On 16/04/14 18:08, Arne Babenhauserheide wrote: > Am Donnerstag, 10. April 2014, 13:21:35 schrieb Matthew Toseland: >>> On did I miss something, that you also assume every non-core node has at >>> least one connection to the core, and will with 100% certainty route a >>> request thereto? >> The proposal was that we only route high HTL requests to core nodes. So >> if we don't have peers which are core peers ... do we route to non-core >> peers? Maybe. Or maybe we don't route at all, and ensure that >> bootstrapping gets us some core peers? > We have to route to peers who are > a) core enough by the default settings, or > b) at least as core as we are (with core being some metric > quantifying local long-term-high-bandwidth-ness). > > That way no one will ever know whether a given node is a core node to the > next node down the chain - which also defeats the “you sent me a high HTL > request, so it’s from you”-attack. IMHO that would be detectable, in general. How important that is in unclear given you can do correlation attacks anyway. > I don’t see a use in having global knowledge of core-ness. Simply that it could be made more expensive.
For tunnels we need a global identity that we can cross-check; an important part of both tunnel setup algorithms is publishing signed peer lists and checking for conflicts in them. I.e. trying to ensure that nodes can't give a different set of peers to each of its peers, thus ensuring that everyone who tunnels through them always tunnels through non-existent identities the malicious node controls. Arguably this depends on identity creation being costly. For example there are some references to / assumptions about IP addresses in one of the anti-Sybil mechanisms PISCES uses. More generally e.g. an attacker could create new virtual nodes for tunnel purposes, with each one appearing a good peer to *one* real peer and providing fakes for all the other peers. In which case the requirement for ShadowWalker for the bad guys to control 20% of the network looks rather more feasible. In ShadowWalker, randomly assigned "guard nodes" counter-sign each node's peers list to prevent cheating, but - without looking into it in depth - it still looks like there is an implication that identity creation isn't completely free. Requiring that we be able to connect to the supposed peers doesn't help either - Mallory will reuse the same set of peers / IPs across the network. Hence IMHO we need global mechanisms that force attackers to e.g. use a unique node identity (for tunneling), connections limit (closely related), and IP address etc, for each node. Collaboratively monitoring a node's bandwidth usage is a logical extension though it may be possible to game it, I dunno. But it looks like some sort of global state - either facilitated or enforced by the seednodes - would help.
signature.asc
Description: OpenPGP digital signature
_______________________________________________ Devl mailing list [email protected] https://emu.freenetproject.org/cgi-bin/mailman/listinfo/devl
