Scaling Bitcoin Milan 2016

Peer-to-Peer Encryption andAuthentication from thePerspective of End-Users_jonasschnelli_
dev@jonasschnelli.chScaling Bitcoin Milan 2016

Simple example how diﬃcult it
is to be aware of end-user
issues…

Scaling Bitcoin Milan 2016

Who of you are using a thinclient (SPV wallet) on yoursmartphone?

Scaling Bitcoin Milan 2016

Who of you on a iOS device?
Have you self-compiled andself-installed the binary?

Scaling Bitcoin Milan 2016

There is no verifiablesecurity-proof or a link
between an app store binary(or an app update) and a
specific state of the code (gitcommit)

Scaling Bitcoin Milan 2016

iOS applications can’t be„hashed“ or verified

Scaling Bitcoin Milan 2016private key storage
mixed with
auto-update
mixed withapp sandboxing
results in„questionable“ trust andsecurity modelScaling Bitcoin Milan 2016

The door to the walk-in vault in the Winona Savings Bank in Winona, Minnesota, United States
CC BY-SA 3.0

Scaling Bitcoin Milan 2016

Lets assume 10’000 users
with a avg. wallet value of
1’000 $.
This results in an attackbounty of 10 million $.

Scaling Bitcoin Milan 2016

But wait!
We have code-signing?
Well,… for what purpose
exactly?

Scaling Bitcoin Milan 2016

Bitcoin scaling focuses mostly
on the core infrastructure,often leaving out the end
users perspective.

Scaling Bitcoin Milan 2016

Running a full node wallet iscurrently „extremely
diﬃcult“ for the novice enduser.

Scaling Bitcoin Milan 2016

Decentralized SPV wallets
are only working onsmartphones because wehave hundreds of full nodeoperators providing
CPU&HDD intensive freeof-charge services.

Scaling Bitcoin Milan 2016

Plus. Almost all „light-clients“
do leak private data (due tobloom filtering).

Scaling Bitcoin Milan 2016

SMTP analogy• It is relatively complex to run your own Mail Server• Most „Mail“ users are no longer directly using SMTP
• SMTP has been extended to death and could probably
seen as a dying out protocol.
• Most novice end-users are using a centralized hosted
mail solution nowadays (resulting in various privacy andsecurity issued)• Encryption has never been made it to an „industrystandard“

Scaling Bitcoin Milan 2016

Make Bitcoin
Great Again!Scaling Bitcoin Milan 2016

Amount of economicalindependent (full)nodes is declining

Missing option tosecurely connectpeers(Connect your thinclient with a trustedfull node)

Missing standard for
hardware wallets
resulting in leaving iOS
in the dark.

End users are more
and more using 2nd
layer applications notdirectly connected withthe p2p network.

Missing standards orcommunication
channels for Multisig.

End users haven't
shifted to the „be-yourown-bank“ security
mindset.

Scaling Bitcoin Milan 2016

Keeping end-users on thep2p network will help
decentralization.
(Or bringing them back)Scaling Bitcoin Milan 2016

A Swiss Bank Account inYour Pocket?

Scaling Bitcoin Milan 2016

Missing option tosecurely connectpeers(Connect your thinclient with your fullnode)

BIP150/151

Scaling Bitcoin Milan 2016

unencrypted,
unauthenticated

Peer

Peer

SPVInternet
PeerScaling Bitcoin Milan 2016

unencrypted,
unauthenticated• Censor outgoing transactions• Hold back blocks/tx• Analyse wallet/behavior(Fingerprinting)

Peer

Peer

SPVInternet
PeerScaling Bitcoin Milan 2016

TrustedPeer

TrustedPeer

Internet

SPVSPVSPVScaling Bitcoin Milan 2016

A Swiss Bank Accessat Home?

Scaling Bitcoin Milan 2016

BitSeedPine64

Odroid-C2~120$

29$

40$

Scaling Bitcoin Milan 2016

Passiv surveillance
Peer
Peer
Peer

Peer
Peer

Scaling Bitcoin Milan 2016

Active surveillance (with BIP151)• Ephemeral key substitution in both directions• Risks being detected• MITM avoidable with BIP150

Peer
Peer

Peer

Peer
Peer

Scaling Bitcoin Milan 2016

Controllable Stack
ChaCha20-Poly1305
Used by openSSH
Widely used by Google

Scaling Bitcoin Milan 2016

Why not openSSL?

Scaling Bitcoin Milan 2016

Related solutions?
stunneli2p

openVPNTor…

Scaling Bitcoin Milan 2016

ChaCha20-Poly1305@openssh

256bit AEAD (stream cipher)• ~300 lines of code
• auditable• fast(er)• no known security weakness•

Scaling Bitcoin Milan 2016

ChaCha20

Scaling Bitcoin Milan 2016

New P2P message structure
4bytes12bytes

4bytes4bytes?

magiccommandlengthchks

payload

SHA256(SHA256())

OLD
NEW?

16byteslengthciphertext payload

MAC tag{

4bytesnvarlen

4bytescommandlengthpayloadinv header old format: 24 bytes
inv header new format: 28 bytes

Scaling Bitcoin Milan 2016

BIP150Fingerprinting free peerauthentication

Scaling Bitcoin Milan 2016

AUTHCHALLENGE
HASH( session_id || „i“ || remote-peers-expected-identity-pubkey )AUTHREPLY
signature( identity_key, session_id )AUTHPROPOSE
HASH( session_id || „p“ || client-identity-pubkey )AUTHCHALLENGE
HASH( session_id || „r“ || client-identity-pubkey )AUTHREPLY
signature( identity_key, session_id )Scaling Bitcoin Milan 2016

Thanks.
Questions?
_jonasschnelli_
dev@jonasschnelli.ch