1. Deanonymization of Clients in Bitcoin P2P Network
Talk about how anonymous are Bitcoin transactions?
How many of you think they’re anonymous?
If they aren’t anonymous, then why were they used on Silk Road?
Deanonymization of Clients in Bitcoin P2P Network

2. What is Bitcoin? Digital Currency
First proposed in 2007 by Satoshi Nakamoto
Decentralized
No central authority
Doesn’t rely on trust
Central authority
Currency trading
Confiscation
Change in Power
Devaluation when governments change etc.

3. How does Bitcoin work? Balances Transaction Security Processing
Have to have something that keeps track of who has what.
Have to have a way of trading the currency.
Have to have computers to process the transaction and those computers have to be distributed.

4. Transactions (key pair)
Based on asymmetric encryption
ID is base 58 encoding of the hash of the public key
Sign transactions with private key.
If person A wants to send person B money, they build the transaction with person B’s ID as the owner and then they sign it with their private key.
All your bitcoins are included in each transaction – no partial payments
Transaction includes source/input, amount and output

5. Balances (block chain)

6. Balances (block chain)
Operates on a collection of blocks
Similar to a general ledger
Hi=SHA-256(SHA-256(Hi-1||Ti||TXi||di||Ni)) < f(di)
Hi = header block
Ti = timestamp
TXi = hash of the transaction data
di =difficulty parameter
N = nonce
80 byte
F(d) is a linear function of the difficulty. Currently must be smaller that 2198 – i.e. the 64 most significant bits are 0

7. Processing (mining) Block has to be confirmed/recording
Mining is process of including transaction in block
Brute force SHA-256 hash to find value < f(d)
Hi=SHA-256(SHA-256(Hi-1||Ti||TXi||di||Ni)) < f(di)
Reward is 25 bitcoins
Change nonce

8. Bitcoin P2P Network

9. Bitcoin P2P Network Address Propagation Peer Discovery
Transaction Propagation
Three pieces to communication in bitcoin network
Publishing your address to help peers discover other peers
Discover other peers to connect to
Forward transactions after they occur
Bitcoin peers try to maintain 8 outgoing connections.
Servers accept up to 117 incoming connections – total 125
Currently 8,000 servers and 100,000 clients

10. Address Propagation Peers request addresses from each other.
Node computers Hash of each neighbor with address to forward, salt, day, memory address
Node sorts the hash and forwards to the one on top
Node N0 get address from Node N3
N0 looks up top hash (let’s say N1) and sends the address
100 ms later
N0 looks up next top hash (let’s say N3) so nothing to do
N0 looks up next top hash (N2) and sends the address

11. Peer Discovery Connects to two hard-coded sites to get external IP
Client makes connection to server and publishes IP
Remote peer propagates address

12. Transaction Propagation
Sender computes hash for random wait time
Sender transmits INVENTORY message to peers
Receiver requests transaction data with GETDATA
Receiver forwards transaction to peers
ASSUMPTION: Entry node will always forward fastest
Receiver runs a series of check on the information in the Inventory message and if it all looks good will request the transaction

13. To connect a Bitcoin address to User’s IP.
What is the Goal?
To connect a Bitcoin address to User’s IP.

14. The Onion Routing (TOR)
What is TOR?
How does TOR affect Bitcoin?

15. How does TOR affect Bitcoin?
TOR would make it impossible to tie Bitcoins to anything other than the TOR exit node.

16. Disconnecting from TOR
First phase of attack
Exploit Bitcoin Denial of Service protection
Approximately 1008 TOR exit nodes
Possible countermeasures
Countermeasure – similar to adding a cookie for Diffie Hellman clogging attack protection – make connection to TOR more computationally expensive initially

17. What’s new here? Attack purposed in original paper
Method targets clients
Crucial idea is each client can be uniquely identified by the entry nodes it connects to.
Deanonymization rates of 11%-60%.

18. Learning Topology
Connect to W Bitcoin servers where W is close to the total number of servers
For each advertised Client IP, log the servers that forwarded the IP to you.
Problem: Server might broadcast elsewhere.
Solution:
Make multiple connections to entry servers
Broadcast Client IP to target entry nodes
When you broadcast the IP to everyone else, they won’t send it to you in the future. This helps to make sure that when the client reconnects, the entry point will send the client IP to the client and stop the propagation.
Learn which servers are entry nodes for which IP’s over time.

19. Deanonymization Getting the list of servers
Composing the deanonymization list
Mapping clients to their entry nodes
3 entry nodes identify user
Sometime only need 2 nodes
Mapping transactions to entry nodes

20. Recap Make many connections to servers.
Learn client entry nodes by listening to address propagation
Tie transactions to clients based on which server forwards the transaction first assuming entry nodes will always forward first.

21. Experimental Results Custom bitcoin client
50 additional connections to each server if possible
Sent transactions from clients
Transaction first forwarded by entry nodes
Correctly linked 59.9% of transactions
Using only 20 connections identified 41% of transactions

22. Analysis
Success depended on number of connections to servers/all target’s entry nodes
False Positives?
Overall success rate:
With 50 connections, expect to capture 11%
Must send 9 transactions to reveal address
Change IP every connection to thwart

23. Conclusion Correlates ID/public key to IP Technique to learn network
Could be used in other point-to-point networks.

24. Other Topics Alternate Reality Further learning to Topography
Estimating Success Rate: Details (Appendix)
Attack Costs (Appendix)
Transaction Propagation Delay (Appendix)
On Stability of the Fingerprint (Appendix)
Denial of Service (Appendix)

25. Questions?