Tampering with the Delivery of Blocks andTransactions in Bitcoin
Arthur Gervais*, Hubert Ritzdorf*,
Ghassan O. Karame’, Srdjan Capkun**ETH Zurich, ’NEC Laboratories Europe

Scaling Bitcoin Phase 2 - 2015

Decentralized Currencies

Bitcoin

Peer-to-peer decentralized currency

No trusted third parties

Blockchain: distributed DB
Transactions
BlocksBroadcast protocol

2 / 18

Broadcast of information

Broadcast

3 / 18

Broadcast of information

Broadcast

3 / 18

Broadcast of information

Broadcast

3 / 18

Broadcast of information

Broadcast

3 / 18

Broadcast of information

Broadcast

3 / 18Broadcast of information

BroadcastDenial of Service
Double Spending
3 / 18

Broadcast of information

BroadcastEclipse attacks
Heilman et al., Usenix ’15

Denial of Service
Double Spending
3 / 18

Broadcast of information

BroadcastEclipse attacks
Heilman et al., Usenix ’15
Monopolize connections
Spamming addresses
Forcing node restart
Requires many bots

Denial of Service
Double Spending
3 / 18

Broadcast of information

BroadcastThis paper
1 connection sufficient
No victim restart necessary
Eclipse attacks
Heilman et al., Usenix ’15
Monopolize connections
Spamming addresses
Forcing node restart
Requires many bots

Denial of Service
Double Spending
3 / 18

Bitcoin Scalability

Transaction/Block advertisement

1. Transaction/Block
hash broadcast

hsaH

Hash

HashBroadcast
4 / 18

Bitcoin Scalability

Transaction/Block advertisement

1. Transaction/Block
hash broadcast

2. Transaction/Blockrequesthsa

Hash(Transaction/Block)Hashget(Transaction/Block)

HHashBroadcast

Transaction/Block

Request from only 1 peer!
4 / 18

Bitcoin Scalability

Request timeouts

5 / 18

Bitcoin Scalability

Request timeouts
Hash(Transaction/Block)5 / 18

Bitcoin Scalability

Request timeouts
Hash(Transaction/Block)get(Transaction/Block)5 / 18

Bitcoin Scalability

Request timeouts
Hash(Transaction/Block)get(Transaction/Block)
Hash(Transaction/Block)5 / 18

Bitcoin Scalability

Request timeouts
Hash(Transaction/Block)get(Transaction/Block)
Hash(Transaction/Block)
Disconnect

5 / 18

Bitcoin Scalability

Request timeouts
Hash(Transaction/Block)get(Transaction/Block)
Hash(Transaction/Block)
Disconnect
get(Transaction/Block)Transaction/Block

5 / 18

Bitcoin Scalability

Request timeouts
Hash(Transaction/Block)get(Transaction/Block)
Hash(Transaction/Block)
Disconnect
get(Transaction/Block)Transaction/Block

Block timeout: 20 minutes
Transaction timeout: 2 minutes

5 / 18

Decentralized Currencies

Contributions
AdversaryBlinds victim from blocks and transaction > 20 min
Experimental validation
ImpactDouble spend transactions
Aggravated selfish mining
Network wide Denial of Service
Mitigations
Hardening measures
Estimate waiting time for secure transactions

