I had written a blog post about the concept and it was shared on mailing list in July 2024. There wasn’t any response on mailing list but I have discussed it with some developers and there seems to be lot of interest for the idea among users.
This is an initial draft and the pull request will help me complete the BIP ASAP.
0@@ -0,0 +1,82 @@
1+ BIP: XXX
2+ Layer: Applications
3+ Title: Octojoin v1
4+ Author: /dev/fd0 <alicexbt@protonmail.com>
5+ Type: Informational
Please add the following 2 lines before this line (see BIP-2):
0Comments-URI: https://github.com/bitcoin/bips/wiki/Comments:BIP-0xxx
1Status: Draft
18+
19+====Relation to Monero====
20+
21+Most Monero transactions use 16 ring size for the input, making it impossible to determine which input is signed by the user out of 16. The amounts are hidden, and stealth addresses are used for outputs.
22+
23+Octojoin achieves partial obfuscation similar to Monero's ring signatures ([https://www.getmonero.org/2024/04/27/fcmps.html FCMP++] will replace ring signatures in future) and stealth addresses. Swaps can be done off-chain to obscure the transaction's input ownership and history.
0Octojoin achieves partial obfuscation similar to Monero's ring signatures ([https://www.getmonero.org/2024/04/27/fcmps.html FCMP++] will replace ring signatures in the future) and stealth addresses. Swaps can be done off-chain to obscure the transaction's input ownership and history.
72+
73+Proof of Concept: TBD
74+
75+==Backwards Compatibility==
76+
77+This is a new protocol and has no compatibility issues. It is not a replacement for payjoin either and benefits from multiple interpretations on-chain.
8+
9+==Introduction==
10+
11+===Abstract===
12+
13+This document describes the process to use swapped UTXOs for inputs, silent payment addresses for outputs, and hide the transacted amount with multiple interpretations.
0This document describes the process to use swapped UTXOs for inputs, [[bip-0352.mediawiki|BIP 352]] silent payment addresses for outputs, and hide the transacted amount with multiple interpretations.
12+
13+This document describes the process to use swapped UTXOs for inputs, silent payment addresses for outputs, and hide the transacted amount with multiple interpretations.
14+
15+===Motivation===
16+
17+Payjoin requires coordination and sharing of UTXOs between sender and recipient. This affects privacy and UX in some cases. Octojoin avoids sharing of UTXOs and uses swapped UTXOs.
83+ x-axis [Jan, Feb, Mar, Apr, May, Jun, Jul, Aug, Sep]
84+ y-axis "Transactions (in thousands)" 0 --> 160
85+ bar [125, 143, 157, 130, 117, 106, 121, 123, 127]
86+</source>
87+
88+Transactions that already use 3 inputs and 2 outputs will serve as the anonymity set for octojoin transactions with default values. It is possible to change defaults and use more number of inputs and outputs.
0Transactions that already use 3 inputs and 2 outputs will serve as the anonymity set for octojoin transactions with default values. It is possible to change defaults and use a higher number of inputs and outputs.
87+
88+Transactions that already use 3 inputs and 2 outputs will serve as the anonymity set for octojoin transactions with default values. It is possible to change defaults and use more number of inputs and outputs.
89+
90+====Swapped UTXOs====
91+
92+Swapping UTXOs off-chain will obscure the transaction's input ownership and history. It also adds more noise on-chain to make chain analysis difficult
0Swapping UTXOs off-chain will obscure the transaction's input ownership and history. It also adds more noise on-chain to make chain analysis difficult.
42+
43+Users should label some UTXOs as “octojoin” so that they can be used in octojoin transactions. Ideally, these UTXOs should be ones that have been swapped with others and are linked to someone else’s transaction history.
44+
45+'''Input Obfuscation with Off-Chain Swaps'''
46+
47+Do off-chain swaps (e.g. statechain, submarine swaps, or coinswap) to obtain UTXOs with different histories. Ensure that all inputs come from other users except one belonging to the sender, making it difficult for on-chain analysts to determine ownership.
Given that two of the listed examples exhibit uncommon patterns, and the third constitutes a payment to a wallet that was executed by a different UTXO owner than the sender, it’s not clear to me how a transaction funded by a combination of such inputs would have significantly improved privacy properties. If an observer simply categorizes the inputs and analyses their pedigree under the corresponding context, it seems likely that a transaction would be sufficiently recognizable as an Octojoin and given the small number of Statechain and Submarine Swap providers, potentially even identifiable via information requests to such service providers. Could you please expand the motivation section by elaborating your arguments why participation in this scheme is expected to lead to a privacy improvement?
A statechain UTXO is co-owned by the statechain operator and the last recipient in a multisig. Multisig inputs do not participate in the secret derivation.
I do not understand what you mean by secret derivation here but swaps are possible using statechains. It is described with an example in this blog post: https://uncensoredtech.substack.com/p/octojoin
Submarine swaps refer to a multi-hop lightning payment whose last hop is executed as an on-chain payment to the recipient. Submarine swaps are easily identifiable via an on-chain HTLC construction and also include a multisig construction.
This is a swap tx using boltz and looks normal to me: https://mempool.space/testnet/tx/e72f8323de0fa8eb9540041a787d4b89694040fd0a674701877f0a352b8f3685
A coinswap is a payment received to the recipient whose inputs were not controlled by the sender.
https://github.com/citadel-tech/coinswap can be used to swap UTXOs which will be part of octojoin transactions along with normal inputs.
If an observer simply categorizes the inputs and analyses their pedigree under the corresponding context, it seems likely that a transaction would be sufficiently recognizable as an Octojoin and given the small number of Statechain and Submarine Swap providers, potentially even identifiable via information requests to such service providers.
Octojoin transactions will always look normal on-chain. Leak during swaps is out of context for this BIP still added as attack vectors.
Could you please expand the motivation section by elaborating your arguments why participation in this scheme is expected to lead to a privacy improvement?
Done
It’s not clear to me whether this BIP draft amounts to an original innovation, given that the method of acquiring UTXOs of varied backgrounds does not appear to be in the focus of this BIP.
This BIP isn’t about acquiring UTXOs but using them. Input selection used in such transactions along with outputs is the original innovation.
Example for an octojoin transaction (both outputs belong to recipient): https://mempool.space/signet/tx/5447f526c64d4f00171f024aae38a1c347ad00e7a295247f9c6acfca21ed2655
I will address other comments after adding more things in next commit.
I don’t have time for this politics and drama, I dont need your certification for my BIP.
Here’s the BIP: https://github.com/octojoin/bip/blob/main/bip.mediawiki
Labels
New BIP