To: bitcoin-dev@lists.linuxfoundation.org
References: <985792b1-e7aa-677b-a7a1-6a5f672da884@riseup.net>
	<94534006-D560-4C90-9D5D-A3A64B698518@gmail.com>
	<20190726143738.0be561da@simplexum.com>
	<3c328312-2bdd-60d9-7425-8db620d09abb@riseup.net>
	<20190731205018.10ed4302@simplexum.com>
	<ae32dcbb-c950-3b3f-22b9-d152d6b221cb@riseup.net>
	<20190802145057.7b81c597@simplexum.com>
	<ad501873-8912-765e-8df5-c9b0451fcd0a@riseup.net>
From: Leo Wandersleb <leo@LeoWandersleb.de>
Openpgp: id=FAE4D5168E9EF9F104AA1B2D6B9A1F0CB7C20812
Autocrypt: addr=leo@LeoWandersleb.de; prefer-encrypt=mutual; keydata=
	mQENBE3ePdoBCADZmTvPyledh9wmNRE+i5k7dUmegSmBpe1kMgzlt3nxwzyE6l3wzT9wen8E
	clmA4ZCLn77DjxF3Dg9X0sRio9No5r4u6luI0CzM7axvTi+5DWU25b+JGGdhKTMkyfyKBZdT
	4xvjLzW9tT7upUuAh9nTcz9MBZS3vhKB1SqiBUdYqj33+2erIQzaYMIZ/crR6FbgDT5dI3gg
	2YKJn4rdFy9saA0qngoDPkyU9u5TYtFk8zOreQrFXmXpLiptoxRolF9tqHyn51H4uV8ggIGc
	xJWRW/i2vBFHSM6ZD7PceWCRU5ehf3h/wat1xtn/H7AB+wcywkYrdg1TLifftwcKYBlzABEB
	AAG0JUxlbyBXYW5kZXJzbGViIDxMZW9ATGVvV2FuZGVyc2xlYi5kZT6JATgEEwECACIFAk3e
	PdoCGwMGCwkIBwMCBhUIAgkKCwQWAgMBAh4BAheAAAoJEGuaHwy3wggSrqQH/Amh6+kYnIUM
	8X5yicpXd37h/Nqnrs6KIE0nYCZe03tkQytndbWXmf2pBth6CEzqrS+wivU7L8dPdiFQtdEW
	dDe8bjJ993TsVSyYrPHv549vD4DbjtB8WS7KEkMhhl+uVaC07YXNwOTAkshv4l3G2ll6dmBn
	LDeF8kSU+DZ1eNzUYHjuUcQYl0XAK5wE7rVpzZUlR0Z5bKNm8QmUPgrZPu6cVRZ6tOD0EMR6
	3dcGI5x0fB35gEUasgNYxQ/g2arh66Pg45olKT1bTcrTJYrE8IePElSCIFDrzrZMhStY3TbQ
	qI3T0vsFGzEeU9M6LmKV8aii4g8o7af0kr4vYS3Nsp65AQ0ETd492gEIAMnahwe+MNliWgpF
	B+UfrwzfgiLjtizH307HYB67THS4h2+MoBJUAqrV7CQkZ8kMYLBl4D+hvxrXDYte6wTb0kcY
	X4NTGof8EDBPxUERYJlWbTbLccbA8d3ia++aTtqd9yRHobK8AO4R22cslYV/nQChHc+1/NFV
	8V1O67U7XpnxQMUzYIhhvVcUwj+8bw/F3zPzS03PWnDv+gmwHt63w72Dth+P0F93/rI+OiEA
	kC/7//1ngQ7auqOeWVdqR8Z1s7tI4kxsVkJfqj3wVu+qaso8FpjNGs888xH8xhgXlll8APWj
	V9Rl3GtpRTdobzNh58jUfGmHh5bcRrYTrtldDwkAEQEAAYkBHwQYAQIACQUCTd492gIbDAAK
	CRBrmh8Mt8IIEi3MB/0UlpEORi7qBOH9egn/8E9fXj3QGpmQ7IAvzvLjkp3cArerBhObhGJ+
	lZ679/9KZ4FxWLDStzGJH3thQstZjcUZzLwTP1sNdY+uPkvOqrzclfPK13z5hJhORD8W0brB
	UptTvyZthIxNIbY4uSbrvaAJmcPFi3cdKOjZz9XyH8AAxXcWGUjQuqxEc0GuM8h8asaUJesB
	bE4J+HPZXcAOC3D+qIqvM438Nbb8Pu7yYWrdq5kmbDMg2nPHXUOOovEsXWBGjWEiXWVUei75
	5Fumqg5mz4P8/Ry3DwZBuHN3Op77gXogvyeE/B5O6dZzWWpSqBIS6MQcLD1divwi/2vNS4c4
Message-ID: <3a9a9277-130d-fbb2-fa51-6119a2242812@LeoWandersleb.de>
Date: Tue, 6 Aug 2019 13:51:02 +1200
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
	Thunderbird/60.8.0
MIME-Version: 1.0
In-Reply-To: <ad501873-8912-765e-8df5-c9b0451fcd0a@riseup.net>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
Content-Language: en-US
Subject: Re: [bitcoin-dev] Improving JoinMarket's resistance to sybil
 attacks using fidelity bonds
Precedence: list

On 8/6/19 7:04 AM, Chris Belcher via bitcoin-dev wrote:
> However, there _is_ a cost to being a sybil attacker. If we define
> honest makers as entities who run just one maker bot, and dishonest
> makers as entities who run multiple maker bots, then we can say that
> running a dishonest maker operation requires a sacrifice of fee income,
> because someone doing that would earn more money if they ran an honest
> maker instead. This happens because of the quadratic V^2 term in the
> formula calculating the fidelity bond value, which provides this
> incentive for lumping together fidelity bonds. This V^2 is probably the
> most important part for privacy.

As established above, there will emerge a market to lock coins, so these locks
will be readily available without having to buy them. Even with V^2 there is no
reason to amass more coins beyond a certain point. Running the biggest 5 V^2
scores should be pretty solid to get in on many coin joins.

> Another way is to require the bond signature proofs to involve the
> one-time taker identifier, and so be different every time. This
> basically requires fidelity bond privkeys to be online in hot wallets,
> and so should massively increase the difficulty of renting TXOs because
> the maker and the TXO owner need to be in constant real-time communication.

Requiring the bond to reside on a hot wallet would be a massive disadvantage.

No matter how you look at the whole problem of sibyl attacks, the honest maker
will have operational costs and gain fees and the sibyl attacker will have the
same plus profit from the deanonymization. As long as makers hunt marginal
profits, the sibyl attacker having the higher margin from deanonymization will
always win. The fidelity bonds would make this even worse, as increased
complexity and entry cost would not favor more makers but less even before the
centralization incentive mentioned above (V^2). To say that old holders have
bitcoins laying around that they can use for such bonds is a fallacy as they
could just as well rent them out on a bonds market.

How about turning this upside down and shift the incentives from being taker to
being maker by introducing a mandatory fee? If each join costs 1% per maker,
people would initially gasp and reject to update to that version but those who
do, will do to become makers, increasing the maker count massively and
eventually most people in frequent need of joining will also become makers to
offset the costs of being takers.

With these changed rules again the sibyl attackers would still have their
competitive edge and would flood the market with even more cheap offers but now
everybody would have an incentive to do the same and as makers have to have the
UTXOs, it's not free to sibyl attack already.

LW