Is simplified payment validation (SPV) decentralized?

Viz., when an SPV client wants to verify a payment, does it connect to a central server or to several random peers, checking that their Merkle tree traversals for the transaction to be verified all agree?

"Choose your Bitcoin wallet" from Bitcoin.org says (e.g., for GreenAddress's Android wallet) "Decentralized validation," which it describes as:

This wallet connects to a random server from a list. This means some trust in third parties is required when verifying payments. However, it is not as secure as a full node like Bitcoin Core.

How is "connect[ing] to a random server from a list" decentralized?

However (e.g., for iOS's BreadWallet) it says "Simplified validation" instead, which it describes as:

This wallet uses SPV and the Bitcoin network. This means very little trust in third parties is required when verifying payments. However, it is not as secure as a full node like Bitcoin Core.

Geremia

Posted 2016-01-13T19:18:57.517

Reputation: 3 665

Did you mean to link bitcoin.com instead of bitcoin.org? – Nick ODell – 2016-01-13T19:33:42.997

I'm not sure why the difference in those two wallet descriptions. That might be a case when the wording was changed for one and the other was forgotten about. That said I don't know the details on exactly how the wallets work, so there might be a slight difference. Maybe you should raise this with the bitcoin.org people (I think they work through github these days, you should be able to raise an issue there). – Jannes – 2016-01-13T20:50:19.847

@Jannes A bit of discussion about it is here: https://github.com/bitcoin-dot-org/bitcoin.org/pull/601

– Geremia – 2016-01-13T21:15:51.317

Answers

If you assume you are not being attacked, in the sense that your internet connection is not being restricted in a way that it allows you to only connect to an attacker's nodes without you noticing (Sybil attack). And note that that's actually an assumption that doesn't always hold and you can't really prove you're NOT being attacked, so it is certainly a security concern.

If that assumption holds then you are really connecting to a random node of your chosing that is not run by a centralized organisation or even group of people. Centralized would imply that there is some center that is the authority to decide what is truth. That is not the case here, even using SPV. So yes, I'd say it's decentralized.

Note also that instead of connecting to just one random peer you can connect to multiple so you can doublecheck that one is not lying. Although depending on the situation it may be hard to judge which peer is lying and which is telling the truth, so you may end up having to trust "the majority".

Also, an upcoming update called Segregated Witness is going to make Fraud Proofs possible. That will allow a single honest node to simply prove a statement, so even if the majority is lying you can still know for sure.

Jannes

Posted 2016-01-13T19:18:57.517

Reputation: 5 823

dan91 wrote on BitcoinTalk.org:

I believe green address uses some of their own servers and some electrum servers for verification. BreadWallet does use full nodes as i have seen some userid's with BreadWallet connect to mine.

Geremia

Posted 2016-01-13T19:18:57.517

Reputation: 3 665