How does Bitcoin currently mitigate Sybil and Eclipse attacks?

0

What countermeasures does Bitcoin currently have in place to limit Sybil attacks (ie of full nodes [not miners]) and eclipse attacks?

In particular, it seems like an important countermeasure would be to attempt to give your connections only about as much resources (bandwidth/processing/etc) as they're giving back to you, so as to ensure that a sybil attacker must cost approximately the same amount as an honest node. But I get the feeling this doesn't exist. Does it?

Are there other countermeasures in place currently?

B T

Posted 2019-07-27T18:50:36.820

Reputation: 1 134

Answers

1

A sybil attack is prevented by using proof of work. Overwhelming the network with nodes cannot substitute for the hash power required to create the proof of work that must be presented in order to get the network to accept a new block.

An eclipse attack is more difficult to prevent:

Bitcoin Core only makes an outbound connection to one IP address per /16 (x.y.0.0). Incoming connections are unlimited and unregulated, but this is generally only a problem in the anonymity case where you're probably already unable to accept incoming connections. See https://en.bitcoin.it/wiki/Weaknesses#Sybil_attack.

As far as I'm aware there is no such logic implemented to equalize the network resources between nodes.

JBaczuk

Posted 2019-07-27T18:50:36.820

Reputation: 6 172

I understand PoW, but that's not the type of Sybil attack I'm talking about. The Sybil attack I'm talking about is about an entity creating many bitcoin network nodes and doing nefarious things to the network, like slowing down traffic or eating up connections. The eclipse prevention mechanism you mention helps for certain things, but not for others. For example, it doesn't prevent a Sybil attacker from matching transactions to IP addresses. – B T – 2019-07-27T21:31:49.183

nodes can be run anonymously to prevent IP address matching. – JBaczuk – 2019-07-27T21:44:28.530

2Incoming connections are actually also regulated, but only once the max connections limit is reached. After that, new connections are still allowed, but subject to certain scoring conditions (including IP range based), and if the new connection is better than an existing one, the existing one is disconnected; otherwise, the new one is. – Pieter Wuille – 2019-07-27T23:38:41.477

Interesting. @PieterWuille what other scoring conditions are there? Is there a good concise list somewhere (maybe in a source file)? – B T – 2019-07-31T17:32:30.500

Asked: 2019-07-27T18:50:36.820

Viewed: 106 times

Active: 2019-07-27T21:32:22.240