To: Pieter Wuille <bitcoin-dev@wuille.net>, Bitcoin Protocol Discussion
 <bitcoin-dev@lists.linuxfoundation.org>
References: <MqZttWy--3-2@tutanota.de>
 <1fbf0ef8b1b42979361b5df0b09c2dcd@willtech.com.au>
 <dSBrti8VFr0lMNgTHw8pD-mAPLm0E4auJa234o0FNY67EUuEy1Dfb93INNIzoUb3j2dWSJjZtG7qncci1LhKAHOXzAzbEWOtXjnggr19J6w=@wuille.net>
From: Aymeric Vitte <aymeric@peersm.com>
Message-ID: <86d49c80-2f8f-245c-5fdb-17c6ca6b5f2b@peersm.com>
Date: Sun, 12 Dec 2021 12:48:18 +0100
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101
 Thunderbird/45.4.0
MIME-Version: 1.0
In-Reply-To: <dSBrti8VFr0lMNgTHw8pD-mAPLm0E4auJa234o0FNY67EUuEy1Dfb93INNIzoUb3j2dWSJjZtG7qncci1LhKAHOXzAzbEWOtXjnggr19J6w=@wuille.net>
Content-Type: multipart/alternative;
 boundary="------------35852C7439EE128664E0EF4B"
Subject: Re: [bitcoin-dev] Rebroadcast mechanism in Bitcoin P2P network
Precedence: list

--------------35852C7439EE128664E0EF4B
Content-Type: text/plain; charset="windows-1252"
Content-Transfer-Encoding: quoted-printable

Indeed, I reiterate that using the Tor network for Bitcoin or whatever
protocol not related to the Tor Browser (ie browsing and HS) does not
make sense, for plenty of reasons

But using the Tor protocol outside of the Tor network (and inside
browsers for wallets for example) does:
https://github.com/Ayms/node-Tor#presentation and
https://github.com/Ayms/node-Tor#phase-4-and-phase-5, anonymizing nodes
can just be already existing bitcoin nodes, example:
https://github.com/bitcoin/bitcoin/pull/18988#issuecomment-646564853


Le 11/12/2021 =E0 17:21, Pieter Wuille via bitcoin-dev a =E9crit :
>> It is that the solution to privacy is to use privacy-enhancing network=

>> communications, such as TOR. I am not against a mechanism to rebroadca=
st
>> transactions more robustly if the mempool of adjoining nodes has
>> forgotten about them, but the truth is, all transactions originate fro=
m
>> some node, and there are methods that allow an individual node to be
>> identified as the likely source of a transaction unless privacy-enable=
d
>> networks are utilised. Having a different method to cause rebroadcast
>> does not obfuscate the origin.
> You're talking about distinct aspects of transaction privacy.
>
> The rebroadcasting approach as it exists on the network, where wallets =
are responsible for their own rebroadcasting, directly reveals to your pe=
ers a relation between nodes and transactions: whenever any node relays t=
he same transaction twice, it almost certainly implies they are the origi=
n.
>
> This is just a node-transaction relation, and not necessarily IP-transa=
ction relation. The latter can indeed be avoided by only connecting over =
Tor, or using other privacy networks, but just hiding the relation with I=
P addresses isn't sufficient (and has its own downsides; e.g. Tor-only co=
nnectivity is far more susceptible to partition/Eclipse/DoS attacks). For=
 example seeing the same node (even without knowing its IP) rebroadcast t=
wo transaction lets an observe infer a relation between those transaction=
s, and that too is a privacy leak.
>
> I believe moving to a model where mempools/nodes themselves are respons=
ible for rebroadcasting is a great solution to improving this specific pr=
oblem, simply because if everyone rebroadcasts, the original author doing=
 it too does not stand out anymore. It isn't "fixing privacy", it's fixin=
g a specific leak, one of many, but this isn't a black and white property=
=2E
>
> Cheers,
>
> --
> Pieter
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev


--------------35852C7439EE128664E0EF4B
Content-Type: text/html; charset="windows-1252"
Content-Transfer-Encoding: 8bit