6 / 18

Delaying information delivery

Necessary requirements

1. Must be first peer to advertise Transaction/Block

7 / 18

Delaying information delivery

Necessary requirements

1. Must be first peer to advertise Transaction/BlockHash7 / 18

Delaying information delivery

Necessary requirements

1. Must be first peer to advertise Transaction/BlockHashHash

7 / 18

Delaying information delivery

Necessary requirements

1. Must be first peer to advertise Transaction/BlockHash
HaOk,
new Hash,
I waitsh

7 / 18

Delaying information delivery

Necessary requirements

1. Must be first peer to advertise Transaction/BlockHash
HaOk,
new Hash,
I waitsh

7 / 18

Delaying information delivery

Necessary requirements

1. Must be first peer to advertise Transaction/BlockHash
HaOk,
new Hash,
I waitsh

2. Victim should wait
Block timeout: 20 minutes
Transaction timeout: 2 minutes
7 / 18Experimental validation

Being First

California

ZurichSingaporeFrankfurt

Bitcoin Network

8 / 18Experimental validation

Being First

California

ZurichSingapore
HashFrankfurt

Bitcoin Network

8 / 18Experimental validation

Being First

Zurich

Hash
Hash
Hash

Hash

California
SingaporeFrankfurt

Bitcoin Network

8 / 18Experimental validation

Being First

Zurich

Hash
Hash
Hash

Hash

California
SingaporeFrankfurt

Bitcoin Network

8 / 18Experimental validation

Being First

ZurichCalifornia

Hash
Hash
Hash

Singapore

HashFrankfurt

Bitcoin Network
Connections of Adversary

4080200800

Connections of Victim

404040400.44±0.14

0.57±
0.20

0.80±0.14

0.89±0.07

Average success in being first

8 / 18Experimental validation

Waiting

Transactions• After 2 minutes request from other peer (FIFO)

9 / 18Experimental validation

Waiting

Transactions• After 2 minutes request from other peer (FIFO)
FIFO queue

9 / 18Experimental validation

Waiting

Transactions• After 2 minutes request from other peer (FIFO)
Hash(TX)

FIFO queue

9 / 18Experimental validation

Waiting

Transactions• After 2 minutes request from other peer (FIFO)
Hash(TX)
Hash(TX)

FIFO queue

9 / 18Experimental validation

Waiting

Transactions• After 2 minutes request from other peer (FIFO)
Hash(TX)
Hash(TX)
Hash(TX)

FIFO queue

9 / 18Experimental validation

Waiting

Transactions• After 2 minutes request from other peer (FIFO)
Hash(TX)
Hash(TX)
Hash(TX)

FIFO queue

6 minutes timeout

9 / 18Experimental validation

Waiting

Transactions• After 2 minutes request from other peer (FIFO)
Hash(TX)
Hash(TX)
Hash(TX)

FIFO queue

6 minutes timeout
Blocks• After 20 minutes disconnect and do nothing• If received header, disconnect and request
block from another peer
9 / 18

Delaying information delivery

Block delivery time > 20 min

1. Requirement for victim•

Must not receive block header•

Must not receive version message

10 / 18

Delaying information delivery

Block delivery time > 20 min

1. Requirement for victim
Header-first synchronization• Must not receive block header
Block B
Block B+1
Block B+2•

Mustnotreceiveversion
message
HeaderHeaderHeaderTransactions

Transactions

Transactions

10 / 18

Delaying information delivery

Block delivery time > 20 min

1. Requirement for victim•Must not receive block header•

Must not receive version message

10 / 18

Delaying information delivery

Block delivery time > 20 min

1. Requirement for victim
Version message exchange
connection• Must noton
receive
block initiation
header•Hi! I’ve
Block 10message
Must not receive
versionHi! I’ve Block 15
Oh! Please send me the headers

10 / 18

Delaying information delivery

Block delivery time > 20 min

1. Requirement for victim
Version message exchange
connection• Must noton
receive
block initiation
header•Hi! I’ve
Block 10message
Must not receive
versionHi! I’ve Block 15Oh! Please send me the headers

Occupy all open connection slots
No new connections

10 / 18

Delaying information delivery

Block delivery time > 20 min

1. Requirement for victim•

Must not receive block header•

Must not receive version message

10 / 18

Delaying information delivery

Block delivery time > 20 min

1. Requirement for victim•

Must not receive block header•

Must not receive version message

2. Requirements for adversary•

Must be first relayer for all blocks•

Should perform connection depletion
10 / 18

Delaying information delivery

Extending the block delivery time - ExampleAdversary

Victimtime

11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Adversary

Victimtime

11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found
Header:B
Mainchain: B
Adversary
Header:B
Mainchain: B
Victimtime

11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
found
Header:B
Mainchain: B

Adversary
Header:B
Mainchain: B
Victimtime

11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
found
Header:
B B+1
Mainchain: B B+1

