From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from whitealder.osuosl.org (smtp1.osuosl.org [140.211.166.138]) by lists.linuxfoundation.org (Postfix) with ESMTP id 789D6C0175 for ; Wed, 22 Apr 2020 19:03:45 +0000 (UTC) Received: from localhost (localhost [127.0.0.1]) by whitealder.osuosl.org (Postfix) with ESMTP id 67F0D811E7 for ; Wed, 22 Apr 2020 19:03:45 +0000 (UTC) X-Virus-Scanned: amavisd-new at osuosl.org Received: from whitealder.osuosl.org ([127.0.0.1]) by localhost (.osuosl.org [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id te-wyyBC3YEQ for ; Wed, 22 Apr 2020 19:03:43 +0000 (UTC) X-Greylist: domain auto-whitelisted by SQLgrey-1.7.6 Received: from mail-pf1-f177.google.com (mail-pf1-f177.google.com [209.85.210.177]) by whitealder.osuosl.org (Postfix) with ESMTPS id 5E960846EE for ; Wed, 22 Apr 2020 19:03:43 +0000 (UTC) Received: by mail-pf1-f177.google.com with SMTP id f7so1580565pfa.9 for ; Wed, 22 Apr 2020 12:03:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to; bh=6rEBHkJvfXXpHQHDggubciLpv8SajflP4ApVVCO34m4=; b=bPbi8XFfpsHoKnKCkKk/BwvYCAmOEcqoPr9mtQnPAxDtV4zx2CE+fuNxPKE0MeVnCE RK4UFDLl6P+ZFaxr9JQD82GyYW0FV8pdKq5cMuPlbS83XIFSJsdYXIiRRJ3zdGztMwdp HPUXGl05G8vLJEKVL+B23biEiWibFLRWm1fmyNt3LsuO4URQ6r7jz2VAJbks3DOYNFxm OwDpsDM54Rut1Rxdr+KohqI37wrm2F9JtGpoVEgA2CroJH295Sk42WHMNRENQIAzcicO BCxnsvxuURCrwC/tEFkmHiJ/MOcmGaJqNfULFp95/Gh+flaJhCKU9PFregNlxjDOyuzE q7xg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to; bh=6rEBHkJvfXXpHQHDggubciLpv8SajflP4ApVVCO34m4=; b=jJQlhjcklczhX4aOmi8/tlaomWnJl4H1zXPdhDCS/Jd4BuWWVLYN7Tg30aQb4LGOhf Hm6QtHxRsyZnMINelgB2b1I0fz5mOha/VC3A0VrSBoIwzE0/3PYxkBlQCy8wtllpKUYE t7c27tPJwr9KsdFPMiiAeDH5qMtB+hidl+BQx72QY2lqPJ2J8hNYiB9lHt6KlEw0rm9h YlLhVKjA3xNax2q0xICAGpGfZ9ttT1FzlSfgnnznOtLyi7BHlY1tG7y4Ioqc5RunKKkG YKgeXCX43iwXUU28zwOCENEDXQPIKsPce+7LbgqDln6jQ12ZFEU6rR8QGbXcUNn58Ryn tUzg== X-Gm-Message-State: AGi0PuaPcMKGTgEiGgdTKeLZFKIkTfOQdfPnba/0F4Z/ONKzOdrFlZmS VgYxXwwDrNOLJ50u+/PQMTh6vBkY+LjSIkQpCLXDOZdB X-Google-Smtp-Source: APiQypKYDm83VPYO578gmCIaPvzct8O05EBTVkjuTimX7M/gSI00TwfC4EfXRbUW1A/u6xy4/RNiUfeJPz1DROLG/v4= X-Received: by 2002:a63:de41:: with SMTP id y1mr508199pgi.176.1587582222823; Wed, 22 Apr 2020 12:03:42 -0700 (PDT) MIME-Version: 1.0 References: <20200422182454.3y3foxxhiovokovp@ganymede> In-Reply-To: <20200422182454.3y3foxxhiovokovp@ganymede> From: Antoine Riard Date: Wed, 22 Apr 2020 15:03:29 -0400 Message-ID: To: "David A. Harding" , Bitcoin Protocol Discussion Content-Type: multipart/alternative; boundary="00000000000071757205a3e5caba" X-Mailman-Approved-At: Wed, 22 Apr 2020 19:53:18 +0000 Subject: Re: [bitcoin-dev] RBF Pinning with Counterparties and Competing Interest X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.15 Precedence: list List-Id: Bitcoin Protocol Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 22 Apr 2020 19:03:45 -0000 --00000000000071757205a3e5caba Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable > In that case, would it be worth re-implementing something like a BIP61 reject message but with an extension that returns the txids of any conflicts? That's an interesting idea, but an attacker can create a local conflict in your mempool and then send the preimage tx to make hit recentRejects until next tip so when the rejection code with conflict is received transaction isn't going to be fetched. Of course you can make an exception for this, but seems a DoS vector... And also if you have a private full-node and connect only to 8 outbounds, an attacker can do a bit of tx-relay topology discovery and blind your tx-relay peers too... I think p2p/mempool hardening measures will only make attack harder but not erase it, we should avoid tie too much the security model of Lightning on a given p2p topology. If you don't do manual peering (whitelist,addnode), this one may change without visibility (like stale tip). Le mer. 22 avr. 2020 =C3=A0 14:25, David A. Harding via bitcoin-dev < bitcoin-dev@lists.linuxfoundation.org> a =C3=A9crit : > On Mon, Apr 20, 2020 at 10:43:14PM -0400, Matt Corallo via Lightning-dev > wrote: > > A lightning counterparty (C, who received the HTLC from B, who > > received it from A) today could, if B broadcasts the commitment > > transaction, spend an HTLC using the preimage with a low-fee, > > RBF-disabled transaction. After a few blocks, A could claim the HTLC > > from B via the timeout mechanism, and then after a few days, C could > > get the HTLC-claiming transaction mined via some out-of-band agreement > > with a small miner. This leaves B short the HTLC value. > > IIUC, the main problem is honest Bob will broadcast a transaction > without realizing it conflicts with a pinned transaction that's already > in most node's mempools. If Bob knew about the pinned transaction and > could get a copy of it, he'd be fine. > > In that case, would it be worth re-implementing something like a BIP61 > reject message but with an extension that returns the txids of any > conflicts? For example, when Bob connects to a bunch of Bitcoin nodes > and sends his conflicting transaction, the nodes would reply with > something like "rejected: code 123: conflicts with txid 0123...cdef". > Bob could then reply with a a getdata('tx', '0123...cdef') to get the > pinned transaction, parse out its preimage, and resolve the HTLC. > > This approach isn't perfect (if it even makes sense at all---I could be > misunderstanding the problem) because one of the problems that caused > BIP61 to be disabled in Bitcoin Core was its unreliability, but I think > if Bob had at least one honest peer that had the pinned transaction in > its mempool and which implemented reject-with-conflicting-txid, Bob > might be ok. > > -Dave > _______________________________________________ > bitcoin-dev mailing list > bitcoin-dev@lists.linuxfoundation.org > https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev > --00000000000071757205a3e5caba Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
> In that case, would it be worth re-imp= lementing something like a BIP61
reject message but with an extension that returns the txids of any
conflicts?

