From: Antoine Riard <antoine.riard@gmail•com>
To: Peter Todd <pete@petertodd•org>
Cc: Bitcoin Development Mailing List <bitcoindev@googlegroups.com>
Subject: Re: [bitcoindev] Re: A Free-Relay Attack Exploiting RBF Rule #6
Date: Wed, 27 Mar 2024 19:17:24 +0000 [thread overview]
Message-ID: <CALZpt+GOCiwYdK4vfkODrT0Sx6HxCAuvhVqa1c5o3Xjy03OiAQ@mail.gmail.com> (raw)
In-Reply-To: <ZgQZUOCc/dSjKMoL@petertodd.org>
[-- Attachment #1: Type: text/plain, Size: 7869 bytes --]
Hi Peter,
Answering the latest 2 emails.
> Since this attack is just a relatively minor extension of existing,
publicly
> disclosed, attacks, I don't think there was any need for formal disclosure
> timelines. It's interesting that the attack exists; it does not
substantially
> change the status quo.
Of course, it's always a matter of appreciation when an attack should get a
formal
disclosure process and when it can be publicized with minimal process
effort.
Given this class of attacks was already known from some experts, I don't
think it
requires a formal process either. Attaching a timeline to a disclosure
email doesn't hurt.
> I don't believe the other attacks in this attack class are even possible
to
fix. We just have to live with the fact that a degree of free relay is
always
going to be possible.
See comments under proof-of-UTXO ownership as plausible mitigations.
In anway, I think this is not the type of fixes we can land in a covert
fashion given the
order of magnitude of engineering effort and potential tx-relay network
impact.
> Can you explain in more detail how exactly you'd pull that off? Are you
aware
of LN implementations that actually create feerate ascending LN states?
I think you can create feerates ascending LN states with today's LN
implementations by playing with BOLT2's `dust_limit_satoshis`.
State 1 has 1 dust HTLC trimmed, state 2 has 2 dust HTLCs trimmed, ...
State N has N dust HTLCs trimmed.
> Imagine if the mempool size was 1TB, an amount larger than the entire BTC
> blocksize to date. I think that example helps make it obvious that with
such an
> enormous mempool, there *must* be free relay attacks, because it's simply
> impossible for all broadcast transactions to even get mined.
I think there is an interesting distinction that can be made between
mempool size
ressources dedicated to increase block template efficiency and minimum
mempool size
to just ensure you have good BIP152 compact block validation time.
Obviously if you're
aiming for the first, you're incentivized to offer "free-relay" bandwidth
to your peers and
increase your view of the ongoing transaction traffic.
> All the existing replacement mechanisms _are_ basically a proof-of-UTXO
> ownership, because they're transactions spending UTXOs. The only question
is
> the details of how that proof works.
Yeah somehow it's correct that any replacement mechanisms encompass a
proof-of-UTXO
ownership mechanism. Yet in a world you can partition mempool like you show
with your
for example, it's easy to make this proof-of-UTXO economically unpaid by
the attacker. Asking
aged UTXOs attached to a replacement candidate could be make such proof
more robust, in
my understanding.
Best,
Antoine
Le mer. 27 mars 2024 à 13:04, Peter Todd <pete@petertodd•org> a écrit :
> On Fri, Mar 22, 2024 at 04:18:18PM -0700, Antoine Riard wrote:
> > Hi Peter,
> >
> > > The marginal cost to an attacker who was planning on broadcasting B
> > anyway is
> > > fairly small, as provided that sufficiently small fee-rates are chosen
> > for A_n,
> > > the probability of A_n being mined is low. The attack does of course
> > require
> > > capital, as the attacker needs to have UTXO's of sufficient size for
> A_n.
> >
> > I think an attacker does not necessarily need to have a UTXO's of
> > sufficient size for A_n.
> > One could reuse feerate ascending old LN states, where the balance on
> > latest states is
> > in favor of your counterparty. So it might be a lower assumption on
> > attacker ressources,
> > you only needs to have been _allocate_ a shared-UTXO in the past.
>
> Can you explain in more detail how exactly you'd pull that off? Are you
> aware
> of LN implementations that actually create feerate ascending LN states?
>
> > > The larger the mempool size limit, the more
> > > effective the attack tends to be. Similarly, the attack is more
> effective
> > with
> > > a larger size difference between A and B. Finally, the attack is more
> > effective
> > > with a smaller minimum incremental relay fee, as more individual
> versions
> > of
> > > the transaction can be broadcast for a given fee-delta range.
