Clustered mixins in Monero

A proposal to change how mixins are chosen in RingCT transactions

Monero currently grabs 50% of its mixins from the past 1.8 days and gets the others from the rest of the blockchain. This change was introduced to combat the problem that the most recent mixin was often the real mixin.

The mixins that are chosen to be in the ring signature don’t depend on the real mixin that is being sent. Not taking the real mixin into account prevents the other mixins from unintentionally leaking metadata about the real mixin.

Here is a different idea that trades some metadata (amount of blocks between the youngest and oldest mixins in the ring) to hopefully completely hide the real mixin among the other mixins. The trade is based in the idea that obscuring which mixin is the real mixin is always a higher priority than obscuring the time frame that the coins were previously received.

Fig. 1, x = the block that contains the mixin we want to send.

The ray is a representation of the monero blockchain over time. ‘X’ is the block that contains the real mixin that is being sent.

Fig. 2, a = time between the real mixin’s block and current block height. b = the largest area that can be used to pick mixins without biasing the real mixin towards the old or young end of the distribution.

To hide the real mixin among the other mixins the real mixin should have the same probability to appear, in a sorted list based on block height, in any position relative to the rest of the mixins. In order to build the largest balanced range of potential mixins take all of the blocks that were mined after the block that contains the real mixin. Take an equivalent amount of blocks from behind the block with the real mixin to balance the average block height of the range about the real mixin’s block height.

Fig. 3, x +.5a and x -.5a are the maximum and minimum points possible to have no bias towards the age of any of the mixins while also maximizing the age range between the youngest and oldest mixin.

Select a random block, c, somewhere within the range x-.5a and x+.5a . Using c as the center, select all blocks that are c-.5a < block height < c+.5a . Randomly select the mixins from the blocks within the range.

Fig. 4, An example point c is chosen to get the range of blocks to select mixins. This range of blocks will, on average, place the real mixin on the young end of the block height distribution.

Fig. 5, Another example point c is chosen. This time the range of blocks will, on average, place the real mixin on the older end of the block height distribution.

Randomly altering the bias of the mixin block range every transaction makes the real mixin equally likely to appear anywhere in the block height distribution.

Trade Offs

Clustered mixins use the real mixin’s block height to determine a range of blocks to use for choosing mixins. As a result the amount of blocks between the youngest and oldest mixin in the ring average about the same amount of blocks between receiving and sending the coin. Compared to the current algorithm clustering the mixins makes the total blocks between the youngest and oldest mixin a lot smaller. This or may not be a problem depending on the use case. This trade off may be able to be further mitigated if older coins were, as a wallet default, sent first.

Other Benefits

Fig. 6, if a is greater than or equal to half of the total blocks in the blockchain then the whole blockchain could be used to find other mixins and provide maximum mixin privacy to users.

If a mixin was not sent until it was at least half as old as the total block height the other mixins would be able to be selected from the whole blockchain.