners working at Wasabi Wallet, I hope this company can continue to provide good privacy for every bitcoiner out there, wherever they may be. So once Wasabi Wallet 2.0 comes out, grab it and coinjoin the f*ck out of your bitcoin.

The post Milestone in Unlinkability appeared first on Wasabi Wallet - Blog.

Account Model

I have 7 Hufflepuff on my account and you have 3 Hufflepuff on your account. Then I send you 1 Hufflepuff.

You’re already familiar with the account model, this is how the banking system works, this is how Ethereum works, but this isn’t how Bitcoin works. Bitcoin uses UTXO model instead. Why? That’s an interesting topic, but it isn’t relevant for this article, so just take it as is.

UTXO Model

I have 7 bitcoins in my wallet and you have 3 bitcoins in your wallet. Then I send you 1 BTC.

I built a transaction that has one input: 7 BTC, and two outputs: 1 BTC, which is yours and 6 BTC, which is a change coming back to me.
Now you have two coins: 3 BTC and 1 BTC. Let’s call these coins Transaction Outputs — TXOs. In fact these coins are unspent, so we may be more specific and call them Unspent Transaction Outputs: UTXOs.

Coinjoin

Coinjoins are collaborative Bitcoin transactions. Multiple people are participating with inputs in a transaction and that’s what we call a coinjoin. Let’s make one!

But there’s a problem. It’s trivial to tell the sub-transactions by correlating the amounts:

6 -> 6
3,1   -> 4

Chaumian Coinjoin

Chaumian Coinjoins, specified and implemented by the author of this article defend against amount correlation by pre-agreeing upon a common denomination: 3 BTC.

This way nobody can tell where the 3 BTC UTXOs are coming from. Although we have privacy now, this is still not perfect. This suffers from three main problems.

1. Change Creation: With amount correlations, passive observers can tell that the 1 BTC change output comes from the 1 BTC input.
2. Blockspace Efficiency: Chaumian Coinjoin algorithms create a lot of outputs.
3. Limited Transaction Structure: Because of design limitations, the coordinating party of Chaumian Coinjoins can also tell that the 3 BTC and 1 BTC inputs were owned by the same user.

WabiSabi

To tackle the coordination issue, we came up with a new research, called WabiSabi, which enables us to create any kind of coinjoins without privacy leaks. We can now add as many inputs and create as many outputs as we want to and we don’t even need to agree upon common denominations. At least not for coordination reasons.

This is far from trivial. Two years of bloody cryptographic research went into solving this problem: how to create trustless coinjoins with arbitrary amounts? In the beginning I didn’t think it’s even possible, but one thing followed another and viola, it’s solved! Now we have complete flexibility regarding coinjoin amount organization, so what do we do with such great power?

Recap

So far we worked on well-defined problems. Centralized mixers were stealing user funds and can deanonymize them…so here comes coinjoins to the rescue. Coinjoins are deanonymizable by amount correlations…so here comes Chaumian Coinjoins to the rescue. Chaumian Coinjoins are cryptographically limiting the coinjoin transaction structure…so here comes WabiSabi to the rescue.

And now we bumped into the unfathomable complexity of the real world. Countless variables lead to ill-defined problems. There was no logical way to progress forward from the bottom up, so a strategy change was needed. We decided to apply the oldest tool humans have: intuition, to come up with many intuitive algorithms to structure coinjoins and see which one yields the best results.

Dynadenomination Coinjoins

Dynadenomination Coinjoins utilize not only multiple denominations, but also multiple denomination systems, randomly and dynamically. I expect this scheme to be improved until Wasabi 2.0 release, ideas and feedback is very much encouraged! I think this already has all the techniques which we’ll apply, so it’s developed enough to talk about. First let me describe the algorithm, then proceed further with analyzing it.

Simulation

We created a simulation of our dynadenomination coinjoins in the following way:

1. First we took a few months of real world Wasabi Wallet fresh coinjoin inputs. Fresh signifies these have never been mixed before. These are the amounts users come into mixes in the real world.
2. We continued our preparation by randomly grouping these fresh amounts together and called these groups users, then executed our mixing algorithm.
3. Then we did the same grouping again, but only 70% of the simulated inputs came from fresh amounts, the rest came from the result of the first coinjoin simulation. This is how remixes were simulated. 30% is also based on real world Wasabi Wallet remix statistics.
4. Finally executed the mix and wrote out the results.

We can see, in our simulation 100 user participated with 300 inputs altogether. Some user participated with less than 3 inputs, some did with more. In the real world we cannot tell the number of users, but this is a simulation, the simulation created these groupings, so we know exactly the links because of that. This coinjoin resulted in 404 outputs, with the exception of two outputs, all of them gained a mathematically verifiable anonymity set. In average an output has 5 anonymity set. This would be already cool by itself, but the privacy guarantees don’t stop with naïve anonymity set calculations. But first, let me describe the above algorithm.

Algorithm

Imagine you’re a user. You know the group of input amounts you’re participating in the coinjoin and you know the input amounts of others.
You also create a big list of denominations from multiple denomination systems. In this case we’re working with powers of 2 (1, 2, 4…), powers of 3 (1, 3, 9…), powers of 3×2 (2, 6, 18…), powers of 10 (1, 10, 100…) and preferred value series (1, 2, 5, 10, 20, 50…)
To finish the setup, let’s create a big list to be our possible denominations: 1,2,3,4,5,6,8,9,10,16,18,20,27,30,32,…

In order to decide what outputs you want to create, first create a frequency table by greedily breaking down each and every input amount with our multidenomination system. For example, the inputs 28 and 29 would be broken down into 27, 1 and 27, 2 respectively. In that case our frequency table holds the following elements: 1:1 , 2:1 and 27:2 . Let’s agree that the current coinjoin round’s denomination will be those denominations that have occurred at least twice in the breakdown. In our example it’d be only 27, which not only shows that the example is too simple, but also that this algorithm doesn’t work for very few inputs, it only starts to make sense from about 50 inputs.
Finally, take the sum of your inputs and break it down into the selected frequent denominations, but this time not greedily, but rather somewhat randomly. For example if we found frequent denominations 1, 4, 6 and the sum of our inputs is 8 then greedily you’d break it down to 6, 1, 1. But with some optimization, you could find that breaking down your sum into 4, 4 would be better, because it creates less outputs and that’s highly desirable, because blockspace is scarce. However finding optimal breakdowns is an exponentially complex problem, so we can only use heuristics here and these heuristics should be spiced with some randomness for privacy reasons.

