p.23 與 p.24 對調。 typo: p.5, package delay --> packet delay typo: p.24 modifing -> modifying Consensus in bitcoin is broken.

1. A Preliminary Study on Attacks
against Consensus in Bitcoin
@若渴 2018.4.22
<ajblane0612@gmail.com>
AjMaChInE

2. Consensus in Bitcoin is Broken

3. Outline
• Double-spending attacks [0]
• Network partition [1][2][3]
• Mining pools [4]
• Transaction malleability [6]
• Attacks targeting mining [7] [8]
• Non-trivial composition of attacks targeting
mining and network partition [8]
• …
affecting consensus

4. Double-Spending Attacks on Fast
Payments [0]

5. Network Partition Attacks
• Eclipse attack [1]
• Routing attack [2]
• …
In order to fulfill requests including victim
isolation, package delay , and so on, to stably
reach double-spending attacks.

6. High Level View of Bitcoin’s Peer-to-
Peer Network [1]
IP, not cryptographic
authentication

7. Eclipse Attack [1]

8. Off-Path Attack - Improving Eclipse
Attack [1]

9. Eclipse Implication - 51% Attack with
40% Mining Power [1]

10. Why to Use N- or 0-Confirmation
Transactions
Transaction security is ensured in Bitcoin by
means of blocks which instantiate a hash-based
Proof of Work (PoW) mechanism; Bitcoin’s PoW
requires 10 minutes on average to be solved and
6 consecutive blocks are recommended to
confirm any single transaction in the system.
This suggests that transactions will be confirmed
in the system after almost one hour—provided
that the majority (>50%) of the computing
power in the network is honest. [1]

11. Eclipse Implication – N- or 0-Confirmation
Double Spend or Engineering Block Races [1]
0% mining power

12. How to Implement Off-Path Attack

13. Routing Attacks [2]
• “Two key characteristics of the Internet’s infrastructure make
routing attacks against Bitcoin possible: (i) the efficiency of
routing manipulation (BGP hijacks); and (ii) the centralization
of Bitcoin from the routing perspective. First, individuals,
located anywhere on the Internet, can manipulate routing to
intercept all the connections to not only one, but many
Bitcoin nodes. As we show in this paper, these routing
manipulations are prevalent today and do divert Bitcoin traffic.
Second, few ASes host most of the nodes and mining power,
while others intercept a considerable fraction of the
connections.”
• “As Bitcoin connections are routed over the Internet— in clear
text and without integrity checks—any third-party on the
forwarding path can eavesdrop, drop, modify, inject, or delay
Bitcoin messages such as blocks or transactions.”

14. AS-level Adversary - Isolating the Set
of Nodes P = (A, B, C, D, E, F) [2]
BGP hijacking

15. AS-level Adversary – Delay can Keep
the Victim Eclipsed [2]
Exchange blocks

16. Deny the Delivery of 2 Consecutive
Blocks with 20 Minute Timeout [3]

17. Mining Pools

18. The Miner's Dilemma [4]
? ?

19. Transaction Malleability

20. Bitcoin Transaction [5]
• “A transaction is a transfer of Bitcoin value that is
broadcast to the network and collected into
blocks. A transaction typically references previous
transaction outputs as new transaction inputs
and dedicates all input Bitcoin values to new
outputs. Transactions are not encrypted, so it is
possible to browse and view every transaction
ever collected into a block. Once transactions are
buried under enough confirmations they can be
considered irreversible”

21. [6]

22. [5]

23. OPCODE: PUSHDATA2 [6]

24. Modifing Transactions by How
to Exploit a Script Feature

25. [6]

26. [6]

27. [6]

28. Modifing ScriptSing, But is Valid [6]

29. [6]

30. [6]

31. [6]

32. Transaction Failed ? [6]

33. Generate Another Transaction to Get
30BTC [6]

34. Attacks Targeting Mining
• Selfish mining [7]
• Stubborn mining [8]

35. Bitcoin Mining
Fairness: If Alice has 1/4th computation power, she
gets 1/4th of the total reward
1) Slide: p.2 Stubborn Mining: Generalizing
Selfish Mining and Combining with an Eclipse
Attack
2) Bitcoin always use the longest chain

36. The Goal of Attacks Targeting Mining
[8]
“Intuitively, for a secure-by-design
cryptocurrency, an attacker controlling fraction
of the network’s computational resource should
be able to obtain only fraction of the mining
reward. However, a malicious attacker can
employ various types of attacks to gain an unfair
share of the mining reward.”

37. Representation of Alice and Bob’s
Blockchain at Different Chain States [8]

38. Selfish Mining – Success [7][8]
In a nutshell, all known deviant mining
strategies work by selectively withholding
(Selfish) blocks mined by the attacker, causing
the rest of the network to waste its
hashpower on redundant blocks. The selfish
mining strategy, in particular, withholds
blocks when it is “in the lead” (i.e., when it
has created a private chain longer than that
of the honest network),

39. Selfish Mining - Fail
• But cooperates with the honest network when
it falls behind. [7][8]
Fail
Maybe

40. Selfish Mining [7][8]
2 reward: if Alice or the 𝛾 fraction of Bob advances
Alice’s fork, then Alice has successfully diverted a part of
Bob, (1-𝛾) fraction, to do useless work.

41. Stubborn Mining - Concept [8]
The key insight behind stubborn mining
strategies is that the attacker should not give up
so easily! Instead, the attacker can often
increase profits by mining on its private chain
more often(Stubborn), even under
circumstances where a selfish-mining attacker
would acquiesce to the public chain.
Stubborn

42. A Stubborn Mining–
Improving Selfish Mining [8]
lead = -1

43. Non-Trivial Composition of Attacks
Targeting Mining (e.g. selfish attack)
and Network Partition (e.g. eclipse
attack)

44. Strategies Exploiting
Eclipse Attack Victims
No eclipse attack
Destroy the eclipsed victim
* waste computation power
Collude with the eclipsed
victim
Destroy if No Stake (DNS)
* as conditionally colluding
with or destroying
Strategies Exploiting
Stubborn Mining
Lead stubborn mining
Equal fork stubborn
Trail stubborn mining
C(4,1) * C(3,1)
Combination
[8]

45. Alice Uses a Strategy with DNS and Equal Fork
Stubborn [8]
三分天下
蜀(Alice)共謀魏
蜀(Alice)共謀吳一統
mine a block

46. Reference
• [0] 2012, Ghassan O. Karame, etc.,Two Bitcoins at the Price of One?
Double-Spending Attacks on Fast Payments in Bitcoin
• [1] 2015, Eclipse Attacks on Bitcoin’s Peer-to-Peer Network ;
https://www.youtube.com/watch?v=J-lF0zxGpu0
• [2] 2015, Arthur Gervais, etc., Tampering with the Delivery of Blocks and
Transactions in Bitcoin
• [3] 2017, Maria Apostolaki, etc., Hijacking Bitcoin: Routing Attacks on
Cryptocurrencies; https://btc-hijack.ethz.ch/
• [4] 2014, Ittay Eyal, The Miner's Dilemma
• [5] Bircoin transaction: https://en.bitcoin.it/wiki/Transaction
• [6] 2014, black hat, Danie Chechik, etc., Bitcoin Transaction Malleability
Theory In Practice
• [7] 2014, Majority is Not Enough- Bitcoin Mining is Vulnerable (selfish
mining)
• [8] 2016, Kartik Nayk, etc. Stubborn Mining: Generalizing Selfish Mining
and Combining with an Eclipse Attack