MIME-Version: 1.0
References: <CABT1wW=X35HRVGuP-BHUhDrkBEw27+-iDkNnHWjRU-1mRkn0JQ@mail.gmail.com>
 <CABT1wW=KWtoo6zHs8=yUQ7vAYcFSdAzdpDJ9yfw6sJrLd6dN5A@mail.gmail.com>
 <20200628121517.f3l2mjcy7x4566v3@ganymede>
 <WYQRrIi65yvBWc9qsqCxHWadrMFtYPh2wI-IzVS15FBTFmpIXqHwj5yrj3Igpr-9sKygWsH4DkI_maWcULKKQb51Xp_xZBvKuPF_HmCvqb4=@protonmail.com>
 <CAAifmATmQSUUsEbouVYTNNMu-BT8vQiGvh3jwLNK4CUB11s7mg@mail.gmail.com>
 <Fh70O0CqbkbLaOUEqRzIG3MOOZi_tYz69xRDPlIlF5tgTIPdYF9LyeoJjypo-agN9-WkuoXJD896R6CQygTozeHA_CFULp3k7007PioaDrs=@protonmail.com>
In-Reply-To: <Fh70O0CqbkbLaOUEqRzIG3MOOZi_tYz69xRDPlIlF5tgTIPdYF9LyeoJjypo-agN9-WkuoXJD896R6CQygTozeHA_CFULp3k7007PioaDrs=@protonmail.com>
From: Tejaswi Nadahalli <nadahalli@gmail.com>
Date: Thu, 2 Jul 2020 14:22:51 +0200
Message-ID: <CAAifmARxvG+_Wo3zba6MCd=jxwesb2JhWAwRErq6QPVTe1AQEA@mail.gmail.com>
To: ZmnSCPxj <ZmnSCPxj@protonmail.com>
Content-Type: multipart/alternative; boundary="000000000000490db305a97478cf"
Cc: Matan Yehieli <matany@campus.technion.ac.il>,
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>,
 Itay Tsabary <sitay@campus.technion.ac.il>
Subject: Re: [bitcoin-dev] MAD-HTLC
Precedence: list

--000000000000490db305a97478cf
Content-Type: text/plain; charset="UTF-8"

On Wed, Jul 1, 2020 at 6:58 PM ZmnSCPxj <ZmnSCPxj@protonmail.com> wrote:

> And your paper posits that if a miner is weak, its best strategy is to
> take the myopic strategy and include the currently-valid Alice transaction.
>

Yes. The proof is quite trivial and follows from the definition of weak: if
the myopic miner's hashpower percentage is p_i, and it's lower than f/b,
that means that f > b*p_i. By including the currently-valid Alice
transaction, the myopic miner could make f, which is higher than their
expected gain, which is b*p_i. The myopic miner has a p_i chance of mining
the first block when Bob's transaction becomes valid, and it's most likely
to stay valid for just 1 block, as every miner would want that immediately
when it gets valid. This is where we disagree with the MAD-HTLC paper. They
assume that there are not any miners with sub-1% hashrate around. We find
that there are many such miners, and with channel_reserve_satoshi set to 1%
of the channel value, Alice can bump her fees to at least 1% of the channel
value without worry (because she will get Bob's channel_reserve_satoshi's
for herself if Bob is cheating by releasing a previous commitment TXN).

We additionally also show that when strong miners know that weak miners are
around, some of their strategies get dominated as well, and they will be
forced to include Alice's transaction as well. This, if there is just one
*known* weak miner, things are good for Alice. As an FYI, in our paper
Alice is the cheater and Bob is the victim. There were reasons to "reverse
the convention", so to speak - but that's for another day :-)


>
> Thus, if Alice even *matches* Bob, it seems to me that this ratio f / b is
> 1.0 implying a miner can only be powerful if it has already 51%-attacked
> Bitcoin (which tends to invalidate all our security assumptions of
> higher-layer protocols anyway, since a 51% attacker can censor anything
> with impunity).
>

We assume that Bob will bribe with the entire channel value - because he
has received commensurate goods and services off-chain. So, Alice will find
it difficult to match Bob's bribe, but she doesn't have to.


>
> Of course, Bob can offer up to the entire fund amount, for free, to miners
> as a bribe, without loss to Bob.
>

Yes. Precisely.


>
> For more realistic scenarios where no miner has 100% hashrate, then Alice
> can make all miners weak by being willing to pay up to 50% of the fund as
> fee, as a miner that achieves greater than 50% hashrate share would already
> effectively pwnzored Bitcoin and gained UNLIMITED POWAH anyway.
>

But she doesn't have to go as far as 50%. Just 1% seems quite reasonable,
given a reasonable timelock. We have a closed form solution for the
timelock T as well. In Lightning's case, with 1% channel_reserve_satoshis
around, we arrive at T = 316, which is much longer than the current default
of 144.


