From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from fraxinus.osuosl.org (smtp4.osuosl.org [140.211.166.137]) by lists.linuxfoundation.org (Postfix) with ESMTP id 7AB33C016F for ; Sun, 7 Jun 2020 22:32:07 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by fraxinus.osuosl.org (Postfix) with ESMTP id 765A98586A for ; Sun, 7 Jun 2020 22:32:07 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from fraxinus.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vGpCmcU3pS9K for ; Sun, 7 Jun 2020 22:32:06 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-pf1-f171.google.com (mail-pf1-f171.google.com [209.85.210.171]) by fraxinus.osuosl.org (Postfix) with ESMTPS id 40452855CE for ; Sun, 7 Jun 2020 22:32:06 +0000 (UTC) Received: by mail-pf1-f171.google.com with SMTP id b5so7665570pfp.9 for ; Sun, 07 Jun 2020 15:32:06 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=V09OcL17nC4tun4pg7rQncfCCto69sDkjZjLwSRf340=; b=hAR9qqeZU8P+HMEA4+uugCcO9mN6uSYsr+zN+6cE0cc8jNXDAMhMoNC327mDBTcseY 1G3rDlR+JYOKzwrgxnPius/jxDP3CenE3P2Ys3nW6s8b0U3Tqx2p+fafaYky0ROrpyWb jO79rUFktzrbWdT9PR5/zcOvW9JtENt0wDSqlbOdwvicOcxfbJAriigub/bzsodfg0CH R3Zo6T4m2MvI4PARSvNbQzhQ/4NoGVRlnUSmPccRVFSuqNe+l7qVIG1vhU07qhvvgAlW ibhIFvPmYN2twMZjfP0pU/1Xrr87MCAwPqCYLR7UglYtETQM3ISZf6idMyrkv+8MMw1X 3Sag== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=V09OcL17nC4tun4pg7rQncfCCto69sDkjZjLwSRf340=; b=GpU1EJKrsIrApNKCUpzAC1SHEoGWcTAuV/SyTQuXNAHraD0hA9Mkl49RiToZsbArMj h6wb2s3SQ2nNMu/k5oLuQzs6KOCMP1P7YxVrBlXwad5fCNNr62c94+4t+8PpaxGPfEpd jJVTWOmv84fJaFfLbqltAvxOjSK1IixsWhzK3vcJfYzygss1XoDlLUiEN39Iek2p+5Ji AdGK9QP35Wpv1VU+jwUbvxZjZsEwsIBoDkg05Db7569Nis+fq75nGTqLeAwNoDo4BNWl GvPnamFtBAA16NJTCS8bRkVQ4p7qOrEozoZhs5RAY9noS/9kocjbyPJbr+xmv/zgtA9U cDtQ== X-Gm-Message-State: AOAM532oYAWghtLOFJqXH76HcMb5ZJKtS25tlUG6y4iZX9ZjLDR1o54h Z/+KEH5Jz5cS2mw+fLJ0IklcfoFX2WHwLO3LjfM= X-Google-Smtp-Source: ABdhPJxHIkkRYMr6U6Ln06QDC0gbJsfnDFK48zjvqBQSAyh4QB19HdTP/stOpfbElK6x14L086b275qsZUdK7+5PfNY= X-Received: by 2002:a63:9d81:: with SMTP id i123mr17900667pgd.176.1591569125731; Sun, 07 Jun 2020 15:32:05 -0700 (PDT) MIME-Version: 1.0 References: <2e8fba65-f7fa-4c37-a318-222547e25a06@Spark> <9e4dfaa7-895a-48a1-8116-eaafc80da34f@Spark> <2phhD75B8ww3hFQ8Do039wAIlW8EVOjUeiedm-JtIek-TEnVocYSx-untchGrO3VoRLoPzinVAG95UN1yR3CadNWBJGSu19vJpFJ_yN-wZY=@protonmail.com> In-Reply-To: <2phhD75B8ww3hFQ8Do039wAIlW8EVOjUeiedm-JtIek-TEnVocYSx-untchGrO3VoRLoPzinVAG95UN1yR3CadNWBJGSu19vJpFJ_yN-wZY=@protonmail.com> From: Antoine Riard Date: Sun, 7 Jun 2020 18:31:54 -0400 Message-ID: To: ZmnSCPxj , Bitcoin Protocol Discussion Content-Type: multipart/alternative; boundary="0000000000005fefe905a786109c" X-Mailman-Approved-At: Mon, 08 Jun 2020 02:02:00 +0000 Cc: Gleb Naumenko Subject: Re: [bitcoin-dev] Time-dilation Attacks on the Lightning Network X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 07 Jun 2020 22:32:07 -0000 --0000000000005fefe905a786109c Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable Hi ZmnSCPxj, > (Of note as well, is that the onchain contract provided by such services is the same in spirit as those instantiated in channels of the Lightning Network, thus the same attack schema works on the onchain side.) If you onchain contract uses a timelock and has concurrent transactions arbiter by this one , it's subject to time-dilation attack. So yes submarine swaps, or any kind of atomic swap is concerned. We note this in discussion. But you're right for the attack cost, you don't need a channel to these services, which is also concerning for their attack surface. > Since the issue here is that eclipsing of Bitcoin nodes is risky, it strikes me that a mitigation would be to run your Bitcoin fullnode on clearnet while running your Lightning node over Tor We clearly mention that risk of running a Bitcoin node over Tor, where do we recommend running a LN node over Tor ? > And this seems to tie with what you propose: that the LN node should use a different view-fullnode from the broadcast-fullnode. Yes in Countermeasures - Link layer diversity, specially if it's easy for an attacker to provoke a transaction broadcast by buying a channel to the LN node. > A mitigation to this would be to run a background process which sleeps for 20 minutes, then does `bitcoin-cli addnode ${BITCOINNODE} onetry`. Yeah instead of having every node operator running their own hacky scripts, without them being bulletproofs on detection, I'm working on getting such mitigations directly in Core, easily deployable for everyone. > The victim *could* instead check that the absolute timelocks seem very far in the future relative to its own view of the current blockheight. I think you're right