Re: [bitcoin-dev] Improving JoinMarket's resistance to sybil attacks using fidelity bonds

[Chris Belcher <belcher@riseup.net>]

On 27/07/2019 20:34, David A. Harding wrote:
> 
> Timelocking bitcoins, especially for long periods, carries some special
> risks in Bitcoin:
> 
> 1. Inability to sell fork coins, also creating an inability to influence
> the price signals that help determine the outcome of chainsplits.
> 
> 2. Possible inability to transition to new security mechanisms if
> a major weakness is discovered in ECC or a hash function.
> 

Far future locks are problematic. In my proposal I've only considered
locked coins for only 6 months because of exactly these reasons. The
market competition between airdrops should still exist after 6 months so
lockers will still get a chance to sell their airdrops. And any
ECC-alternative or hash-function-alternative fork will probably take a
couple of months to be designed, implemented and deployed as well,
giving a chance for lockers to move coins.


> An alternative to timelocks might be coin age---the value of a UTXO
> multiplied by the time since that UTXO was confirmed.  Coin age may be
> even harder for an attacker to acquire given that it is a measure of
> past patience rather than future sacrifice.  It also doesn't require
> using any particular script and so is flexible no matter what policy the
> coin owner wants to use (especially if proof-of-funds signatures are
> generated using something like BIP322).

I'm becoming more and more convinced that coin age is also a valid
method of proving a sacrifice. Using coin age also has a benefit that
less block space is used, because using timelocks requires a new
on-chain transaction to be made every 6 months or whatever the locking
period is.

Perhaps JoinMarket should accept all three methods of proving a
sacrifice: burning, timelocking and aging. I could imagine that makers
would first lock coins for 6 months to create a fidelity bond they could
immediately use, and after the timelock expires leave that coin unspent
and use its age as the fidelity bond.

For what its worth, I mostly considered burning coins because the maths
for it is easy (the value of such a bond is just V^2), and because it
provides a boundary condition (locking up coins for infinity time is the
same as burning them). I doubt anybody will actually do it in practice.


> - BIP158 users who have saved their past filters to disk can use them to
>   determine which blocks subsequent to the one including the UTXO may
>   contain a spend from it.  However, since a UTXO can be spent in the
>   same block, they'd always need to download the block containing the
>   UTXO (alternatively, the script could contain a 1-block CSV delay
>   ensuring any spend occurred in a later block).  If BIP158 filters
>   become committed at some point, this mechanism is upgraded to SPV-level
>   security.

This scheme could be attacked using address reuse. An attacker could
create an aged coin on a heavily-reused address, which would force an
SPV client using this scheme to download all the blocks which contain
this reused address which could result in many gigabytes of extra
download requirement.

So to fix this: a condition for aged coins is that their address has not
been reused, if the coin is on a reused address then the value of the
fidelity bond becomes zero.