IMDEA Software researchers present MixBuy, a protocol for secure and privacy-preserving digital purchases

IMDEA Software Institute researchers Diego Castejón Molina, Dimitris Vasilopoulos and Pedro Moreno-Sanchez present a system that represents a step forward in digital purchases. Their research is reflected in the study: “MixBuy: Contingent Payment in the Presence of Coin Mixers” which has been accepted at the Privacy Enhancing Technologies Symposium (PETS).

Context

Today, many products can be purchased with cryptocurrencies such as Bitcoin: video games, books or cell phone plans. In some countries, such as El Salvador, you can even buy a hamburger. Most cryptocurrencies operate on a public payment system, known as the blockchain. In most cryptocurrencies, the details of the transaction - who has paid and to whom, how much and when- are in plain sight because the transaction log is public.

Therefore, the details of a digital purchase made with a cryptocurrency on a public blockchain can be seen by anyone. In a nutshell: people's consumption patterns, -where they buy, how much they buy and when they buy- can be identified. 

IMDEA Software researchers wondered if it was possible to create a privacy preserving protocol for digital purchases that could work with most cryptocurrencies. They answered their question in the affirmative: such a protocol is MixBuy.

The study

MixBuy is the first cryptographic protocol that guarantees the security of a digital purchase and hides the relationship between customer and store. Their solution involves an intermediary -an entity similar to the spanish instant payment operator Bizum- relaying the payment between customer and store. While Bizum is trusted to transfer the money from the sender to the receiver, intermediaries in cryptocurrencies cannot be trusted. They can steal the money in the process. IMDEA researchers have designed MixBuy such that cryptography prevents the client, the intermediary or the shop from stealing money from each other. 

MixBuy relies on the intermediary to hide the relationship between the customer and the store. The blockchain records transactions from customers to the intermediary, as well as transactions from the intermediary to the stores. Hence, it is not possible to learn which customer bought in which store. Since the intermediary cannot be trusted, IMDEA Software researchers have designed MIxBuy to ensure that not even the intermediary can learn which customer bought from which shop. Only the customer and the store know the details of the digital purchase between them.

“MixBuy represents the first protocol that guarantees both security and privacy in a digital purchase. Moreover, it can be implemented in most cryptocurrencies.” explains Diego Castejón Molina, one of the authors of the study.