From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from smtp1.linuxfoundation.org (smtp1.linux-foundation.org [172.17.192.35]) by mail.linuxfoundation.org (Postfix) with ESMTPS id E869ADFD for ; Sun, 20 Dec 2015 17:00:59 +0000 (UTC) X-Greylist: whitelisted by SQLgrey-1.7.6 Received: from mail-qg0-f44.google.com (mail-qg0-f44.google.com [209.85.192.44]) by smtp1.linuxfoundation.org (Postfix) with ESMTPS id B75D214F for ; Sun, 20 Dec 2015 17:00:58 +0000 (UTC) Received: by mail-qg0-f44.google.com with SMTP id 74so22249231qgh.1 for ; Sun, 20 Dec 2015 09:00:58 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:from:date:message-id:subject:to :content-type; bh=GF7pDR8cXCEhrstHhS1oTizcMAI5vd1CDJHlu789apY=; b=Bja5Tq62V5Z6s2wKWVrGTLDwnJZ19rvG7vjsL/vH8q+Yx0qZK+tKJNz3HLeANvJSuC NnawHddnNFf/uVjTCX/JRFa0qUn4B1w9oX4KEGjppKZA0Nd7dr0txLaMDel4W4K/5jP2 mgsINEJFeYaUPB2jEIJf2X+LfeotHYmUK3deb1Er8fikr3dgI8MqMPsu8oCR1ekTDq+Q dx4KJptaHDy5HM+eN50pcaXeXKfaBAw/VPH5VxuWsJFGLp03r9CXMLPC/I/mJj9BLRXF bDXwvORNoVpdoduar8o5yptw/iTXJxnFLQbqxjXfHJ/BUPIrJDfpHUf6x9Evnzq2m4xa f97Q== X-Received: by 10.140.94.56 with SMTP id f53mr19456875qge.0.1450630857872; Sun, 20 Dec 2015 09:00:57 -0800 (PST) MIME-Version: 1.0 Received: by 10.140.29.73 with HTTP; Sun, 20 Dec 2015 09:00:37 -0800 (PST) In-Reply-To: <20151220132842.GA25481@muck> References: <20151219184240.GB12893@muck> <219f125cee6ca68fd27016642e38fdf1@xbt.hk> <20151220132842.GA25481@muck> From: =?UTF-8?Q?Emin_G=C3=BCn_Sirer?= Date: Sun, 20 Dec 2015 12:00:37 -0500 Message-ID: To: Bitcoin Dev Content-Type: multipart/alternative; boundary=001a11466d1cfbff6d0527575077 X-Spam-Status: No, score=-2.7 required=5.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FROM,HTML_MESSAGE,RCVD_IN_DNSWL_LOW autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on smtp1.linux-foundation.org Subject: Re: [bitcoin-dev] We need to fix the block withholding attack X-BeenThere: bitcoin-dev@lists.linuxfoundation.org X-Mailman-Version: 2.1.12 Precedence: list List-Id: Bitcoin Development Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 20 Dec 2015 17:01:00 -0000 --001a11466d1cfbff6d0527575077 Content-Type: text/plain; charset=UTF-8 On Sun, Dec 20, 2015 at 8:28 AM, Peter Todd wrote: > There are a number of techniques that can be used to detect block > withholding attacks that you are not aware of. These techniques usually > have the characteristic that if known they can be avoided, so obviously > those who know about them are highly reluctant to reveal what exactly > they are. I personally know about some of them and have been asked to > keep that information secret, which I will. > Indeed, there are lots of weak measures that one could employ against an uninformed attacker. As I mentioned before, these are unlikely to be effective against a savvy attacker, and this is a good thing. > In the context of KYC, this techniques would likely hold up in court, > which means that if this stuff becomes a more serious problem it's > perfectly viable for large, well-resourced, pools to prevent block > withholding attacks, in part by removing anonymity of hashing power. > This would not be a positive development for the ecosystem. > KYC has a particular financial-regulation connotation in Bitcoin circles, of which I'm sure you're aware, and which you're using as a spectre. You don't mean government-regulated-KYC a la FINCEN and Bitcoin exchanges like Coinbase, you are just referring to a pool operator demanding to know that its customer is not coming from its competitors' data centers. And your prediction doesn't seem well-motivated or properly justified. There are tons of conditionals in your prediction, starting with the premise that every single open pool would implement some notion of identity checking. I don't believe that will happen. Instead, we will have the bigger pools become more suspicious of signing up new hash power, which is a good thing. And we will have small groups of people who have some reason for trusting each other (e.g. they know each other from IRC, conferences, etc) band together into small pools. These are fantastic outcomes for decentralization. Secondly, DRM tech can also easily be used to prevent block withholding > attacks by attesting to the honest of the hashing power. This is being > discussed in the industry, and again, this isn't a positive development > for the ecosystem. > DRM is a terrible application. Once again, I see that you're trying to use those three letters as a spectre as well, knowing that most people hate DRM, but keep in mind