Adversary
Header:B
Mainchain: B
Victimtime

11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
found
Header:
B B+1
Mainchain: B B+1

Adversary
Header:B
Mainchain: B
Victimtime
20 minB+1

Block B+1timeout

11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
found
Header:
B B+1
Mainchain: B B+1

Adversary
Header:B B
Mainchain: B B
Victimtime
20 minB+1

Block B+1timeout

11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
foundHeader:
B B+1
Mainchain: B B+1

Block B+2
found

Adversary
Header:B B
Mainchain: B B
Victimtime
20 minB+1

Block B+1timeout

11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
found
Header:
B B+1
Mainchain: B B+1

Block B+2
found
B+2
B+2

Adversary
Header:B B
Mainchain: B B
Victimtime
20 minB+1

Block B+1timeout
20 minB+2

Block B+2timeout
11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
foundHeader:
B B+1
Mainchain: B B+1

Block B+2
found
B+2B+2AdversaryHeader:
B B
Mainchain: B BBB

Victimtime
20 minB+1

Block B+1timeout
20 minB+2

Block B+2timeout
11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
found
Header:
B B+1
Mainchain: B B+1

Block B+2
found
B+2
B+2

Adversary
Header:B B
Mainchain: B B

B
B

Victimtime
20 minB+120 min

B+1

Block B+1timeout
20 minB+2

Block B+2timeout
11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
foundHeader:
B B+1
Mainchain: B B+1

Block B+2
found
B+2
B+2

Block B+3
found

Adversary
Header:B B
Mainchain: B BBB

Victimtime
20 minB+1

20 minB+1

Block B+1timeout
20 minB+2

Block B+2timeout
11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
found
Header:
B B+1
Mainchain: B B+1

Block B+2
found
B+2
B+2

Block B+3
found
B+3
B+3

Adversary
Header:B B
Mainchain: B BB
B

Victimtime
20 minB+120 min

B+1

Block B+1timeout
20 minB+2

Block B+2timeout
11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
found
Header:
B B+1
Mainchain: B B+1

Block B+2
found
B+2
B+2

Block B+3
found
B+3
B+3

Adversary
Header:B B
Mainchain: B B

B
B

B+3B

VictimLearns B+320 min

B+120 min

time

B+1

Block B+1timeout
20 minB+2

Block B+2timeout
11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
foundBlock B+1
foundHeader:
B B+1
Mainchain: B B+1

Block B+2
found
B+2
B+2

Block B+3
found
B+3B+3Adversary
Header:B B
Mainchain: B B

B
B

B+3B

VictimLearns B+320 min

B+120 min

time

B+1

Block B+1timeout
20 minB+2

Learns B+2

Block B+2timeout
11 / 18

Delaying information delivery

Extending the block delivery time - Example
Block B
found

Block B+1
found
Header:
B B+1
Mainchain: B B+1

Block B+2
found
B+2
B+2

Block B+3
found
B+3B+3Adversary
Header:B B
Mainchain: B B

B
B

B+3BVictim

B+3B+3

Learns B+320 min

B+120 minB+1timeLearns B+1

Block B+1timeout
20 minB+2

Learns B+2

Block B+2timeout
11 / 18

Delaying information delivery

Experimental validation - Continuous block denial
1.0
Expected success

Probability

0.8
0.6
0.4
0.2
0.0

05

10

15202530

Number of consecutively denied blocks

Probability for N blocks = PN
based on P = 0.83
12 / 18

Delaying information delivery

Experimental validation - Continuous block denial
1.0
Expected
Expected successsuccess
Measured success

Probability0.80.6
0.4
0.2
0.0051015202530

Number of consecutively denied blocks

Probability for N blocks = PN
based on P = 0.83
12 / 18

Implications

What is Double Spending?

Spending money more than once
TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversary

13 / 18

Implications

What is Double Spending?

Spending money more than once
TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversary
TXlegitimate
TXdoublespend

13 / 18

Implications

What is Double Spending?