it's really dependent on CLTV_delta deployed on the path and time-dilation offset. The alternative you're proposing is a good one, but you shouldn't know where you're in the path and max CLTV is 2048 blocks IIRC. Thanks for your reading and review, Cheers, Antoine Le mer. 3 juin 2020 =C3=A0 22:58, ZmnSCPxj via bitcoin-dev < bitcoin-dev@lists.linuxfoundation.org> a =C3=A9crit : > Good morning Gleb and Antoine, > > This is good research, thank you for your work. > > > **Targeting Per-Hop Packet Delay** is based on routing via the victim, > and the victim should have at least two channels with the attacker. > > The existence of offchain-to-onchain swap services means that the attacke= r > needs only build one channel to the victim for this attack to work. > Rather than route to themselves, the attacker routes to a convenient > service providing such a swap service, and receives the stolen funds > onchain, with no need even for an incoming channel from a different node. > (Of note as well, is that the onchain contract provided by such services > is the same in spirit as those instantiated in channels of the Lightning > Network, thus the same attack schema works on the onchain side.) > > Indeed, the attack can be mounted on such a service directly. > > Even without such a service, the incoming channel need not be directly > connected to the victim. > > > > [Tor is tricky](https://arxiv.org/abs/1410.6079) too > > Since the issue here is that eclipsing of Bitcoin nodes is risky, it > strikes me that a mitigation would be to run your Bitcoin fullnode on > clearnet while running your Lightning node over Tor. > Eclipsing the Lightning node (but not the Bitcoin fullnode it depends on) > "only" loses you the ability to pay, receive, or route (and thereby earn > forwarding fees), but as long as your blockchain view is clear, it should > be fine. > > Of course, the Lightning node could still be correlated with the Bitcoin > node when transactions are broadcast with the attached Bitcoin node (as > noted in the paper). > Instead the Lightning node should probably connect, over Tor, to some > random Bitcoin fullnodes / Electrum servers and broadcast txes to them. > > And this seems to tie with what you propose: that the LN node should use = a > different view-fullnode from the broadcast-fullnode. > > > > if a node doesn=E2=80=99t observe a block within the last 30 minutes, i= t > attempts to make a new random connection to someone in the network. > > A mitigation to this would be to run a background process which sleeps fo= r > 20 minutes, then does `bitcoin-cli addnode ${BITCOINNODE} onetry`. > It might want to `disconnectnode` any previous node it attempted to > connect to. > > However I note that the help for `addnode` contains the text "though such > peers will not be synced from", which confuses me, since it also refers t= o > the `-connect` command line option, and `-connect` means you only connect > out to the specific nodes, so if those are not synced from.... huh? > > And of course the interesting part is "how do we get a `${BITCOINNODE}` > that we think is not part of the eclipsing attacker?" > > > > If a Lightning node is behind in its Bitcoin blockchain view, but > Lightning payments between honest nodes are still flowing through it, thi= s > node will have a high routing failure rate. This would happen because > honest nodes on the routing path would reject the forwarded HTLC for bein= g > too close to expired. > > I am uncertain this would happen very often. > In the first place, the incoming HTLC would have "reasonable" timeouts, o= r > else the incoming honest node would not have routed it at all, and the > outgoing HTLC would be relative to this incoming one, so the outgoing > honest node will still accept this. > > The victim *could* instead check that the absolute timelocks seem very fa= r > in the future relative to its own view of the current blockheight. > (a forwarding node miht want to do that anyway to have an upper bound > against griefing attacks) > > What would definitely increase in failure rate would be payments arising > from the victim node; the victim node believes the blockheight to be much > lower than it actually is, and either the payee node, or some intermediat= e > node along the route, will claim to have too little time to safely forwar= d > the funds. > This does not help for nodes which are primarily forwarding nodes. > > > > Regards, > ZmnSCPxj > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists.linuxfoundation.org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev > --0000000000005fefe905a786109c Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
Hi ZmnSCPxj,

