Output Registration

Output registration is the CoinJoin phase in which each participant tells the coordinator which outputs the final collaborative transaction should create, redeeming the blinded credentials they earned during input registration. Because those credentials are cryptographically blinded, the coordinator can verify that every requested output is fully backed by registered input value — nobody can conjure coins — without ever learning which participant's inputs back which outputs. That unlinkability between the two registration phases is the heart of how a modern CoinJoin protects privacy: the coordinator assembles a valid transaction it cannot itself de-anonymize.

How the blinded accounting works

During input registration, a participant proves ownership of their UTXOs and receives credentials attesting to their registered value, blinded so the issuer cannot recognize them later. At output registration the participant returns — as a stranger — and spends those credentials against the outputs they want, with zero-knowledge style proofs guaranteeing the sums balance after fees. The coordinator sees that some legitimate registrant is entitled to the requested value; it cannot see which one. The design goal is precise: even a malicious coordinator that logs everything should be structurally unable to map inputs to outputs, so users need not trust its goodwill — only its math. That is the sovereign posture applied to mixing: verify, don't trust.

The role of a fresh network identity

Cryptography only holds if the network layer does not betray it. To prevent the coordinator from joining the dots through metadata, participants register outputs over a new network identity — typically a fresh Tor circuit, distinct from the one used for inputs. If a wallet reused the same circuit or IP across both phases, timing and origin alone could link an input to an output and collapse the participant's anonymity set, no matter how sound the blinding. Well-built wallets enforce this identity separation automatically, along with randomized timing, because privacy that depends on user discipline is privacy that fails.

Standard denominations and the change problem

Participants generally request outputs in standardized denominations so their mixed coins are indistinguishable from everyone else's in the round — the logic explored in equal-output CoinJoin designs and their decomposition-based successors. Whatever value cannot be expressed in standard denominations becomes change, and change is the perennial weak link: its non-standard amount can fingerprint its owner, and carelessly co-spending it with mixed outputs later undoes the round's work entirely. Output registration is therefore where a participant's future privacy is actually decided — the choices made here determine what the blockchain will forever say about the mix.

After registration: signing

Fees are settled in the same blinded ledger: coordinator and mining fees are deducted from the value a participant's credentials entitle them to, so what can be registered as outputs is the registered input value minus those costs, all verified without identity. A participant who tries to claim more than their balance simply fails the proof — arithmetic, not authority, is what polices the round.

Once all outputs are registered, the coordinator publishes the full unsigned transaction, each participant verifies that their own inputs and outputs appear exactly as intended, and only then contributes signatures. Nothing moves without every signature, so the coordinator never has custody at any point — a participant risks time, not coins. If some participants vanish or refuse to sign at this stage, the protocol falls back to recovery mechanisms that re-run the round without them. Output registration thus sits at the pivot of the whole ceremony: after the anonymous accounting, before the collective commitment, and squarely where fungibility — every sat as good as every other — is manufactured.