Spending money more than once
TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversaryOk,
I accept thepayment

TXlegitimate
TXdoublespend

TXlegitimate

13 / 18

Implications

What is Double Spending?

Spending money more than once
TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversaryOk,
I accept thepayment

TXlegitimate
Goods/Service
TXdoublespend

TXlegitimate

13 / 18

Implications

What is Double Spending?

Spending money more than once
TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversaryOk,
I accept thepayment

TXlegitimate
Goods/ServiceTXdoublespend

TXlegitimate

Majority accepts
TXdoublespend

13 / 18

Implications

What is Double Spending?

Spending money more than once
TXlegitimate- Pays the vendor

TXdoublespend - Pays the adversaryOk,
I accept thepayment

TXlegitimate
Goods/ServiceTXdoublespend
Majority accepts
TXdoublespend

TXlegitimate

TXlegitimate
invalidated
13 / 18

Implications

Double Spending 0 Confirmation Transactions

Very reliable attack
Regardless of protection (double spend relay)

VendorBitcoin Network

14 / 18

Implications

Double Spending 0 Confirmation Transactions

Very reliable attack
Regardless of protection (double spend relay)
Blind TXdoublespend
VendorBitcoin Network

14 / 18

Implications

Double Spending 0 Confirmation Transactions

Very reliable attack
Regardless of protection (double spend relay)
Blind TXdoublespend
Vendor

TXdoublespend
Bitcoin Network

14 / 18

Implications

Double Spending 0 Confirmation Transactions

Very reliable attack
Regardless of protection (double spend relay)
Blind TXdoublespend
VendorAdvertise TXdoublespend
TXdoublespend
Bitcoin Network

14 / 18

Implications

Double Spending 0 Confirmation Transactions

Very reliable attack
Regardless of protection (double spend relay)
Blind TXdoublespend
TXlegitimateVendor
Advertise TXdoublespend

TXdoublespend
Bitcoin Network

14 / 18

Implications

Double Spending 0 Confirmation Transactions

Very reliable attack
Regardless of protection (double spend relay)
Blind TXdoublespend
TXlegitimate
TXlegitimate

VendorAdvertise TXdoublespend

TXdoublespend
Bitcoin Network

14 / 18

Implications

Denial of Service

6000 reachable Bitcoin nodes
Preventing the delivery of blocks to these450 000 TCP connections required
600 KB of advertisement / block / 20 min

15 / 18

Implications

Denial of Service

6000 reachable Bitcoin nodes
Preventing the delivery of blocks to these450 000 TCP connections required
600 KB of advertisement / block / 20 min

Network wide Denial of Service

15 / 18

Countermeasures

Hardening the P2P overlay network

1. Why not smaller static timeouts?

2. Why not requesting from multiple peers?

3. What about alternative relay networks?

Security vs Scalability tradeoffs

16 / 18

Countermeasures

Hardening the P2P overlay network
1. Dynamic timeouts

17 / 18

Countermeasures

Hardening the P2P overlay network
1. Dynamic timeouts
2. Handling Transaction Advertisements- Filtering by IP address- Randomly choosing senderFirst request from one peer, then two, then three…

17 / 18

Countermeasures

Hardening the P2P overlay network
1. Dynamic timeouts
2. Handling Transaction Advertisements- Filtering by IP address- Randomly choosing senderFirst request from one peer, then two, then three…
3. Updating Block Advertisements:- Broadcast header instead of hash
- Keep track of block advertisers

17 / 18

Summary
Scalability measures impact security
Blind victim from blocks and transactions
Minimum 20 minutes
1 connection sufficient per target

18 / 18

Summary
Scalability measures impact security
Blind victim from blocks and transactions
Minimum 20 minutes
1 connection sufficient per target

Show impact
Double Spending
Aggravated selfish mining
Affordable Denial of Service
18 / 18

Summary
Scalability measures impact security
Blind victim from blocks and transactions
Minimum 20 minutes
1 connection sufficient per target

Show impact

Proposal to harden the network

Double Spending

Hardening measures

Aggravated selfish mining

Estimation of waiting time forsecure transactions

Affordable Denial of Service
18 / 18

Summary
Scalability measures impact security
Blind victim from blocks and transactions
Minimum 20 minutes
1 connection sufficient per target

