  Retail central bank digital currency (rCBDC) is seen as a key upgrade of the
monetary system in the 21st century. However, privacy concerns are the main
impediment to rCBDC's development and roll-out. On the one hand, the rights of
people to keep their transactions private should be protected, including
against central bank surveillance. On the other hand, the central bank needs to
ensure that no over-issuance of money or other frauds occur, demanding a
certain form of knowledge of rCBDC transactions to safeguard against malicious
users. This work focuses on rCBDC architectures based on the unspent
transaction output (UTXO) data model and tackles the research problem of
preserving a sufficient degree of privacy for UTXO transaction records while
allowing the central bank to verify their correctness. User privacy is not
adequately addressed in the UTXO-based rCBDC architectures. Using evolving
public keys as pseudonyms to hide the real identities of users only solves the
privacy issue partially. Some information could still be leaked out. This work
investigates techniques to address the shortcomings of the pseudonym approach.
First, a Pedersen commitment scheme is applied to hide the transaction values
of a UTXO transaction while allowing the central bank to verify that no
over-issuance of rCBDC has occurred in the transaction.This work uses a Schnorr
signature to prove no over-issuance of money, which reduces overheads and
enables a non-interactive proof. Then, Coinjoin is applied to aggregate UTXO
transactions from different users into one larger UTXO transaction to obfuscate
the payer-payee relationship while preserving the correctness of the amount of
money flow. This work applies k-anonymity to analyse the privacy guarantee of
Coinjoin. By modelling the transaction traffic by a Poisson process, the
trade-off between anonymity and transaction confirmation time of Coinjoin is
analysed.
