"Cracking the Mimblewimble Privacy Model" Factual Bias

Editor's Note: This article comes fromBixinInstitute（ID：gh_6efd45282f5b）Editor's Note: This article comes from

, Author: Daniel Lehnberg, Compiler: Bixin Research Institute, reprinted by Odaily with authorization.

Mimblewimble privacy is not "fundamentally flawed". The described "attack" on Mimblewimble/Grin is a misunderstanding of known limitations. While the article provides some interesting numbers on the network analysis, the results presented do not actually constitute an attack, nor do they support the lurid claims made.https://mp.weixin.qq.com/s/dZpQ6GqpzfolT5CSOpqD5AToday, there is an article titled "Breaking the Mimblewimble Privacy Model" (

), where the authors assert that they somehow "broke" the privacy models of Mimblewimble and Grin.

The "attack" the author claims to have made is the well-documented and discussed transaction graph input-output-linkability problem. This is no stranger to anyone on the Grin team or anyone who has worked on the Mimblewimble protocol. Grin's ability to chain outgoing links was acknowledged in the Privacy Primer published on its public wiki in November 2018 prior to mainnet launch (https://github.com/mimblewimble/docs/wiki/Grin-Privacy-Primer/ ). This issue incorporates Ian Mier's "Flashlight Attack" (https://www.zfnd.org/blog/blockchain-privacy/#flashlight), which we have included as one of the open research issues (https://github .com/mimblewimble/docs/wiki/Grin-Open-Research-Problems#7-reducing-linkability-of-outputs-on-chain).

In fact, many of the claims, including the title of the article, are inaccurate. At a high level, the paper reads less nuanced, claiming a compelling result. However, the conclusions of this paper contain many logical leaps that have not been substantiated by the network analysis exercise described.

We don't want to refute this article one by one, but just point out the main problems in the research and its conclusions.

secondary title

Unfortunately, Mimblewimble's most fundamental privacy benefit is the fundamental problem with this research and related articles: Mimblewimble doesn't have the kind of address that might link to a specific Bitcoin wallet. Participants exchange value, add one-time outputs to a transaction, and at no time do they have an "address" that can present data to the network or on-chain.

secondary title

2) Unable to link addresses that do not exist

For this, researchers appear to have taken an inconsistent approach. The github repository accompanying the article (https://github.com/bogatyy/grin-linkability) states:

"There are no addresses, only hidden UTXOs committed to Pedersen."

Subsequently, the following scenarios are depicted:

“Let’s say I’m law enforcement and I know an address that belongs to a vendor on a darknet market. When you send your Grin coins to Coinbase, Coinbase associates your address with your name.”

The medium article goes on to say:

"Or suppose an authoritarian government knows that a particular address belongs to a political dissident. You send a small donation to the dissident."

We have to assume that the author conveniently confused transaction output (TXO) with address, but they are not the same. And, as we've already detailed, the fact that TXOs can be linked is not news.

secondary title

Details of the actual drill were described as an "attack". So-called "sniffer nodes" collect transactions broadcast from nodes, which are part of the dandelion's stem and fluff phase. The authors were able to collect 95.5% of the transactions on the network within a specific time period. Other than "output A is spent to output B", it's not clear what exactly is identified here, or what the authors were able to accomplish with this information.

secondary title

While it is desirable to avoid leaking the transaction graph, the graph alone does not necessarily reveal the sender and receiver outputs. Without an amount, it is difficult to distinguish change outputs from receiver outputs. Even though this paper does not attempt to actually do this, it is an interesting area of ​​future research.

secondary title

5) ...the author doesn't seem to be aware of this

On the Github repository it says:

"What we found was a transaction graph: a record of who paid whom"

But this is not the case.

In this case, a "sniffer node" monitoring the network would not discover anything about Alice, and certainly not a record of who paid whom. A "torch attack" is an active attack in which an adversary is participating in the transaction structuring process. The network analysis activities in this paper are reactive and not sufficient.

secondary title

The title of the article is "Cracking Mimblewimble's Privacy Model". Mimblewimble's privacy model does not yet cover making it impossible for monitoring nodes to link transaction outputs. Our ambition is to get there, but we're not there yet, and there's no claim beyond that.

in conclusion

in conclusion

The privacy you gain will never exceed the size of the anonymity set

Grin is a minimal cryptocurrency designed to be private, scalable, and fair. It's far from perfect, but it implements a security model on par with Bitcoin, with better privacy enabled by default, and less data to keep. It does all of this without a trusted setup, without dev taxes, ICOs, or premines.

However, Grin is still young and has not yet reached its full potential. Eleven months into mainnet, network usage is low. Of the last 1000 blocks, 22% contained only one tx (and 30% contained no tx), meaning their inputs and outputs were microlinkable. That won't change until network usage increases, but that still doesn't mean the identities of senders and receivers will be compromised.

Privacy research is conducted in collaboration

As contributors to Grin, we're excited to see interest in the project. Our community welcomes scientific analysis and scrutiny of the Grin protocol and codebase, but at the same time expects some rigor. In fact, if we are asked to help, we can even help.

The authors of the paper had Haseeb, Oleg, Elena, Mohammed, and Nader review their work, but unfortunately they didn't leverage anyone from the Grin community to do the same and provide (kindly) feedback. Doing so may prevent this response and will only improve the quality of the work. In a tweet (https://twitter.com/IvanBogatyy/status/1196441115324379136?s=20), the author wrote:

"Importantly, I have a lot of respect for the Grin community and core developers who have been extremely helpful in answering my questions."