That's an interesting idea, but an attacker can= create a local conflict in your mempool
and then send the preimag= e tx to make hit recentRejects until next tip so
when the rejecti= on code with conflict is received transaction isn't going to be fetched= .
Of course you can make an exception for this, but seems a D= oS vector...

And also if you have a private full-node and= connect only to 8 outbounds, an attacker
can do a bit of tx-rela= y topology discovery and blind your tx-relay peers too...

I think p2p/mempool hardening measures will only make attack harder but no= t erase it, we
should avoid tie too much the security model o= f Lightning on a given p2p topology. If you don't
do manual p= eering (whitelist,addnode), this one may change without visibility (like st= ale tip).



=
Le=C2=A0mer. 22 avr. 2020 =C3=A0=C2= =A014:25, David A. Harding via bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org> = a =C3=A9crit=C2=A0:
On Mon, Apr 20, 2020 at 10:43:14PM -0400, Matt Corallo via Lightning-de= v wrote:
> A lightning counterparty (C, who received the HTLC from B, who
> received it from A) today could, if B broadcasts the commitment
> transaction, spend an HTLC using the preimage with a low-fee,
> RBF-disabled transaction.=C2=A0 After a few blocks, A could claim the = HTLC
> from B via the timeout mechanism, and then after a few days, C could > get the HTLC-claiming transaction mined via some out-of-band agreement=
> with a small miner. This leaves B short the HTLC value.

IIUC, the main problem is honest Bob will broadcast a transaction
without realizing it conflicts with a pinned transaction that's already=
in most node's mempools.=C2=A0 If Bob knew about the pinned transaction= and
could get a copy of it, he'd be fine.

In that case, would it be worth re-implementing something like a BIP61
reject message but with an extension that returns the txids of any
conflicts?=C2=A0 For example, when Bob connects to a bunch of Bitcoin nodes=
and sends his conflicting transaction, the nodes would reply with
something like "rejected: code 123: conflicts with txid 0123...cdef&qu= ot;.
Bob could then reply with a a getdata('tx', '0123...cdef') = to get the
pinned transaction, parse out its preimage, and resolve the HTLC.

This approach isn't perfect (if it even makes sense at all---I could be=
misunderstanding the problem) because one of the problems that caused
BIP61 to be disabled in Bitcoin Core was its unreliability, but I think
if Bob had at least one honest peer that had the pinned transaction in
its mempool and which implemented reject-with-conflicting-txid, Bob
might be ok.

-Dave
_______________________________________________
bitcoin-dev mailing list
= bitcoin-dev@lists.linuxfoundation.org
https://lists.linuxfoundation.org/mail= man/listinfo/bitcoin-dev
--00000000000071757205a3e5caba--