Tax Declaration Scheme Using Blockchain Confidential Transactions

1Introduction

Recently blockchain technology has been penetrating into business processes monitoring and control (Maupin, 2017), as this technology is based on clear and transparent security foundations. The blockchain technology does not require a Trusted Third Party (TTP) since any user (node) participates in the peer-to-peer blockchain network and is operating according to consensus rules recognized by all. The information is stored and shared on a variety of nodes in many different locations. A node is simply any computer or electronic device, maintaining copies of the blockchain database, named a (hyper)ledger.

The global trends, current tendencies, and frontiers of blockchain technology are reported in Boakye et al. (2022), pointing out that blockchain technology research in finance has evolved and is predominated by studies on crowdfunding/equity crowdfunding, entrepreneurial finance, bitcoin, entrepreneurship, fintech, and venture capital. The overview covers 157 articles. However, the interaction of finance activity and tax collection system is not outlined in this study.

The systematic analysis of blockchain in sustainable finance is presented in Ren et al. (2023) for the field of renewable finance. Authors indicate that: (1) Blockchain has been widely used in many industries involved in sustainable finance; (2) Blockchain will have a long-term impact on sustainable finance in the fields of smart city and sharing economy fields; (3) Blockchain can be deeply integrated with other technologies to promote the diversified development of sustainable finance. Despite the fact that authors do not reveal specific technologies, the latter proposition is important to justify the solution proposed in this paper, namely integration of tax collection system with blockchain technology, providing transaction confidentiality and verifiability. We are unaware of any solutions of this problem in the literature.

The unspent transaction output (UTxO) and account-based transactions (ABT) are two types of record-keeping methods used by a blockchain network to record provenance of its cryptocurrency and the way cryptocurrency balances are determined. UTxO is also considered a token-based system. Bitcoin, Bitcoin Cash, Zcash, Litecoin, Dogecoin, Dash, etc., are UtxO instances.

The ABT blockchains, such as Ethereum, EOS, Tron, and Ethereum Classic, are focused on smart contracts. In ABT system, the ledger would have accounts for all users of the currency and requires real-time updates of the account balance (Bai et al., 2019). This means that we have exponentially growing account information to manage.

The UTxO system can also be used in smart contracts and would enable business models based on asset tokenisation. It would also reduce the large-scale information keeping.

In this paper, we consider an UTxO system, allowing to create e-wallets to the users, thus meeting the user’s needs for offline transactions more effectively, e.g. between users of mobile phones with implemented e-wallets (Sakalauskas et al., 2017, 2018; Muleravicius et al., 2019). In this case, digital currency is implemented in the customer e-wallet and in the blockchain ledger.

A new and perspective trend in blockchain technology is business process monitoring and control, requiring faster and less expensive transactions, as well as more transparent investment mechanisms using tokens and smart contracts.

However, governments have pointed out that so far there has been a lack of regulation for such activities. Regulation is especially important for tax declaration and honest tax collection. The need for such regulation will also grow, when a new type of blockchain-based cryptocurrency will be issued by Central Banks and named Central Bank Digital Currency (CBDC) (Bouchaud et al., 2020).

The overview of tax collection problem is actualized in Phadke et al. (2021). But authors do not present technological solutions to this problem. In Dedhia et al. (2023) the novel tax tracker application is presented working completely over the blockchain technology, which prioritises decentralised data as its key principle. This solution can solve the transparency problem by showing the use of the tax amount by the government to the users and will keep track of the amount and its allocation for various government projects. But this research does not provide data confidentiality that is important in business processes.

In general, it is natural that in business processes some information is confidential and limited to certain participants. However, it is necessary to define what information can be shared by system users to provide verifiable transactions. This problem can be solved by using a permissioned IBM Hyperledger Fabric or Ethereum blockchain (Paulavičius et al., 2019; Mohan, 2019). To simultaneously provide both authentication and confidentiality, a signcryption scheme is used combining signing and encrypting processes which is an important cryptographic primitive (Tseng et al., 2022), that can be also be used in blockchain technology. Such networks are more dedicated to consortium activity, and therefore have certain limitations for flexible and effective new users’ growth and involvement. The Ethereum Mainnet, for example, is a public or permissionless blockchain, which, however, does not provide the confidentiality of sensitive business data.

This paper proposes a solution of the regulation for tax collection, when a certain TTP, named Audit Authority (AA), is needed. At the same time, we propose a scheme to provide transaction data confidentiality for other actors, apart from AA. Existing solutions are using range proofs on committed values (Bünz et al., 2018). However, range proofs are not adequate for tax collection, since they do not prove the exact amount of transferred money, that is needed for AA.