<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <p>Indeed, I reiterate <span class="VIiyi" jsaction="mouseup:BR6jm"
        jsname="jqKxS" lang="en"><span
jsaction="agoMJf:PFBcW;usxOmf:aWLT7;jhKsnd:P7O7bd,F8DmGf;Q4AGo:Gm7gYd,qAKMYb;uFUCPb:pvnm0e,pfE8Hb,PFBcW;f56efd:dJXsye;EnoYf:KNzws,ZJsZZ,JgVSJc;zdMJQc:cCQNKb,ZJsZZ,zchEXc;Ytrrj:JJDvdc;tNR8yc:GeFvjb;oFN6Ye:hij5Wb;bmeZHc:iURhpf;Oxj3Xe:qAKMYb,yaf12d"
          jsname="txFAF" class="JLqJ4b ChMk0b"
          data-language-for-alternatives="en"
          data-language-to-translate-into="fr" data-phrase-index="0"
          data-number-of-phrases="1" jscontroller="Zl5N8"
          jsdata="uqLsIf;_;$58" jsmodel="SsMkhd"><span
            jsaction="click:qtZ4nf,GFf3ac,tMZCfe;
            contextmenu:Nqw7Te,QP7LD; mouseout:Nqw7Te;
            mouseover:qtZ4nf,c2aHje" jsname="W297wb">that using the Tor
            network for Bitcoin or whatever protocol not related to the
            Tor Browser (ie browsing and HS) does not make sense, for
            plenty of reasons</span></span></span></p>
    <p><span class="VIiyi" jsaction="mouseup:BR6jm" jsname="jqKxS"
        lang="en"><span
jsaction="agoMJf:PFBcW;usxOmf:aWLT7;jhKsnd:P7O7bd,F8DmGf;Q4AGo:Gm7gYd,qAKMYb;uFUCPb:pvnm0e,pfE8Hb,PFBcW;f56efd:dJXsye;EnoYf:KNzws,ZJsZZ,JgVSJc;zdMJQc:cCQNKb,ZJsZZ,zchEXc;Ytrrj:JJDvdc;tNR8yc:GeFvjb;oFN6Ye:hij5Wb;bmeZHc:iURhpf;Oxj3Xe:qAKMYb,yaf12d"
          jsname="txFAF" class="JLqJ4b ChMk0b"
          data-language-for-alternatives="en"
          data-language-to-translate-into="fr" data-phrase-index="0"
          data-number-of-phrases="1" jscontroller="Zl5N8"
          jsdata="uqLsIf;_;$58" jsmodel="SsMkhd"><span
            jsaction="click:qtZ4nf,GFf3ac,tMZCfe;
            contextmenu:Nqw7Te,QP7LD; mouseout:Nqw7Te;
            mouseover:qtZ4nf,c2aHje" jsname="W297wb">But using the Tor
            protocol outside of the Tor network (and inside browsers for
            wallets for example) does:
            <a class="moz-txt-link-freetext" href="https://github.com/Ayms/node-Tor#presentation">https://github.com/Ayms/node-Tor#presentation</a> and
            <a class="moz-txt-link-freetext" href="https://github.com/Ayms/node-Tor#phase-4-and-phase-5">https://github.com/Ayms/node-Tor#phase-4-and-phase-5</a>,
            anonymizing nodes can just be already existing bitcoin
            nodes, example:
            <a class="moz-txt-link-freetext" href="https://github.com/bitcoin/bitcoin/pull/18988#issuecomment-646564853">https://github.com/bitcoin/bitcoin/pull/18988#issuecomment-646564853</a><br>
          </span></span></span></p>
    <br>
    <div class="moz-cite-prefix">Le 11/12/2021 à 17:21, Pieter Wuille
      via bitcoin-dev a écrit :<br>
    </div>
    <blockquote
cite="mid:dSBrti8VFr0lMNgTHw8pD-mAPLm0E4auJa234o0FNY67EUuEy1Dfb93INNIzoUb3j2dWSJjZtG7qncci1LhKAHOXzAzbEWOtXjnggr19J6w=@wuille.net"
      type="cite">
      <blockquote type="cite">
        <pre wrap="">It is that the solution to privacy is to use privacy-enhancing network
communications, such as TOR. I am not against a mechanism to rebroadcast
transactions more robustly if the mempool of adjoining nodes has
forgotten about them, but the truth is, all transactions originate from
some node, and there are methods that allow an individual node to be
identified as the likely source of a transaction unless privacy-enabled
networks are utilised. Having a different method to cause rebroadcast
does not obfuscate the origin.
</pre>
      </blockquote>
      <pre wrap="">
You're talking about distinct aspects of transaction privacy.

The rebroadcasting approach as it exists on the network, where wallets are responsible for their own rebroadcasting, directly reveals to your peers a relation between nodes and transactions: whenever any node relays the same transaction twice, it almost certainly implies they are the origin.

This is just a node-transaction relation, and not necessarily IP-transaction relation. The latter can indeed be avoided by only connecting over Tor, or using other privacy networks, but just hiding the relation with IP addresses isn't sufficient (and has its own downsides; e.g. Tor-only connectivity is far more susceptible to partition/Eclipse/DoS attacks). For example seeing the same node (even without knowing its IP) rebroadcast two transaction lets an observe infer a relation between those transactions, and that too is a privacy leak.

I believe moving to a model where mempools/nodes themselves are responsible for rebroadcasting is a great solution to improving this specific problem, simply because if everyone rebroadcasts, the original author doing it too does not stand out anymore. It isn't "fixing privacy", it's fixing a specific leak, one of many, but this isn't a black and white property.

Cheers,

--
Pieter

_______________________________________________
bitcoin-dev mailing list
<a class="moz-txt-link-abbreviated" href="mailto:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.org</a>
<a class="moz-txt-link-freetext" href="https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev">https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev</a>
</pre>
    </blockquote>
    <br>
    <br>
  </body>
</html>

--------------35852C7439EE128664E0EF4B--