mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
79 lines
3.4 KiB
TeX
79 lines
3.4 KiB
TeX
\section{Deposit Denomination Analysis}
|
|
\label{sec:denominations}
|
|
|
|
\subsection{Denomination Selection}
|
|
|
|
Fixed denominations are critical for privacy: if each deposit has a unique amount, withdrawals are trivially linkable. We analyze the optimal denomination set:
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{Denomination analysis: frequency vs.\ anonymity set size.}
|
|
\label{tab:denominations}
|
|
\begin{tabular}{rrrr}
|
|
\toprule
|
|
\textbf{Denomination (LUX)} & \textbf{Est.\ Deposits/Day} & \textbf{Anonymity Set (30d)} & \textbf{Privacy (bits)} \\
|
|
\midrule
|
|
0.1 & 500 & 15,000 & 13.9 \\
|
|
1 & 800 & 24,000 & 14.5 \\
|
|
10 & 400 & 12,000 & 13.5 \\
|
|
100 & 200 & 6,000 & 12.5 \\
|
|
1,000 & 50 & 1,500 & 10.5 \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
\begin{proposition}[Minimum Privacy Level]
|
|
With the permissive ASP and 30-day accumulation, even the least popular denomination (1,000 LUX) provides 10.5 bits of privacy ($k_{\text{eff}} = 1{,}500$), meaning an adversary must inspect 1,500 deposits to deanonymize a withdrawal.
|
|
\end{proposition}
|
|
|
|
\subsection{Multi-Denomination Deposits}
|
|
|
|
Users needing to deposit non-standard amounts split across denominations:
|
|
|
|
\begin{algorithm}[H]
|
|
\caption{Multi-Denomination Deposit}
|
|
\label{alg:multidenom}
|
|
\begin{algorithmic}[1]
|
|
\Require User wants to deposit 1,234.5 LUX
|
|
\State Split: 1 $\times$ 1000 + 2 $\times$ 100 + 3 $\times$ 10 + 4 $\times$ 1 + 5 $\times$ 0.1
|
|
\State Execute 15 separate deposits (can be batched in one transaction)
|
|
\State User receives 15 independent secret notes
|
|
\State Each note is withdrawable independently
|
|
\end{algorithmic}
|
|
\end{algorithm}
|
|
|
|
Gas cost for batched multi-denomination deposit: $15 \times 80{,}000 = 1{,}200{,}000$ gas ($\sim$\$0.07).
|
|
|
|
\subsection{Timing Analysis Protection}
|
|
|
|
Deposits and withdrawals should be temporally uncorrelated. We recommend:
|
|
|
|
\begin{enumerate}
|
|
\item \textbf{Delay}: Wait at least 24 hours between deposit and withdrawal.
|
|
\item \textbf{Randomization}: Add random delay sampled from exponential distribution with mean 48 hours.
|
|
\item \textbf{Batching}: Withdraw during high-activity periods (gas price peaks correlate with transaction volume).
|
|
\end{enumerate}
|
|
|
|
\begin{proposition}[Timing Attack Resistance]
|
|
With exponential delay of mean $\mu = 48$ hours and $k_{\text{eff}} = 10{,}000$ deposits in the anonymity set, the probability of correct timing-based deanonymization is:
|
|
\begin{equation}
|
|
P_{\text{timing}} \leq \frac{1}{k_{\text{eff}}} + \frac{1}{e^{-t/\mu}} \approx \frac{1}{10{,}000} + O(10^{-6})
|
|
\end{equation}
|
|
assuming deposits arrive at a constant rate and the adversary knows the delay distribution.
|
|
\end{proposition}
|
|
|
|
\subsection{Graph Analysis Resistance}
|
|
|
|
Privacy pools are more resistant to graph analysis than mixing services because:
|
|
|
|
\begin{enumerate}
|
|
\item All deposits and withdrawals interact with the same contract (no peer-to-peer mixing graph).
|
|
\item The anonymity set includes all compliant deposits, not just contemporaneous ones.
|
|
\item Withdrawal recipients are chosen freely (not constrained by mixing partners).
|
|
\end{enumerate}
|
|
|
|
\begin{theorem}[Graph Analysis Bound]
|
|
A graph-based adversary who observes all deposits and withdrawals can narrow the anonymity set by at most a factor of $1/d$ where $d$ is the number of active denominations, because the denomination links the deposit and withdrawal pools. Within a denomination, the adversary gains no information beyond timing.
|
|
\end{theorem}
|
|
|