In Section 2, the overall description of the proposed scheme is presented. In Section 3, introduction to ElGamal encryption is given. The Confidential transaction construction and creation are presented in Sections 4 and 5. In Section 6, security and efficiency analysis is provided. Section 7 gives the conclusions, and at the end the list of references is presented.

2The Overall Description of the Scheme

We have constructed the following scheme for multiple input and multiple output blockchain transaction. The following actors are defined: the transaction creator Alice, the AA and the network we denote by the Net. The Net is divided into three parts: the Bobs B₁, B₂, …, B_M, transferring money to Alice and providing her with income; the Laries L₁, L₂, …, L_N, receiving money from Alice and thus causing Alice expenses; and other Net nodes verifying the transaction validity, composing and validating blocks, etc.

The presented solution is an integration of several approaches providing trustworthy tax declaration while keeping confidential transactions in blockchain technology. It is known that the trustworthiness of transactions relies on the balance between income (inputs) and expenses (outputs). Bünz et al. (2020) presents a method to provide confidentiality and verifiability of transactions to the Net using some modification of ElGamal encryption, ElGamal (1985). This technique transfers multiplicatively-homomorphic ElGamal encryption to additively-homomorphic encryption. We will use this technique to create a tax declaration scheme.

UTxO transactions rely on the requirement that the sum of all inputs must be equal to the sum of all outputs plus the transaction fee. Change, if it exists, gets sent to the transaction creator as one of the outputs.

Confidentiality means that the transaction data must be encrypted using a secure probabilistic encryption method. The problem is in providing the honesty of transaction with encrypted income and expenses, when, despite the equality of these values, their ciphertexts differ when using the probabilistic encryption. In this case, the balance violation cannot be determined. Moreover, there is a way of cheating by making a transaction with the sum of expenses greater than the sum of actual income, thus “making money out of the air”. The presented solution is provable, secure, transparent, and hence, trustworthy.

Let us consider a transaction, created by Alice, consisting of income and expenses. Any single income or expense is denoted by an integer d representing its value.

Let us assume Alice received income sums i1,i2,…,iM from several Bobs B1,B2,…,BM, respectively. Then the total income is i=i1+i2+…,iM. Alice transfers part of her total income i to several Laries L1,L2,…,LN by incurring expenses e1,e2,…,eN, respectively. If the sum of expenses e′=e1+e2+⋯+eN is less than the total income, then she transfers the change value that we denote by eN+1, to herself. If the transaction is honest, then the following balance equation must hold

The first question is how to share functions between AA and Net?

Secondly, how to provide transaction confidentiality for the Net while ensuring honesty of transactions?

Since AA is a TTP for all the Net, then it is sensible to provide the verification of all actual transaction data to AA. Laries must be able to verify their actual income. Net must be able to verify the balance between income and expenses without any knowledge about the actual values of these data.

Our solution relies on the probabilistic asymmetric ElGamal encryption. In order to realize ElGamal encryption/decryption, public parameters must be shared in the Net. Probabilistic encryption is performed by the sender using receiver’s public key and randomly generated number, thus providing different ciphertexts even for the encryption of the same plaintext. Ciphertext is sent to the receiver, who can decrypt it using the same shared public parameters and his/her private key for obtaining corresponding plaintext. ElGamal encryption has the so-called multiplicatively isomorphic property: the encrypted product of plaintexts is equal to the product of ciphertexts of every corresponding plaintext.

3ElGamal Encryption

Let G be a cyclic group of order q with generator g. Let Msg be a message to be encrypted and m – an image of reversible 1-to-1 function, transforming Msg to m in G. We denote public parameters in ElGamal encryption by

4Confidential Transaction Construction

Let p be a large strong prime number, expressed by p=2q+1, where q is a prime number, defining a multiplicative cyclic group Zp∗={1,2,…,p−1} with operations performed mod p. This group has a subgroup of prime order q, denoted by Gq with all elements, except 1, being generators in Gq. From now on, group G, defined in Section 2, is replaced by group Gq. The operations, defined for group G in previous section, are computed mod p unless otherwise stated.

