Delivery-date: Wed, 27 Mar 2024 05:58:31 -0700
Sender: bitcoindev@googlegroups.com
Received-SPF: pass (google.com: domain of pete@petertodd.org designates 64.147.123.152 as permitted sender) client-ip=64.147.123.152;
Feedback-ID: i525146e8:Fastmail
Date: Wed, 27 Mar 2024 12:54:54 +0000
From: Peter Todd <pete@petertodd.org>
To: Antoine Riard <antoine.riard@gmail.com>
Cc: "David A. Harding" <dave@dtrt.org>, bitcoindev@googlegroups.com
Subject: Re: [bitcoindev] A Free-Relay Attack Exploiting RBF Rule #6
Message-ID: <ZgQXHpraCWeEyDKe@petertodd.org>
References: <Zfg/6IZyA/iInyMx@petertodd.org>
 <012f89763cc336cd91eec13dccefc921@dtrt.org>
 <CALZpt+HNiwie1RNJOi9WJs-F2=YSvFdwCDfdNDuTdUuSf_kTBg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha512;
	protocol="application/pgp-signature"; boundary="UljpBEO4e1Hy/v0+"
Content-Disposition: inline
In-Reply-To: <CALZpt+HNiwie1RNJOi9WJs-F2=YSvFdwCDfdNDuTdUuSf_kTBg@mail.gmail.com>
Precedence: list
Mailing-list: list bitcoindev@googlegroups.com; contact bitcoindev+owners@googlegroups.com


--UljpBEO4e1Hy/v0+
Content-Type: text/plain; charset="UTF-8"
Content-Disposition: inline

On Wed, Mar 27, 2024 at 06:27:47AM +0000, Antoine Riard wrote:
> Hi Dave,
> 
> > Could you tell us more about the disclosure process you followed?  I'm
> > surprised to see it disclosed without any apparent attempt at patching.
> > I'm especially concerned given your past history of publicly revealing
> > vulnerabilities before they could be quietly patched[1] and the conflict
> > of interest of you using this disclosure to advocate for a policy change
> > you are championing.
> 
> In defense of Peter, I don't think there is a low-hanging fruit that could
> have
> been landed easily in Bitcoin Core. The most obvious ones could have been
> a) to reduce `MAX_STANDARD_TX_WEIGHT` or b) a new rule
> `max_replacement_bandwidth`
> or c) a new absolute-fee based penalty on bandwidth replacement cost.

To be clear, I _did_ disclose the issue on bitcoin-security and no-one had any
objections to disclosing it publicly.

> All hard to integrate in a covert fashion without attracting some attention
> from the
> community, which would certainly ask why we're changing the marginal
> bandwidth cost.
> Potentially, impacting unfavorably some use-cases.
> 
> Certainly, Peter's report could have integrated a disclosure timeline at the
> example of CVE-2018-17144 [0], which I can recommend to anyone to follow
> doing
> security research or servicing as a security point of contact in our field.

Since this attack is just a relatively minor extension of existing, publicly
disclosed, attacks, I don't think there was any need for formal disclosure
timelines. It's interesting that the attack exists; it does not substantially
change the status quo.

I don't believe the other attacks in this attack class are even possible to
fix. We just have to live with the fact that a degree of free relay is always
going to be possible.

> I don't see the conflict of interest in the present disclosure ? It is
> public information
> that Peter is championing RBFR [1].  I'm not aware of any private interest
> unfavorably
> influencing Peter's behavior in the conduct of this security issue
> disclosure.

Well, there is a conflict of interest in trying to keep this issue under wraps:
Replace-By-Fee-Rate benefits from public discussion of the fact that many
different free-relay attacks are possible. The arguments against RBFR mainly
hinge on the idea that free-relay is preventable.

-- 
https://petertodd.org 'peter'[:-1]@petertodd.org

-- 
You received this message because you are subscribed to the Google Groups "Bitcoin Development Mailing List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to bitcoindev+unsubscribe@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/bitcoindev/ZgQXHpraCWeEyDKe%40petertodd.org.

--UljpBEO4e1Hy/v0+
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE0RcYcKRzsEwFZ3N5Lly11TVRLzcFAmYEFx0ACgkQLly11TVR
LzeG/xAAvH2bVpyiRYEoEei4Jx6avGNmz/RNmoCHHwuKA5buo6a+D6mO6UeEfDDL
hdHDEt0GCgQFfFnI3re6dN2cqDx3bFmV5K3dloVI6TWNwjM3haqCEcAFZj8ks1qb
Aq0i6O728719vALKnilgIHQ5X6N5/dgaR5CKKBiSW0kh5MU5A+dSsIflCH8lrSkO
0996S2W1a9eaU64TJXAAlIR1FylXBm9HSHxaXPvYQ1cspbFXtDfUB1OAZ5I7NGPD
8gf6SGWARo6sXpjlNIAPkR7sAXCAawvwzB/wWnI1bH6JVv5KpAotdwtxm/AWknov
TJ0GFspVfEul8igny83OPi3reTREnhfFDIFmqnVTwcCqOfbOjZeF8TpRhexhJc//
ZZ2tpVwHMex1LEKHJ1S0VnMV+ns/cgHFvSPMF2gBmKdHWsty2xRLJtJun5X7ETec
GxH2ZL5UoYPmjkeyePOnScO0QxHbi28i9MJFrYiNmh3voCUOxIWvtQk16EcUwC9t
KyGK6G2p97yXi5c6RaSCOiCiqZhVr46RA0ez+Bt5YLH9+HCyiHMnhQn9NVdAcS9E
aZBTM27Dy/xpC7gmMiIXK3sTh3QobXMW3mQdlgGUqQeu23vtkARhA4ZQgFwfKn4a
oSFIaaakUvFziS4ZJSElhjt/6RFD8nY33SPrC4SohQVY2Ed+6lA=
=eH9y
-----END PGP SIGNATURE-----

--UljpBEO4e1Hy/v0+--