> (Of note as w= ell, is that the onchain contract provided by such services is the same in spirit as those instantiated in channels of the=20 Lightning Network, thus the same attack schema works on the onchain=20 side.)

If you onchain contract uses a timelock and has concurr= ent transactions arbiter by this one , it's subject to time-dilation at= tack. So yes submarine swaps, or any kind of atomic swap is concerned. We n= ote this in discussion.
But you're right for the attack cost, = you don't need a channel to these services, which is also concerning fo= r their attack surface.

> Since the issue here is that eclipsing = of Bitcoin nodes is risky, it=20 strikes me that a mitigation would be to run your Bitcoin fullnode on=20 clearnet while running your Lightning node over Tor

We clearly mention that risk of running a Bitcoin node over T= or, where do we recommend running a LN node over Tor ?

> =C2=A0 A= nd this seems to tie with what you propose: that the LN node should use a d= ifferent view-fullnode from the broadcast-fullnode.

Yes in Cou= ntermeasures - Link layer diversity, specially if it's easy for an atta= cker to provoke a transaction broadcast by buying a channel to the LN node.=

> A mitigation to this would be to run a background process whic= h sleeps=20 for 20 minutes, then does `bitcoin-cli addnode ${BITCOINNODE} onetry`.
=
Yeah instead of having every node operator running their own= hacky scripts, without them being bulletproofs on detection, I'm worki= ng on getting such mitigations directly in Core, easily deployable for ever= yone.

> The victim *could* instead check that the absolute timelo= cks seem very=20 far in the future relative to its own view of the current blockheight.
<= br>
I think you're right it's really dependent on CLTV_de= lta deployed on the path and time-dilation offset. The alternative you'= re proposing is a good one, but you shouldn't know where you're in = the path and max CLTV is 2048 blocks IIRC.