that DRM is just an application -- it's like pointing to Adobe Flash to taint all browser plugins. The tech behind DRM is called "attestation," and it provides a technical capability not possible by any other means. In essence, attestation can ensure that a remote node is indeed running the code that it purports to be running. Since most problems in computer security and distributed systems stem from not knowing what protocol the attacker is going to follow, attestation is the only technology we have that lets us step around this limitation. It can ensure, for instance, - that a node purporting to be Bitcoin Core (vLatest) is indeed running an unadulterated, latest version of Bitcoin Core - that a node claiming that it does not harvest IP addresses from SPV clients indeed does not harvest IP addresses. - that a cloud hashing outfit that rented out X terahashes to a user did indeed rent out X terahashes to that particular user, - that a miner operating on behalf of some pool P will not misbehave and discard perfectly good blocks and so forth. All of these would be great for the ecosystem. Just getting rid of the cloudhashing scams would put an end to a lot of heartache. > Keep in mind that when an open pool gets big, like GHash did and > > two other pools did before them, the only thing at our disposal used > > to be to yell at people about centralization until they left the big > > pools and reformed into smaller groups. Not only was such yelling > > kind of desperate looking, it wasn't incredibly effective, either. > > We had no protocol mechanisms that put pressure on big pools to > > stop signing up people. Ittay's discovery changed that: pools that > > get to be very big by indiscriminately signing up miners are likely to > > be infiltrated and their profitability will drop. And Peter's post is > > evidence that this is, indeed, happening as predicted. This is a > > good outcome, it puts pressure on the big pools to not grow. > > GHash.io was not a pure pool - they owned and operated a significant > amount of physical hashing power, and it's not at all clear that their % > of the network actually went down following that 51% debacle. > Right, it's not clear at all that yelling at people has much effect. As much fun as I had going to that meeting with GHash in London to ask them to back down off of the 51% boundary, I am pretty sure that yelling at large open pools will not scale. We needed better mechanisms for keeping pools in check. And Miner's Dilemma (MD) attacks are clearly quite effective. This is a time when we should count our blessings, not work actively to render them inoperable. Currently a significant % of the hashing power - possibly a majority - > is in the form of large hashing installations whose owners individually, > and definitely in trusting groups, have enough hashing power to solo > mine. Eyal's results indicate those miners have incentives to attack > pools, and additionally they have the incentive of killing off pools to > make it difficult for new competition to get established, yet they > themselves are not vulnerable to that attack. > There are indeed solo miners out there who can attack the big open pools. The loss of the biggest open pools would not be a bad outcome. Pools >25% pose a danger, and the home miner doesn't need a pool >25% for protection against variance. > Peter, you allude to a specific suggestion from Luke-Jr. Can you > > please describe what it is? > > Basically you have the pool pick a secret k for each share, and commit > to H(k) in the share. Additionally the share commits to a target divider > D. The PoW validity rule is then changed from H(block header) < T, to be > H(block header) < T * D && H(H(block header) + k) < max_int / D > Thanks, this requires a change to the Bitcoin PoW. Good luck with that! Once again, this suggestion would make the GHash-at-51% situation possible again. Working extra hard to re-enable those painful days sounds like a terrible idea. - egs --001a11466d1cfbff6d0527575077 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable
On S= un, Dec 20, 2015 at 8:28 AM, Peter Todd <pete@petertodd.org> wrote:
There are a number of techniques= that can be used to detect block
withholding attacks that you are not aware of. These techniques usually
have the characteristic that if known they can be avoided, so obviously
those who know about them are highly reluctant to reveal what exactly
they are. I personally know about some of them and have been asked to
keep that information secret, which I will.

