Dandelion: Privacy-Preserving Transaction Propagation in Bitcoin s P2P Network

Transcription

1 Dandelion: Privacy-Preserving Transaction Propagation in Bitcoin s P2P Network Presenter: Giulia Fanti Joint work with: Shaileshh Bojja Venkatakrishnan, Surya Bakshi, Brad Denby, Shruti Bhargava, Andrew Miller, Pramod Viswanath 1

2 Bitcoin P2P Primer tx Blockchain sd93fjj2 pckrn29 tx Alice k A Bob k B 2

3 Privacy requirement: Address and real identity must be unlinkable Bitcoin Address IP Address 3

4 Today, messages spread with diffusion. t=0.25!! t=2.9! Alice!!!!!! t=1.1 4

5 Diffusion is vulnerable to source detection! Biryukov et al. CCS 2014 Koshy et al., Financial Crypto 2014 F. and Viswanath, NIPS

6 Dandelion Lightweight transaction propagation algorithm with provable privacy guarantees. Venkatakrishan et al., ACM Sigmetrics 2017; F. et al., ACM Sigmetrics

7 FAQ: Why not alternative solutions? Connect through Tor I2P Integration (e.g. Monero) Tor 7

8 Model Assumptions and Notation 8

9 Adversarial model spies collude observe all metadata identities unknown fraction p of spies honestbut-curious 9

10 Metric for Anonymity Transactions Users Recall Precision 1 " # $ 1 % & ' s tx = & 1 " # $ 1 % & ' s tx = & # tx mapped to v Number honest users User Mapping Mapping % 10

11 Goal: Design a distributed flooding protocol that minimizes the maximum precision and recall achievable by a computationally-unbounded adversary. 11

12 Fundamental Limits 1 Thm: Maximum recall ". Precision Fraction of spies p 2 0 p 1 Recall Thm: Maximum precision " #. 12

13 What are we looking for? Asymmetry Mixing spy 13

14 What can we control? Spreading Protocol Topology Dynamicity Diffusion Approximately regular Dynamic Static Given a graph, how do we spread content? What is the underlying graph topology? How often does the graph change? 14

15 Spreading Protocol: Dandelion 1) Anonymity Phase 2) Spreading Phase 15

16 Why Dandelion spreading? Theorem: Dandelion spreading has an optimally low maximum recall of! + # $ %. lower bound = p fraction of spies number of nodes 16

17 Graph Topology: Line tx1 Anonymity graph tx2 Regular graph 17

18 Dynamicity: High Change the anonymity graph frequently. 18

19 DANDELION Network Policy Dandelion Spreading Spreading Protocol Line graph Topology Dynamicity Dynamic Static Given a graph, how do we spread content? What is the anonymity graph topology? How often does the graph change? 19

20 lower bound = p 2 Theorem: DANDELION has a nearly-optimal maximum precision of!"# $%" log! " + * $ +.* fraction of spies number of nodes *For, < $ 20.

21 Performance: Achievable Region 1 Precision Flooding Diffusion p 2 DANDELION 0 p 1 Recall 21

22 Why does DANDELION work? Strong mixing properties. Tree Complete graph (Crowds, Tor) Too many leaves Too many paths Precision:!(#) Precision: % &'% (1 *%'& ) 22

23 Graph construction in practice tx1 Choose d=1 outbound edges 23

24 Gives approximate d-regular anonymity graph d=1 24

25 What are drawbacks of Dandelion? Dandelion++: Lightweight Cryptocurrency Networking with Formal Anonymity Guarantees, ACM Sigmetrics

26 Experiments on mainnet TLPe to 10% (sefonds) %est )Lt 0LnLPuP (est) Path Length 26

27 Take-Home Messages 1) Bitcoin s P2P network has weak anonymity protections 2) DANDELION may be a lightweight solution against large-scale deanonymization attacks (but doesn t replace Tor!) 3) More information at:

28 Simulation on Bitcoin P2P Topology 1 Probability of Detection Trickle, Theoretical lower bound Trickle, Simulated Trickle, Theoretical lower bound (d=2) Diffusion, Theoretical Diffusion, Simulation Diffusion # Supernode Connections per Node 28 F. and Viswanath, NIPS 2017

29 4-Regular Graphs More robust against adversaries that learn the graph Per-transaction routing vulnerable to intersection attacks One-to-one Routing Pro: Increases cost of graph-learning attacks Con: Can make transactions from the same source easier to link 29

30 FAQ: Why not Tor? Tor, VPNs, etc. address this problem Only work for savvy or privacy-aware users If Bitcoin is to become a mainstream payment system, it should protect everyone s transactions Dandelion: lightweight, easy to integrate into existing network 30

31 Strength of Guarantees Dandelion Date of Invention 31 Narayanan and Möser, 2017

32 Moving from theory to practice 32

33 Implementation Adversarial Model Graph construction Deployment Byzantine nodes Intersection attacks AS-Level Adversaries 33

34 Implementation: Dandelion spreading 1) Anonymity Phase 2) Spreading Phase 34

35 Anonymity graph construction Degree 35

36 Adversarial Model: Byzantine nodes Learn the graph Misbehave during graph construction Misbehave during propagation 4-regular graphs 36

37 Anonymity graph construction 37

38 Dealing with stronger adversaries Learn the graph Misbehave during graph construction Misbehave during propagation 4-regular graphs Only send messages on outgoing edges Multiple nodes diffuse 38

39 Partial deployment Running Dandelion Not running Dandelion tx1 39

40 Latency Overhead: Estimate PDF Time to first transaction sighting (s) Information Propagation in the Bitcoin Network, Decker and Wattenhofer,

41 < 5 sec 41

42 DANDELION vs. Tor, Crowds, etc. 1) Messages propagate over the same cycle graph 2) Anonymity graph changes dynamically. 3) No encryption required. 42

43 Lower bound (Known graph) Upper bound (Known graph) Line (unknown) Line (known) 4-reg (unknown) Precision Upper bound (Unknown graph) d-regular graphs give robustness! 4-reg (known) Lower bound (Unknown graph) Fraction of Spies 43

44 44

45 Anonymity graph construction Base Case k=1 Rounds Base Case k=1 rounds of Degree-Checking Degree 45

46 Dealing with stronger adversaries Learn the graph Misbehave during graph construction Misbehave during propagation 4-regular graphs Get rid of degreechecking Multiple nodes diffuse 46

47 Learning the anonymity graph Line Precision Random regular Graph unknown Graph known! p # log 1 ( Ω(()? 47

48 Manipulating the anonymity graph 48

49 DANDELION++ Network Policy Dandelion Spreading Spreading Protocol 4-regular graph Topology Dynamicity Dynamic Static Given a graph, how do we spread content? What is the anonymity graph topology? How often does the graph change? 49