If g is a generator of Gq, then according to Lagrange theorem and its consequences, the following relation is satisfied

All Laries L1,L2,…,LN have their key pairs that we denote by (PrKLn=yn, PuKLn=ln), n=1,2,…,N. The direct income and expenses encryption does not provide the opportunity to verify transaction balance (1), since, according to (10) and (11), encryption is a multiplicative homomorphism of plaintexts. We need to have additively multiplicative homomorphism instead by transforming transaction data by DEF in (3). Let d1, d2 be transaction data. Then they are transformed to new variables D1, D2 computed in the following way

We denote the ciphertexts of encrypted exponent values D1, D2 by capital letters while lower cases are used otherwise. Then, after encrypting the product D1D2=D with PuKAA=α according to (10) and (11), and when j=j1+j2 mod q, we obtain

As there is 1-to-1 correspondence between d1, d2 and D1, D2, and according to (16), we can state the following properties of ElGamal encryption, if j=(j1+j2) mod q:

In general, in order to implement an additively-multiplicative isomorphism for encryption, any integer of transaction data d in Zq is transformed to the element D in Gq by DEF in (3).

In order to create Alice’s confidential and verifiable transaction, all her actual income i1,i2,…,iM must be transformed to the numbers I1,I2,…,IM, and expenses e1,e2,…,eN+1, correspondingly, to the numbers E1,E2,…,EN+1 by (17). Then the balance equation (1) can be verified by the following equation:

In order to achieve verifiability of transaction, both sets I1,I2,…,IM and E1,E2,…,EN+1 must be encrypted with the same public key in a special way providing the equality of the sums of random generated numbers for income and expenses. We denote the ciphertexts of encrypted numbers I1,I2,…,IM with Alice PuKA=a by Ca,I1,Ca,I2,…,Ca,IM. In this case, the following problems have to be solved:

The solution to these problems is presented in next section.

5Confidential and Auditable Transaction Creaton

In the proposed solution, all the information about actual transaction data is available for Alice as a transaction creator and AA as an Audit Authority.

6Security and Effectivity Analysis

We will show that the presented tax declaration scheme ensures semantic security. It implies that any encrypted information in ciphertext accessible to the eavesdropper can provide only negligible information about the plaintext.

The group Gq, introduced in Section 3, is so-called Schnorr group where the Decissional Diffie-Hellman assumption (DDH) holds (Tsiounis and Yung, 1998). It is proved in the same source that if the DDH assumption holds, then ElGamal achieves semantic security. If DDH assumption holds, then DLP is infeasible in Gq. In this case, the solution of (3) for finding i when Gq and g is given is infeasible. It means that it is infeasible to find either decryptor’s private key PrK=z in (5) or random secret encryption parameter j in (6). Since DLP is infeasible, the public key exchange between the parties can be achieved using open communication channels. In order to provide authenticity and integrity of this exchange, the public keys should be digitally signed. We do not consider this technique in this paper.

Let us consider the following issue. If random integer j∈Zq can be found, then the ciphertext c in (6) can be decrypted using the following relation

The efficiency of the implementation of the proposed scheme is almost the same as the efficiency of the implementation of ElGamal encryption. In order to create a transaction, it is necessary to perform an extra exponentiation operation to transform transaction data d to D according to (17). Since we bounded the actual transfer sums up to 232−1=4294967295, then by using a well-known square and multiply algorithm for all exponentiations, we have the additional number of operations for money transfer as O(log2d). The maximal number of exponentiations for AA is 32.

7Conclusions

Tax declaration scheme using blockchain confidential transactions based on unspent transactions output (UTxO) paradigm is presented. The main actors are money senders Bobs, Alice (being a receiver and a sender, and a transaction creator), money receivers Laries, Audit Authority AA and the Net. Different information is available for all these actors.

The proposed scheme provides that the Net can only verify the transaction honesty with guarantee that every transaction indirectly satisfies the balance equation (1) without revealing any feasible information about the actual transaction data. It is guaranteed by the semantic security of the ElGamal encryption, presented in section 5, providing the confidentiality property of transactions for the Net. Actual money transfer values from Alice are available for each Larie, since they can be decrypted by their private keys respectively.

AA is handling all information about the actual transaction income and expenses. AA can also verify that the sum transferred from the sender Alice, as an expense, is equal to the sum received by Larie as an input. Therefore, the expense and income declaration can be monitored. It holds for all related transactions, thus also allowing to monitor tax payments. The efficiency of the implementation of the proposed scheme is almost the same as the efficiency of the implementation of ElGamal encryption. The additional number of operations for money transfer is O(log2d). The maximum number of exponentiations for AA is 32.