Thank you!
Show impact

Proposal to harden the network

Double Spending

Hardening measures

Aggravated selfish mining

Estimation of waiting time forsecure transactions

Affordable Denial of Service18 / 18

Delaying information delivery

Implications - Increasing Mining Advantage

Idea from Eyal et. al:• Instead of publishing, keep a block private
Other miners will perform wasteful computations0'α(1-α)γ(1-α)(1-γ)

1-α
01-α

α

11-αα

2α1-α

3α
1-α

4α1-α...

↵ : hashing power of adversary: propagation parameter
19 / 18

Delaying information delivery

Implications - Increasing Mining Advantage...
01-α...

21-α(1-P)(1-α)
21
P: 01-P: 1'3α1-α(1-P)(1-α)...
P(1-α)22
P²: 0[P(1-P)+(1-P)](1-α)
P(1-P): 1''
1-P: 1'P²(1-α)

...

1-α
31
P: 0
1-P: 1'α

α...
...

...

αα

...

P(1-α)
32
P²: 0...
P(1-P): 1'' α
1-P: 1'P²(1-α)...

P: probability to deny a block to a miner
20 / 18

Implications

Implications - Increasing Mining Advantage

Relative pool revenue

1.00.8P = 0.500, consec. denied blocks = 2
Honest mining
Network control
γ = 0.00 [Eyal]
γ = 1.00 [Eyal]

0.60.40.2

0.00.00.10.2

0.3

Pool size

0.4

0.5
21 / 18

Delaying information delivery

Implications - Double Spending 1 Confirmation Transactions

11. Send BlVendor

Xl = legitimate
Xd = double spend attempt
22 / 18

Countermeasures

Hardening the P2P overlay network
1. Dynamic timeouts
2. Updating Block Advertisements:- Broadcast header instead of hash
- Keep track of block advertisers
3. Handling Transaction Advertisements- Filtering by IP address- Randomly choosing senderFirst request from one peer, then two, then three…

23 / 18

Countermeasures

Hardening the P2P overlay networkBetter Block request management
1. Dynamic timeouts
BlocksBlocksBlock Advertisements:
2. Updatinginv
header- Broadcast header instead of hash
- Keepget
trackof block advertisers
headerget data

3. Handling Transaction Advertisements
headers- Filteringby IP address
blockchoosing sender- Randomly

get data

blockFirst request from one peer, then two, then three…
size(inv) = 36 bytessize(header) = 80 bytes

23 / 18

Countermeasures

Hardening the P2P overlay network
1. Dynamic timeouts
2. Updating Block Advertisements:- Broadcast header instead of hash
- Keep track of block advertisers
3. Handling Transaction Advertisements- Filtering by IP address- Randomly choosing senderFirst request from one peer, then two, then three…

23 / 18

Countermeasures

Probability to receive transaction

Hardening the P2P overlay network
1. Dynamic timeouts
1.0

Updating Block Advertisements: ia = inv messages sent
2. 0.8- Broadcast header instead of hash by adversary
0.6- Keep track of block advertisersiit = 0.50
a0.4

ia
it = 0.75

it = total inv messages

3. 0.2
Handling Transaction Advertisements
i- Filtering by IP address i = 0.95
0.0- Randomly
30 60 90choosing
120 150 180sender210 240 270 300at

Waiting time (assuming 30 sec timeout)

First request from one peer, then two, then three…

After 5 minutes, transaction is received, even
if the adversary controls 95% of the inv
23 / 18

Main contributions

Advertisment-based request request management system
Hash(Object)
get(Object)
ObjectBlocksTransactions

24 / 18

Main contributions

Advertisment-based request request management system
Hash(Object)
get(Object)
ObjectBlocksTransactions
inv
get datatransaction

24 / 18

Main contributions

Advertisment-based request request management system
Hash(Object)
get(Object)
ObjectBlocksTransactions

inv

inv

get headers

get data

get datatransaction
headersblock

24 / 18