>
> So it looks to me that scorched-earth is a possible mitigation against
> this attack.
>

I don't follow this. We show that a reasonable value of fees and timelock
are enough to avoid the attack. Why scorch the earth?

--000000000000490db305a97478cf
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr">On Wed, Jul 1, 2020 at 6:58 PM ZmnSCPxj &=
lt;<a href=3D"mailto:ZmnSCPxj@protonmail.com">ZmnSCPxj@protonmail.com</a>&g=
t; wrote:<br></div><div class=3D"gmail_quote"><blockquote class=3D"gmail_qu=
ote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,20=
4);padding-left:1ex">And your paper posits that if a miner is weak, its bes=
t strategy is to take the myopic strategy and include the currently-valid A=
lice transaction.<br></blockquote><div><br></div><div>Yes. The proof is qui=
te trivial and follows from the definition of weak: if the myopic miner&#39=
;s hashpower percentage is p_i, and it&#39;s lower than f/b, that means tha=
t f &gt; b*p_i. By including the currently-valid Alice transaction, the myo=
pic miner could make f, which is higher than their expected gain, which is =
b*p_i. The myopic miner has a p_i chance of mining the first block when Bob=
&#39;s transaction becomes valid, and it&#39;s most likely to stay valid fo=
r just 1 block, as every miner would want that immediately when it gets val=
id. This is where we disagree with the MAD-HTLC paper. They assume that the=
re are not any miners with sub-1% hashrate around. We find that there are m=
any such miners, and with channel_reserve_satoshi set to 1% of the channel =
value, Alice can bump her fees to at least 1% of the channel value without =
worry (because she will get Bob&#39;s channel_reserve_satoshi&#39;s for her=
self if Bob is cheating by releasing a previous commitment TXN).</div><div>=
<br></div><div>We additionally also show that when strong miners know that =
weak miners are around, some of their strategies get dominated as well, and=
 they will be forced to include Alice&#39;s transaction as well. This, if t=
here is just one *known* weak miner, things are good for Alice. As an FYI, =
in our paper Alice is the cheater and Bob is the victim. There were reasons=
 to &quot;reverse the convention&quot;, so to speak - but that&#39;s for an=
other day :-)</div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=
=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding=
-left:1ex">
<br>
Thus, if Alice even *matches* Bob, it seems to me that this ratio f / b is =
1.0 implying a miner can only be powerful if it has already 51%-attacked Bi=
tcoin (which tends to invalidate all our security assumptions of higher-lay=
er protocols anyway, since a 51% attacker can censor anything with impunity=
).<br></blockquote><div><br></div><div>We assume that Bob will bribe with t=
he entire channel value - because he has received commensurate goods and se=
rvices off-chain. So, Alice will find it difficult to match Bob&#39;s bribe=
, but she doesn&#39;t have to.=C2=A0</div><div>=C2=A0</div><blockquote clas=
s=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid r=
gb(204,204,204);padding-left:1ex">
<br>
Of course, Bob can offer up to the entire fund amount, for free, to miners =
as a bribe, without loss to Bob.<br></blockquote><div><br></div><div>Yes. P=
recisely.</div><div>=C2=A0</div><blockquote class=3D"gmail_quote" style=3D"=
margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-lef=
t:1ex">
<br>
For more realistic scenarios where no miner has 100% hashrate, then Alice c=
an make all miners weak by being willing to pay up to 50% of the fund as fe=
e, as a miner that achieves greater than 50% hashrate share would already e=
ffectively pwnzored Bitcoin and gained UNLIMITED POWAH anyway.<br></blockqu=
ote><div><br></div><div>But she doesn&#39;t have to go as far as 50%. Just =
1% seems quite reasonable, given a reasonable timelock. We have a closed fo=
rm solution for the timelock T as well. In Lightning&#39;s case, with 1% ch=
annel_reserve_satoshis around, we arrive at T =3D 316, which is much longer=
 than the current default of 144.=C2=A0</div><div>=C2=A0</div><blockquote c=
lass=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px soli=
d rgb(204,204,204);padding-left:1ex">
<br>
So it looks to me that scorched-earth is a possible mitigation against this=
 attack.<br></blockquote><div><br></div><div>I don&#39;t follow this. We sh=
ow that a reasonable value of fees and timelock are enough to avoid the att=
ack. Why scorch the earth?</div></div></div>

--000000000000490db305a97478cf--