MIME-Version: 1.0
References: <a09f5291-e7c0-0aca-6971-03ace0c38dff@mattcorallo.com>
 <20200422182454.3y3foxxhiovokovp@ganymede>
In-Reply-To: <20200422182454.3y3foxxhiovokovp@ganymede>
From: Antoine Riard <antoine.riard@gmail.com>
Date: Wed, 22 Apr 2020 15:03:29 -0400
Message-ID: <CALZpt+HHJ6rKJK8FBdJ1gznWDsfkUo26rOy=mNLbvMwicv9muQ@mail.gmail.com>
To: "David A. Harding" <dave@dtrt.org>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="00000000000071757205a3e5caba"
Subject: Re: [bitcoin-dev] RBF Pinning with Counterparties and Competing
	Interest
Precedence: list

--00000000000071757205a3e5caba
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

> In that case, would it be worth re-implementing something like a BIP61
reject message but with an extension that returns the txids of any
conflicts?

That's an interesting idea, but an attacker can create a local conflict in
your mempool
and then send the preimage tx to make hit recentRejects until next tip so
when the rejection code with conflict is received transaction isn't going
to be fetched.
Of course you can make an exception for this, but seems a DoS vector...

And also if you have a private full-node and connect only to 8 outbounds,
an attacker
can do a bit of tx-relay topology discovery and blind your tx-relay peers
too...

I think p2p/mempool hardening measures will only make attack harder but not
erase it, we
should avoid tie too much the security model of Lightning on a given p2p
topology. If you don't
do manual peering (whitelist,addnode), this one may change without
visibility (like stale tip).


Le mer. 22 avr. 2020 =C3=A0 14:25, David A. Harding via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> a =C3=A9crit :

> On Mon, Apr 20, 2020 at 10:43:14PM -0400, Matt Corallo via Lightning-dev
> wrote:
> > A lightning counterparty (C, who received the HTLC from B, who
> > received it from A) today could, if B broadcasts the commitment
> > transaction, spend an HTLC using the preimage with a low-fee,
> > RBF-disabled transaction.  After a few blocks, A could claim the HTLC
> > from B via the timeout mechanism, and then after a few days, C could
> > get the HTLC-claiming transaction mined via some out-of-band agreement
> > with a small miner. This leaves B short the HTLC value.
>
> IIUC, the main problem is honest Bob will broadcast a transaction
> without realizing it conflicts with a pinned transaction that's already
> in most node's mempools.  If Bob knew about the pinned transaction and
> could get a copy of it, he'd be fine.
>
> In that case, would it be worth re-implementing something like a BIP61
> reject message but with an extension that returns the txids of any
> conflicts?  For example, when Bob connects to a bunch of Bitcoin nodes
> and sends his conflicting transaction, the nodes would reply with
> something like "rejected: code 123: conflicts with txid 0123...cdef".
> Bob could then reply with a a getdata('tx', '0123...cdef') to get the
> pinned transaction, parse out its preimage, and resolve the HTLC.
>
> This approach isn't perfect (if it even makes sense at all---I could be
> misunderstanding the problem) because one of the problems that caused
> BIP61 to be disabled in Bitcoin Core was its unreliability, but I think
> if Bob had at least one honest peer that had the pinned transaction in
> its mempool and which implemented reject-with-conflicting-txid, Bob
> might be ok.
>
> -Dave
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--00000000000071757205a3e5caba
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div><div><div>&gt; In that case, would it be worth re-imp=
lementing something like a BIP61<br>
reject message but with an extension that returns the txids of any<br>
conflicts?<br><br></div>That&#39;s an interesting idea, but an attacker can=
 create a local conflict in your mempool<br></div>and then send the preimag=
e tx to make hit recentRejects until next tip so</div><div>when the rejecti=
on code with conflict is received transaction isn&#39;t going to be fetched=
.<br></div><div>Of course you can make an exception for this, but seems a D=
oS vector...<br><br></div><div>And also if you have a private full-node and=
 connect only to 8 outbounds, an attacker</div><div>can do a bit of tx-rela=
y topology discovery and blind your tx-relay peers too...<br><br></div><div=
>I think p2p/mempool hardening measures will only make attack harder but no=
t erase it, we<br></div><div>should avoid tie too much the security model o=
f Lightning on a given p2p topology. If you don&#39;t</div><div>do manual p=
eering (whitelist,addnode), this one may change without visibility (like st=
ale tip).<br></div><br><div><br></div></div><br><div class=3D"gmail_quote">=
<div dir=3D"ltr" class=3D"gmail_attr">Le=C2=A0mer. 22 avr. 2020 =C3=A0=C2=
=A014:25, David A. Harding via bitcoin-dev &lt;<a href=3D"mailto:bitcoin-de=
v@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>&gt; =
a =C3=A9crit=C2=A0:<br></div><blockquote class=3D"gmail_quote" style=3D"mar=
gin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1=
ex">On Mon, Apr 20, 2020 at 10:43:14PM -0400, Matt Corallo via Lightning-de=
v wrote:<br>
&gt; A lightning counterparty (C, who received the HTLC from B, who<br>
&gt; received it from A) today could, if B broadcasts the commitment<br>
&gt; transaction, spend an HTLC using the preimage with a low-fee,<br>
&gt; RBF-disabled transaction.=C2=A0 After a few blocks, A could claim the =
HTLC<br>
&gt; from B via the timeout mechanism, and then after a few days, C could<b=
r>
&gt; get the HTLC-claiming transaction mined via some out-of-band agreement=
<br>
&gt; with a small miner. This leaves B short the HTLC value.<br>
<br>
IIUC, the main problem is honest Bob will broadcast a transaction<br>
without realizing it conflicts with a pinned transaction that&#39;s already=
<br>
in most node&#39;s mempools.=C2=A0 If Bob knew about the pinned transaction=
 and<br>
could get a copy of it, he&#39;d be fine.<br>
<br>
In that case, would it be worth re-implementing something like a BIP61<br>
reject message but with an extension that returns the txids of any<br>
conflicts?=C2=A0 For example, when Bob connects to a bunch of Bitcoin nodes=
<br>
and sends his conflicting transaction, the nodes would reply with<br>
something like &quot;rejected: code 123: conflicts with txid 0123...cdef&qu=
ot;.<br>
Bob could then reply with a a getdata(&#39;tx&#39;, &#39;0123...cdef&#39;) =
to get the<br>
pinned transaction, parse out its preimage, and resolve the HTLC.<br>
<br>
This approach isn&#39;t perfect (if it even makes sense at all---I could be=
<br>
misunderstanding the problem) because one of the problems that caused<br>
BIP61 to be disabled in Bitcoin Core was its unreliability, but I think<br>
if Bob had at least one honest peer that had the pinned transaction in<br>
its mempool and which implemented reject-with-conflicting-txid, Bob<br>
might be ok.<br>
<br>
-Dave<br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div>

--00000000000071757205a3e5caba--