Step (4.1). Compute beacon function. If the produced
random number is less than or equal to the value p from
mixing parameters, then the funds are kept by M as a mixing
fee. Otherwise, the protocol moves to the next step.
Step (5a). M service acts honestly when i mixers agree to
mixing Alice’s funds. By time t 2 , she will receive v coins in
her address k out . Both Alice and M should then destroy their
records to ensure anonymity.
Step (5b). If M steals Alice’s funds and fails to transfer
v to k out by time t 2 , then Alice detects theft.
Step (6). Alice signs and publishes the signed warranties
that she received in step (2a). Any third party in the network
4) A (by time t 1 ):
Transfer (v, k in , k esc )
X = Beacon (t 2 , w, n)
X ≤ p
X > p
M (m 1 ,…, m i )
retain funds
M (m 1 ,…, m i )
act honesty
M (m 1 ,…, m i )
steal funds
M (m 1 ,…, m i )
accept terms,
specify k esc
M (m 1 ,…, m i )
reject terms
1) A
M (m 1 ,…, m j ):
anon
[v, t 1 , t 2 , w, k out , p, n] K M
2b) A
M(m 1 ,…, m i ):
anon
⊥
A destroys k out
5a) M (m 1 ,…, m i ) (by time t 2 ):
Transfer (v, k’ esc , k out )
Protocol completed
successfully
A, M (m 1 ,…, m j )
destroy records
6) A publicizes:
{{v, t 1 , t 2 , w, k esc , k out , p, n} K M (1,…,i)
} K out
5b) No transfer to k out
by time t 2
A detects theft
(after t 2 )
{v, t 1 , t 2 , w, k esc , k out , p, n} K M (1,…,i)
anon
2a) A
M (m 1 ,…, m i ):
M (m 1 ,…, m i )
abort protocol
A pays on time
(from any address)
A
doesn’t pay
3) A reconstructs received
warranties
Valid warranties
A aborts protocol
and destroys k out
Invalid warranties
Fig. 2 T-Mix protocol design
T-Mix: A Threshold Cryptography Mixing Service for Bitcoin
295
random number is less than or equal to the value p from
mixing parameters, then the funds are kept by M as a mixing
fee. Otherwise, the protocol moves to the next step.
Step (5a). M service acts honestly when i mixers agree to
mixing Alice’s funds. By time t 2 , she will receive v coins in
her address k out . Both Alice and M should then destroy their
records to ensure anonymity.
Step (5b). If M steals Alice’s funds and fails to transfer
v to k out by time t 2 , then Alice detects theft.
Step (6). Alice signs and publishes the signed warranties
that she received in step (2a). Any third party in the network
4) A (by time t 1 ):
Transfer (v, k in , k esc )
X = Beacon (t 2 , w, n)
X ≤ p
X > p
M (m 1 ,…, m i )
retain funds
M (m 1 ,…, m i )
act honesty
M (m 1 ,…, m i )
steal funds
M (m 1 ,…, m i )
accept terms,
specify k esc
M (m 1 ,…, m i )
reject terms
1) A
M (m 1 ,…, m j ):
anon
[v, t 1 , t 2 , w, k out , p, n] K M
2b) A
M(m 1 ,…, m i ):
anon
⊥
A destroys k out
5a) M (m 1 ,…, m i ) (by time t 2 ):
Transfer (v, k’ esc , k out )
Protocol completed
successfully
A, M (m 1 ,…, m j )
destroy records
6) A publicizes:
{{v, t 1 , t 2 , w, k esc , k out , p, n} K M (1,…,i)
} K out
5b) No transfer to k out
by time t 2
A detects theft
(after t 2 )
{v, t 1 , t 2 , w, k esc , k out , p, n} K M (1,…,i)
anon
2a) A
M (m 1 ,…, m i ):
M (m 1 ,…, m i )
abort protocol
A pays on time
(from any address)
A
doesn’t pay
3) A reconstructs received
warranties
Valid warranties
A aborts protocol
and destroys k out
Invalid warranties
Fig. 2 T-Mix protocol design
T-Mix: A Threshold Cryptography Mixing Service for Bitcoin
295