I’ve been thinking about ways to obfuscate a transaction before it is broadcasted. Many months ago, I came up with a decoy system that I never publicly shared because it was bloating the chain with kernels. I think I have found a way to reduce kernels to a single one. It still has some flaws, but I hope someone else finds a variant of this that is better.
What we end up with is a transaction where Alice is sending funds to Bob and the transaction has a bunch of input->output pairs that act as decoys. Bob doesn’t know anything apart from his output UTXO, each peer that contributed an input->output pair also does not know anything apart from their own inputs and outputs. This is information theoretical optima from Alice’s view. Alice can choose the number of decoy input->output pairs
N and she blinds everyone else with 1/N probability which is somewhat similar to ring signatures from her view point (Monero has fixed N=11). This is why I called it ObscuroJoin because Alice knows everything, but she blindfolds everyone else.
As already mentioned, this system has some issues e.g. Alice could be asking for pairs just to gather info on fake outputs. I still hope someone ponders on this and finds improvements. It’s also possible to do analysis attacks on the previous spendings etc.
P.S. Bob can blindfold Alice as well by doing a similar dance on his end and contributing a set of inputs and outputs, which would mean that even Alice does not know which output belongs to Bob.
Edit: I’ve updated the incentive system with what John described below because it seems superior.