Thanks for you= r reading and review,

Cheers,
Antoine

Le=C2=A0mer. 3 juin 2020 =C3=A0=C2=A022:58, ZmnSCPxj via bitcoin-dev &l= t;bitcoin-dev@list= s.linuxfoundation.org> a =C3=A9crit=C2=A0:
Good morning Gleb and Antoine,

This is good research, thank you for your work.

> **Targeting Per-Hop Packet Delay** is based on routing via the victim,= and the victim should have at least two channels with the attacker.

The existence of offchain-to-onchain swap services means that the attacker = needs only build one channel to the victim for this attack to work.
Rather than route to themselves, the attacker routes to a convenient servic= e providing such a swap service, and receives the stolen funds onchain, wit= h no need even for an incoming channel from a different node.
(Of note as well, is that the onchain contract provided by such services is= the same in spirit as those instantiated in channels of the Lightning Netw= ork, thus the same attack schema works on the onchain side.)

Indeed, the attack can be mounted on such a service directly.

Even without such a service, the incoming channel need not be directly conn= ected to the victim.


> [Tor is tricky](https://arxiv.org/abs/1410.6079) too

Since the issue here is that eclipsing of Bitcoin nodes is risky, it strike= s me that a mitigation would be to run your Bitcoin fullnode on clearnet wh= ile running your Lightning node over Tor.
Eclipsing the Lightning node (but not the Bitcoin fullnode it depends on) &= quot;only" loses you the ability to pay, receive, or route (and thereb= y earn forwarding fees), but as long as your blockchain view is clear, it s= hould be fine.

Of course, the Lightning node could still be correlated with the Bitcoin no= de when transactions are broadcast with the attached Bitcoin node (as noted= in the paper).
Instead the Lightning node should probably connect, over Tor, to some rando= m Bitcoin fullnodes / Electrum servers and broadcast txes to them.

And this seems to tie with what you propose: that the LN node should use a = different view-fullnode from the broadcast-fullnode.


> if a node doesn=E2=80=99t observe a block within the last 30 minutes, = it attempts to make a new random connection to someone in the network.

A mitigation to this would be to run a background process which sleeps for = 20 minutes, then does `bitcoin-cli addnode ${BITCOINNODE} onetry`.
It might want to `disconnectnode` any previous node it attempted to connect= to.

However I note that the help for `addnode` contains the text "though s= uch peers will not be synced from", which confuses me, since it also r= efers to the `-connect` command line option, and `-connect` means you only = connect out to the specific nodes, so if those are not synced from.... huh?=

And of course the interesting part is "how do we get a `${BITCOINNODE}= ` that we think is not part of the eclipsing attacker?"


> If a Lightning node is behind in its Bitcoin blockchain view, but Ligh= tning payments between honest nodes are still flowing through it, this node= will have a high routing failure rate. This would happen because honest no= des on the routing path would reject the forwarded HTLC for being too close= to expired.

I am uncertain this would happen very often.
In the first place, the incoming HTLC would have "reasonable" tim= eouts, or else the incoming honest node would not have routed it at all, an= d the outgoing HTLC would be relative to this incoming one, so the outgoing= honest node will still accept this.

The victim *could* instead check that the absolute timelocks seem very far = in the future relative to its own view of the current blockheight.
(a forwarding node miht want to do that anyway to have an upper bound again= st griefing attacks)

What would definitely increase in failure rate would be payments arising fr= om the victim node; the victim node believes the blockheight to be much low= er than it actually is, and either the payee node, or some intermediate nod= e along the route, will claim to have too little time to safely forward the= funds.
This does not help for nodes which are primarily forwarding nodes.



Regards,
ZmnSCPxj
_______________________________________________
bitcoin-dev mailing list
= bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mail= man/listinfo/bitcoin-dev
--0000000000005fefe905a786109c--