=
Indeed, there are lots of weak measures that one could employ against= =C2=A0
an uninformed attacker. As I mentioned before, these are u= nlikely to be
effective against a savvy attacker, and this is a g= ood thing.
=C2=A0
In the context of KYC, this techniques would likely hold up in court,
which means that if this stuff becomes a more serious problem it's
perfectly viable for large, well-resourced, pools to prevent block
withholding attacks, in part by removing anonymity of hashing power.
This would not be a positive development for the ecosystem.

KYC has a particular financial-regulation connotation = in Bitcoin circles,=C2=A0
of which I'm sure you're aware,= and which you're using as a spectre.=C2=A0
You don't mea= n government-regulated-KYC a la FINCEN and Bitcoin
exchanges like= Coinbase, you are just referring to a pool operator
demanding to= know that its customer is not coming from its competitors'
d= ata centers.

And your prediction doesn't seem = well-motivated or properly justified.=C2=A0
There are tons of con= ditionals in your prediction, starting with the premise
that = every single open pool would implement some notion of identity=C2=A0
<= div>checking. I don't believe that will happen. Instead, we will have t= he bigger
pools become more suspicious of signing up new hash pow= er, which is a
good thing. And we will have small groups of peopl= e who have some reason
for trusting each other (e.g. they know ea= ch other from IRC, conferences,=C2=A0
etc) band together into sma= ll pools. These are fantastic outcomes for
decentralization.

Secondly, DRM tech can also = easily be used to prevent block withholding
attacks by attesting to the honest of the hashing power. This is being
discussed in the industry, and again, this isn't a positive development=
for the ecosystem.

DRM is a terrible ap= plication. Once again, I see that you're trying to use those
= three letters as a spectre as well, knowing that most people hate DRM, but= =C2=A0
keep in mind that DRM is just an application -- it's l= ike pointing to Adobe Flash
to taint all browser plugins.

The tech behind DRM is called "attestation," an= d it provides a technical=C2=A0
capability not possible by any ot= her means. In essence, attestation can ensure that
a remote node = is indeed running the code that it purports to be running. Since=C2=A0
most problems in computer security and distributed systems stem from = not
knowing what protocol the attacker is going to follow, attest= ation is the only=C2=A0
technology we have that lets us step arou= nd this limitation.=C2=A0

It can ensure, for insta= nce,=C2=A0
=C2=A0 - that a node purporting to be Bitcoin Core (vL= atest) is indeed running an
unadulterated, latest version of Bitc= oin Core=C2=A0
=C2=A0 - that a node claiming that it does not har= vest IP addresses from SPV=C2=A0
clients indeed does not harvest = IP addresses.
=C2=A0 - that a cloud hashing outfit that rented ou= t X terahashes to a user did=C2=A0
indeed rent out X terahash= es to that particular user,=C2=A0
=C2=A0 - that a miner operating= on behalf of some pool P will not misbehave and
discard perfectl= y good blocks
and so forth. All of these would be great for the e= cosystem. Just getting rid
of the cloudhashing scams would put an= end to a lot of heartache.

> Keep in mind that when an open pool gets big, like GHash did and
> two other pools did before them, the only thing at our disposal used > to be to yell at people about centralization until they left the big > pools and reformed into smaller groups. Not only was such yelling
> kind of desperate looking, it wasn't incredibly effective, either.=
> We had no protocol mechanisms that put pressure on big pools to
> stop signing up people. Ittay's discovery changed that: pools that=
> get to be very big by indiscriminately signing up miners are likely to=
> be infiltrated and their profitability will drop. And Peter's post= is
> evidence that this is, indeed, happening as predicted. This is a
> good outcome, it puts pressure on the big pools to not grow.

GHash.io was not a pure pool - they owned and operated a significant=
amount of physical hashing power, and it's not at all clear that their = %
of the network actually went down following that 51% debacle.

Right, it's not clear at all that yelling at peo= ple has much effect. As much
fun as I had going to that meeting w= ith GHash in London to ask them to
back down off of the 51% bound= ary, I am pretty sure that yelling at large
open pools will not s= cale. We needed better mechanisms for keeping pools
in check.

And Miner's Dilemma (MD) attacks are clearly quit= e effective. This is a
time when we should count our blessings, n= ot work actively to render
them inoperable.

<= blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px= #ccc solid;padding-left:1ex"> Currently a significant % of the hashing power - possibly a majority -
is in the form of large hashing installations whose owners individually, and definitely in trusting groups, have enough hashing power to solo
mine. Eyal's results indicate those miners have incentives to attack pools, and additionally they have the incentive of killing off pools to
make it difficult for new competition to get established, yet they
themselves are not vulnerable to that attack.

There are indeed solo miners out there who can attack the big open
pools. The loss of the biggest open pools would not be a bad outco= me.
Pools >25% pose a danger, and the home miner doesn't n= eed a pool=C2=A0
>25% for protection against variance.=C2=A0

> Peter, you allude to a specific suggestion from Luke-Jr. Can you
> please describe what it is?

Basically you have the pool pick a secret k for each share, and comm= it
to H(k) in the share. Additionally the share commits to a target divider D. The PoW validity rule is then changed from H(block header) < T, to be=
H(block header) < T * D && H(H(block header) + k) < max_int /= D

Thanks, this requires a change to th= e Bitcoin PoW. Good luck with that!=C2=A0

Once aga= in, this suggestion would make the GHash-at-51% situation=C2=A0
p= ossible again. Working extra hard to re-enable those painful days=C2=A0
sounds like a terrible idea.=C2=A0

- egs

--001a11466d1cfbff6d0527575077--