> >
> > I think the observation on larger the mempool size, more effective the
> > attack tends
> > to come as a novel insight to me. Naively, in a world where the future
> > blockspace
> > demand is uncertain, miners have an incentive to scale up their mempool
> > size limit.
> > As such, holding a cache of non-mined low-feerates transactions. The
> type
> > of bandwidth,
> > denial-of-service described sounds effectively to affect more full-nodes
> > with large
> > mempools. Fair point, it's expected they have more bandwidth ressources
> > available too.
>
> Imagine if the mempool size was 1TB, an amount larger than the entire BTC
> blocksize to date. I think that example helps make it obvious that with
> such an
> enormous mempool, there *must* be free relay attacks, because it's simply
> impossible for all broadcast transactions to even get mined.
>
> > Commenting on this, do we have a free-relay attack variant where an
> > attacker with reasonable
> > visibility on the transaction-relay network could exploit propagation
> > asymmetries due to
> > *_INVENTORY_BROADCAST_INTERVAL and re-inject A_n traffic in a targeted
> > fashion ?
> > I don't think it's worst than the parallelization you're describing,
> it's
> > just another approach.
>
> Well, whether or not that is an attack depends on how exactly the
> transcation
> could be rebroadcast.
>
> > > Requiring replacements to increase the fee-rate by a certain ratio
> would
> > also
> > > mitigate the attack. However doing so would break a lot of wallet
> > software that
> > > bumps fees by values equal or close to the minimum relay fee.
> >
> > I think there is still the open questions of the economic relevance of
> > replace-by-fee if
> > the local mempool is completely empty. Here a miner is optimizing to
> > maximize absolute
> > fee as a transaction replaced by a higher-feerate, lower fee is less
> > interesting if you have
> > less than 1 MB virtual bytes / 4 MB WU.
>
> Obviously. That's why I proposed one-shot replace-by-fee-rate. Not pure
> replace-by-fee-rate.
>
> > > Ironically, the existence of this attack is an argument in favor of
> > > replace-by-fee-rate. While RBFR introduces a degree of free-relay, the
> > fact
> > > that Bitcoin Core's existing rules *also* allow for free-relay in this
> > form
> > > makes the difference inconsequential.
> >
> > Back on the point where an attacker ability to provoke bandwidth DoS in
> > considerations
> > of the UTXO-amount available, a minimal absolute fee as a proof of
> owning
> > some UTXO
> > amount could be still maintained (or maybe after a _bounded_ number of
> > replacement under
> > a given block period).
> >
> > We studied proof-of-UTXO ownership as a p2p DoS mitigation approach in
> the
> > past with Gleb:
> >
> https://lists.linuxfoundation.org/pipermail/lightning-dev/2020-November/002884.html
>
> All the existing replacement mechanisms _are_ basically a proof-of-UTXO
> ownership, because they're transactions spending UTXOs. The only question
> is
> the details of how that proof works.
>
> --
> https://petertodd.org 'peter'[:-1]@petertodd.org
>
--
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups•com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/CALZpt%2BGOCiwYdK4vfkODrT0Sx6HxCAuvhVqa1c5o3Xjy03OiAQ%40mail.gmail.com.
[-- Attachment #2: Type: text/html, Size: 9825 bytes --]
next prev parent reply other threads:[~2024-03-27 19:18 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-03-18 13:21 [bitcoindev] " Peter Todd
2024-03-19 12:37 ` Nagaev Boris
2024-03-19 13:46 ` Peter Todd
2024-03-23 0:29 ` Nagaev Boris
2024-03-22 23:18 ` [bitcoindev] " Antoine Riard
2024-03-27 13:04 ` Peter Todd
2024-03-27 19:17 ` Antoine Riard [this message]
2024-03-28 14:27 ` Peter Todd
2024-03-28 15:20 ` Peter Todd
2024-03-28 19:13 ` Antoine Riard
2024-03-28 19:47 ` Peter Todd
2024-03-29 20:48 ` Antoine Riard
2024-03-26 18:36 ` [bitcoindev] " David A. Harding
2024-03-27 6:27 ` Antoine Riard
2024-03-27 12:54 ` Peter Todd
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CALZpt+GOCiwYdK4vfkODrT0Sx6HxCAuvhVqa1c5o3Xjy03OiAQ@mail.gmail.com \
--to=antoine.riard@gmail$(echo .)com \
--cc=bitcoindev@googlegroups.com \
--cc=pete@petertodd$(echo .)org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox