MIME-Version: 1.0
References: <20160824014634.GA19905@fedora-21-dvm>
In-Reply-To: <20160824014634.GA19905@fedora-21-dvm>
From: James MacWhyte <macwhyte@gmail.com>
Date: Thu, 25 Aug 2016 02:54:47 +0000
Message-ID: <CAH+Axy4ahvQOG5=jGn68u0m5dTTmFCJ0isfOEt-Be=63ot55dg@mail.gmail.com>
To: Peter Todd <pete@petertodd.org>, 
	Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary=001a114a8388f49447053adc85f4
Cc: Jeff Coleman <jeff@ledgerlabs.io>
Subject: Re: [bitcoin-dev] Capital Efficient Honeypots w/ "Scorched Earth"
 Doublespending Protection
Precedence: list

--001a114a8388f49447053adc85f4
Content-Type: text/plain; charset=UTF-8

I've always assumed honeypots were meant to look like regular, yet
poorly-secured, assets. If the intruder could identify this as a honeypot
by the strange setup (presigned, non-standard transactions lying around)
and was aware that the creator intended to doublespend as soon as the
transaction was discovered, wouldn't they instead prefer to not touch
anything and wait for a non-bait target to appear? Is the assumption here
that the intruder wouldn't know this is a honeypot, or that they would know
and it's just assumed that they would rather take their chances on this
instead of causing some other trouble?

On Tue, Aug 23, 2016 at 6:47 PM Peter Todd via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

> Bitcoin-based honeypots incentivise intruders into revealing the fact they
> have
> broken into a server by allowing them to claim a reward based on secret
> information obtained during the intrusion. Spending a bitcoin can only be
> done
> by publishing data to a public place - the Bitcoin blockchain - allowing
> detection of the intrusion.
>
> The simplest way to achieve this is with one private key per server, with
> each
> server associated with one transaction output spendable by that key.
> However
> this isn't capital efficient if you have multiple servers to protect: if we
> have N servers and P bitcoins that we can afford to lose in the
> compromise, one
> key per server gives the intruder only N/P incentive.
>
> Previously Piete Wuille proposed(1) tree signatures for honeypots, with a
> single txout protected by a 1-N tree of keys, with each server assigned a
> specific key. Unfortunately though, tree signatures aren't yet implemented
> in
> the Bitcoin protocol.
>
> However with a 2-of-2 multisig and the SIGHASH_SINGLE feature we can
> implement
> this functionality with the existing Bitcoin protocol using the following
> script:
>
>     2 <honeypot-pubkey> <distriminator-pubkey> 2 CHECKMULTISIG
>
> The honeypot secret key is shared among all N servers, and left on them.
> The
> distriminator secret key meanwhile is kept secret, however for each server
> a
> unique signature is created with SIGHASH_SINGLE, paying a token amount to a
> notification address. For each individual server a pre-signed signature
> created
> with the distriminator secret key is then left on the associated server
> along
> with the honeypot secret key.
>
> Recall the SIGHASH_SINGLE flag means that the signature only signs a single
> transaction input and transaction output; the transaction is allowed to
> have
> additional inputs and outputs added. This allows the thief to use the
> honeypot
> key to construct a claim transaction with an additional output added that
> pays
> an address that they own with the rest of the funds.
>
> Equally, we could also use SIGHASH_NONE, with the per-server discriminator
> being the K value used in the pre-signed transaction.
>
> Note that Jeff Coleman deserves credit as co-inventor of all the above.
>
>
> Censorship Resistance
> =====================
>
> A potential disadvantage of using non-standard SIGHASH flags is that the
> transactions involved are somewhat unusual, and may be flagged by
> risk analysis at exchanges and the like, a threat to the fungibility of the
> reward.
>
> We can improve on the above concept from Todd/Coleman by using a pre-signed
> standard transaction instead. The pre-signed transaction spends the
> honeypot
> txout to two addresses, a per-server canary address, and a change address.
> The
> private key associated with the change addres is also left on the server,
> and
> the intruder can then spend that change output to finally collect their
> reward.
>
> To any external observer the result looks like two normal transactions
> created
> in the process of someone with a standard wallet sending a small amount of
> funds to an address, followed by sending a larger amount.
>
>
> Doublespending
> ==============
>
> A subtlety in the the two transactions concept is that the intruder doesn't
> have the necessary private keys to modify the first transaction, which
> means
> that the honeypot owner can respond to the compromise by doublespending
> that
> transaction, potentially recovering the honeypot while still learning
> about the
> compromise. While this is possible with all honeypots, if the first
> transaction
> is signed with the opt-in RBF flags, and CPFP-aware transaction
> replacement is
> not implemented by miners, the mechanics are particularly disadvantageous
> to
> the intruder, as the honeypot owner only needs to increase the first
> transaction's fee slightly to have a high chance of recovering their funds.
> With CPFP-aware transaction replacement the intruder could in-turn respond
> with
> a high-fee CPFP second transaction, but currently no such implementation is
> known.
>
>
> Scorched Earth
> ==============
>
> We can use the "scorched earth" concept to improve the credibility of the
> honeypot reward by making it costly for the honeypot owner to doublespend.
> Here
> a second version of the honeypot pre-signed transaction would also be
> provided
> which sepnds the entirety of the honeypot output to fees, and additionally
> spends a second output to fees. An economically rational intruder will
> publish
> the first version, which maximizes the funds they get out of the honeypot.
> If
> the owner tries to dishonestly doublespend, they can respond by publishing
> the
> "scorched earth" transaction, encouraging the honeypot owner's honesty and
> making CPFP-aware transaction replacement irrelevant.
>
> Of course, miner centralization adds complexity to the above: in many
> instances
> honeypot owners and/or intruders will be able to recover funds from
> altruistic
> miners. Equally, the additional complexity may discourage intruders from
> making
> use of the honeypot entirely.
>
> Note that as an implementation consideration CHECKSEQUENCEVERIFY can be
> used to
> ensure the honeypot output can only be spent with transaction replacement
> enabled, as CSV requires nSequence to be set in specific ways in any
> transation
> spending the output.
>
>
> References
> ==========
>
> 1) https://blockstream.com/2015/08/24/treesignatures/
>
> --
> https://petertodd.org 'peter'[:-1]@petertodd.org
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--001a114a8388f49447053adc85f4
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I&#39;ve always assumed honeypots were meant to look like =
regular, yet poorly-secured, assets. If the intruder could identify this as=
 a honeypot by the strange setup (presigned, non-standard transactions lyin=
g around) and was aware that the creator intended to doublespend as soon as=
 the transaction was discovered, wouldn&#39;t they instead prefer to not to=
uch anything and wait for a non-bait target to appear? Is the assumption he=
re that the intruder wouldn&#39;t know this is a honeypot, or that they wou=
ld know and it&#39;s just assumed that they would rather take their chances=
 on this instead of causing some other trouble?<br><br><div class=3D"gmail_=
quote"><div dir=3D"ltr">On Tue, Aug 23, 2016 at 6:47 PM Peter Todd via bitc=
oin-dev &lt;<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoi=
n-dev@lists.linuxfoundation.org</a>&gt; wrote:<br></div><blockquote class=
=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padd=
ing-left:1ex">Bitcoin-based honeypots incentivise intruders into revealing =
the fact they have<br>
broken into a server by allowing them to claim a reward based on secret<br>
information obtained during the intrusion. Spending a bitcoin can only be d=
one<br>
by publishing data to a public place - the Bitcoin blockchain - allowing<br=
>
detection of the intrusion.<br>
<br>
The simplest way to achieve this is with one private key per server, with e=
ach<br>
server associated with one transaction output spendable by that key. Howeve=
r<br>
this isn&#39;t capital efficient if you have multiple servers to protect: i=
f we<br>
have N servers and P bitcoins that we can afford to lose in the compromise,=
 one<br>
key per server gives the intruder only N/P incentive.<br>
<br>
Previously Piete Wuille proposed(1) tree signatures for honeypots, with a<b=
r>
single txout protected by a 1-N tree of keys, with each server assigned a<b=
r>
specific key. Unfortunately though, tree signatures aren&#39;t yet implemen=
ted in<br>
the Bitcoin protocol.<br>
<br>
However with a 2-of-2 multisig and the SIGHASH_SINGLE feature we can implem=
ent<br>
this functionality with the existing Bitcoin protocol using the following<b=
r>
script:<br>
<br>
=C2=A0 =C2=A0 2 &lt;honeypot-pubkey&gt; &lt;distriminator-pubkey&gt; 2 CHEC=
KMULTISIG<br>
<br>
The honeypot secret key is shared among all N servers, and left on them. Th=
e<br>
distriminator secret key meanwhile is kept secret, however for each server =
a<br>
unique signature is created with SIGHASH_SINGLE, paying a token amount to a=
<br>
notification address. For each individual server a pre-signed signature cre=
ated<br>
with the distriminator secret key is then left on the associated server alo=
ng<br>
with the honeypot secret key.<br>
<br>
Recall the SIGHASH_SINGLE flag means that the signature only signs a single=
<br>
transaction input and transaction output; the transaction is allowed to hav=
e<br>
additional inputs and outputs added. This allows the thief to use the honey=
pot<br>
key to construct a claim transaction with an additional output added that p=
ays<br>
an address that they own with the rest of the funds.<br>
<br>
Equally, we could also use SIGHASH_NONE, with the per-server discriminator<=
br>
being the K value used in the pre-signed transaction.<br>
<br>
Note that Jeff Coleman deserves credit as co-inventor of all the above.<br>
<br>
<br>
Censorship Resistance<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
<br>
A potential disadvantage of using non-standard SIGHASH flags is that the<br=
>
transactions involved are somewhat unusual, and may be flagged by<br>
risk analysis at exchanges and the like, a threat to the fungibility of the=
<br>
reward.<br>
<br>
We can improve on the above concept from Todd/Coleman by using a pre-signed=
<br>
standard transaction instead. The pre-signed transaction spends the honeypo=
t<br>
txout to two addresses, a per-server canary address, and a change address. =
The<br>
private key associated with the change addres is also left on the server, a=
nd<br>
the intruder can then spend that change output to finally collect their rew=
ard.<br>
<br>
To any external observer the result looks like two normal transactions crea=
ted<br>
in the process of someone with a standard wallet sending a small amount of<=
br>
funds to an address, followed by sending a larger amount.<br>
<br>
<br>
Doublespending<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
<br>
A subtlety in the the two transactions concept is that the intruder doesn&#=
39;t<br>
have the necessary private keys to modify the first transaction, which mean=
s<br>
that the honeypot owner can respond to the compromise by doublespending tha=
t<br>
transaction, potentially recovering the honeypot while still learning about=
 the<br>
compromise. While this is possible with all honeypots, if the first transac=
tion<br>
is signed with the opt-in RBF flags, and CPFP-aware transaction replacement=
 is<br>
not implemented by miners, the mechanics are particularly disadvantageous t=
o<br>
the intruder, as the honeypot owner only needs to increase the first<br>
transaction&#39;s fee slightly to have a high chance of recovering their fu=
nds.<br>
With CPFP-aware transaction replacement the intruder could in-turn respond =
with<br>
a high-fee CPFP second transaction, but currently no such implementation is=
<br>
known.<br>
<br>
<br>
Scorched Earth<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
<br>
We can use the &quot;scorched earth&quot; concept to improve the credibilit=
y of the<br>
honeypot reward by making it costly for the honeypot owner to doublespend. =
Here<br>
a second version of the honeypot pre-signed transaction would also be provi=
ded<br>
which sepnds the entirety of the honeypot output to fees, and additionally<=
br>
spends a second output to fees. An economically rational intruder will publ=
ish<br>
the first version, which maximizes the funds they get out of the honeypot. =
If<br>
the owner tries to dishonestly doublespend, they can respond by publishing =
the<br>
&quot;scorched earth&quot; transaction, encouraging the honeypot owner&#39;=
s honesty and<br>
making CPFP-aware transaction replacement irrelevant.<br>
<br>
Of course, miner centralization adds complexity to the above: in many insta=
nces<br>
honeypot owners and/or intruders will be able to recover funds from altruis=
tic<br>
miners. Equally, the additional complexity may discourage intruders from ma=
king<br>
use of the honeypot entirely.<br>
<br>
Note that as an implementation consideration CHECKSEQUENCEVERIFY can be use=
d to<br>
ensure the honeypot output can only be spent with transaction replacement<b=
r>
enabled, as CSV requires nSequence to be set in specific ways in any transa=
tion<br>
spending the output.<br>
<br>
<br>
References<br>
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D<br>
<br>
1) <a href=3D"https://blockstream.com/2015/08/24/treesignatures/" rel=3D"no=
referrer" target=3D"_blank">https://blockstream.com/2015/08/24/treesignatur=
es/</a><br>
<br>
--<br>
<a href=3D"https://petertodd.org" rel=3D"noreferrer" target=3D"_blank">http=
s://petertodd.org</a> &#39;peter&#39;[:-1]@<a href=3D"http://petertodd.org"=
 rel=3D"noreferrer" target=3D"_blank">petertodd.org</a><br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div></div>

--001a114a8388f49447053adc85f4--