Privacy Guarantees Of Wasabi Wallet 2.0

Inherited Guarantees

Wasabi 2.0 inherits the security and privacy guarantees of Wasabi 1.0, which is: nobody can steal your coins, the coordinator cannot correlate your inputs with your outputs and the naïve anonymity set guarantee, which is what you can see on the blockchain, with your own eyes, you can count the number of equal outputs that nobody can tell apart.

Sub-Transaction Privacy Guarantee

However Wasabi 2.0 seems to weaken the anonymity set privacy guarantee by creating smaller equal amount outputs. Wasabi 1.0 ideally creates 100 equal outputs, Wasabi 2.0 does much less. At first it may seem like a privacy tradeoff to avoid change creation and inflating outputs, which it was intended to be that at first. But upon a deeper look we observed the privacy guarantees are much larger, because of the huge number of sub-transactions. Take an output from the following output group:

There are 7 occurrences of 0.01 BTC output.

You may think the anonymity set of the chosen output is 7, but in reality it’s just a minimum estimation. It’s much higher than that! It could potentially come from many different inputs, not just 7 of them.
To get a sense of this, take the following transaction: 1, 1, 2, 4 -> 2, 2, 4
4 only appears once on the output side. It’s naïve anonymity set is 1. But it could also be that 1, 1, 2 came from the same user. Therefore its anonymity set is 2, because there are 2 different groupings of the inputs where the output could have come from.
The Dynadenomination Coinjoin algorithm started by breaking down each and every input into denominations and took the most frequent ones. This was not only helpful in achieving probabilistic equalities on the output side, but these are also great numbers to increase their combinations such as they add up to many input combinations. In other words the final outputs end up adding up to more valid sub-mappings (sub-transactions) than if they were to be chosen randomly. Furthermore I’m talking in exponentials here. The combinations of inputs and the combinations of outputs are huge numbers.

Computational Privacy “Guarantee”

Fully analyzing Wasabi 2.0 coinjoins is computationally hard and will probably be impossible for decades to come because a combinatorial complexity explosion is happening when we try to find all the sub-transactions of a Wasabi 2.0 coinjoin.

A brute force algorithm would have to

1. Take all the possible combinations of how inputs can be grouped together: 2^number of inputs .
2. Take all the possible combinations of how outputs can be grouped together: 2^number of outputs .
3. Finally check for equality of every combination to find a sub-transaction. This would take 2^number of inputs * 2^number of outputs iterations.

In the case of our example transaction: 100 inputs, 300 outputs, it’d be:

In a 2017 research paper, Anonymous CoinJoin Transactions with Arbitrary Value, the authors measured the processing time it took them to find all valid mappings of coinjoin transactions: forever. Later, but independently, the guys working on CashFusion observed the same.

That’s all I note here, because our cryptographers will kick my ass if I try to make any claims on Wasabi relying on computational privacy. Nevertheless I still consider this a spicy addition.

In Summary

Wasabi 2.0 provides decently verifiable privacy based on naïve anonymity set calculations and a huge probabilistic privacy based on the inflation of sub-transactions. But this is unanalyzable because of the spicy third guarantee: computational privacy, which is theoretically unsound, but practically relevant.

The post Privacy Guarantees Of Wasabi Wallet 2.0 appeared first on Wasabi Wallet - Blog.

I hear your shock and awe through the screen. What is this WabiSabi protocol you ask? It’s an amazing new feature that will come as part of our 2.0 launch. It will basically make CoinJoin transactions with the help of a coordinator. The main idea behind it is that it can’t deanonymize you or steal your money, despite the fact that the CoinJoin is being operated by a coordinator.

It brings privacy to Bitcoin, and makes it so people cannot see your prior transactions. A welcome side effect to this is that it will in turn, save you from losing any of those precious bitcoins you’ve been hodling. It also means automatic CoinJoin transactions (the crowd goes wild!)!

It’s also important to note that there is no point in time where the coordinator will be able to steal your money as they will never know who is who during the transaction.

How does WabiSabi help us achieve privacy in those transactions? Well, there are some components that make sure it runs as smoothly as possible:

Zero knowledge proof system:

This is where one person can prove to another that they know what amount is meant to be sent, without really having to prove anything aside from that.

The keyed-verification anonymous credentials:

With this, the coordinator can confirm which amount was paid when the sum of the coinjoin is broken down, without being able to tell who paid it.

Tor circuits:

This allows users to connect to the coordinator anonymously.

Lastly, serial numbers are used to prevent double spending as well as helping to ensure the correct input and output values are going to the right location without showing the exact amount.

If you’d like to see an analogy further explaining how it all works, here’s a helpful link on our GitHub: https://github.com/zkSNACKs/WabiSabi/blob/master/explainer.md

There’s certainly lots to look forward to with the impending 2.0 launch and we can’t wait to share this and the other amazing things we’ve created to protect your privacy and ease the transaction process.

WabiSabi’s definition should be clearer now.

The post What is Wabi-Sabi? appeared first on Wasabi Wallet - Blog.