Toward Active and Passive Confidentiality Attacks on Cryptocurrency Off-chain Networks

Abstract

Cryptocurrency off-chain networks such as Lightning (e.g., Bitcoin) or Raiden (e.g., Ethereum) aim to increase the scalability of traditional onchain transactions. To support nodes in learning about possible paths to route their transactions, these networks need to provide gossip and probing mechanisms. This paper explores whether these mechanisms may be exploited to infer sensitive information about the flow of transactions, and eventually harm privacy. In particular, we identify two threats, related to an active and a passive adversary. The first is a probing attack: here the adversary aims to detect the maximum amount which is transferable in a given direction over a target channel by actively probing it and differentiating the response messages it receives. The second is a timing attack: the adversary discovers how close the destination of a routed payment actually is, by acting as a passive man-in-the middle and analyzing the time deltas between sent messages and their corresponding responses. We then analyze the limitations of these attacks and propose remediations for scenarios in which they are able to produce accurate results. arXiv:2003.00003v1 [cs.CR] 28 Feb 2020However, the fact that nodes need to be able to find routes also requires mechanisms for nodes to learn about the payment channel network's state. The two typical mechanisms which enable nodes to find and create such paths are gossip and probing. The gossip protocol defines messages which are to be broadcast in order for participants to be able to discover new nodes and channels and keep track of currently known nodes and channels [15]. Probing is the mechanism which is used to construct an actual payment route based on a local network view delivered by gossip, and ultimately perform the payment. In the context of §4, we are going to exploit probing to discover whether a payment has occurred over a target channel. The gossip store is queried for viable routes to the destination, based on the desired route properties [25]. Because the gossip store contains global channel information, it is possible to query payment routes originating from any node on the network. Due to privacy concerns, gossip messages only include the total balance for any given channel rather than the balance each node is holding.This paper explores the question whether the inherent need for nodes to discover routes in general, and the gossip and probing mechanisms in particular, can be exploited to infer sensitive information about the off-chain network and its transactions.

How Lightning’s Routing Diminishes its Anonymity

“…The considerable higher timelocks in shadow routing facilitate longer fund reservation and hence increase the severity of the attack. Furthermore, timing attacks still allow inferring the hop distance to the receiver in practice [20].…”

“…However, the evaluation was limited in the sense that only paths of up to length 5 was allowed between any pair of nodes. Other works evaluating the anonymity in Bitcoin's Lightning network studied the effectiveness of inferring the receiver through timing attacks [20], linkability of payments at different locations in the network [17], and an attack that determines whether the predecessor is indeed the source [13]. The only attack that explicitly makes use of Lightning's predictable routing targets availability rather than anonymity [29].…”

Route Hijacking and DoS in Off-Chain Networks

“…Off-chain networks, in particular, attracted many researchers to study possible attacks. Some of these attacks overload the channels with pending transactions to DoS the network [26], create congestion in the underlined blockchain to steal money [15], and deanonymize users with active and passive timing attacks [31], [34].…”

Counting Down Thunder

“…Concurrently to our work, Kappos et al [33] refine prior approaches of traffic simulation and introduce a probabilistic model based on observed path lengths in order to estimate probable payment endpoints. Moreover, while a recent entry by Nisslmueller et al [48] mention the possibility of timing attacks, their investigation remains in a preliminary state.…”