Dandelion: Redesigning the Bitcoin Network for Anonymity

0.66 MB·

by  Shaileshh Bojja Venkatakrishnan

Dandelion: Redesigning the Bitcoin Network for
Anonymity
Shaileshh Bojja Giulia Fanti Pramod Viswanath
Venkatakrishnan UniversityofIllinoisat UniversityofIllinoisat
UniversityofIllinoisat Urbana-Champaign Urbana-Champaign
Urbana-Champaign [email protected] [email protected]
[email protected]
ABSTRACT actionsareverifiedandrecordedwithcryptographicintegrity
7
guarantees; this prevents fraudulent activity like double-
1 Bitcoin and other cryptocurrencies have surged in popular-
spending of money. Transparency is achieved through a
0 ityoverthelastdecade. AlthoughBitcoindoesnotclaimto
combination of clever cryptographic protocols and the pub-
2 provide anonymity for its users, it enjoys a public percep-
tionofbeinga‘privacy-preserving’financialsystem. Inreal- lication of transactions in a ledger known as a blockchain.
n This blockchain serves as a public record of every financial
ity, cryptocurrencies publish users’ entire transaction histo-
a
transaction in the network.
J ries inplaintext, albeitunder apseudonym; this is required
fortransactionvalidation. Therefore,ifauser’spseudonym A property that Bitcoin does not provide is anonymity.
6 Each user is identified in the network by a public, crypto-
can be linked to their human identity, the privacy fallout
1
graphic key. If one were to link such a key to its owner’s
canbesignificant. Recently,researchershavedemonstrated
] deanonymizationattacksthatexploitweaknessesintheBit- humanidentity,theowner’sentirefinancialhistorycouldbe
R coin network’s peer-to-peer (P2P) networking protocols. In learned from the public blockchain. In practice, it is pos-
sible to link public keys to identities through a number of
C particular,theP2Pnetworkcurrentlyforwardscontentina
channels, including the very networking protocols on which
structured way that allows observers to deanonymize users.
s. Inthiswork,weredesigntheP2Pnetworkfromfirstprinci- Bitcoin is built [7]. This is a massive privacy violation, and
c can be downright dangerous for deanonymized users.
ples with the goal of providing strong, provable anonymity
[ Bitcoin is often associated with anonymity or privacy in
guarantees. We propose a simple networking policy called
1 Dandelion,whichachievesnearly-optimalanonymityguar- the public eye, despite explicit statements to the contrary
intheoriginalBitcoinpaper[34]. Peoplemaythereforeuse
v antees at minimal cost to the network’s utility. We also
9 provide a practical implementation of Dandelion for de- Bitcoin without considering the potential privacy repercus-
sions [2]. Moreover, this problem is not unique to Bitcoin;
3 ployment.
many spinoff cryptocurrencies (known as altcoins) use sim-
4
4 ilar technologies, and therefore suffer from the same lack of
1. INTRODUCTION
0 anonymity in their P2P networks.
. Cryptocurrenciesaredigitalcurrenciesthatprovidecryp- The objective of this paper is to redesign the Bitcoin
1
tographic verification of transactions. Bitcoin is the best- networking stack from first principles to prevent network-
0
known example of a cryptocurrency [34]. In recent years, facilitateddeanonymizationofusers. Critically,thisredesign
7
cryptocurrencieshavetransitionedfromanacademicresearch must not reduce the network’s reliability or performance.
1
topic to a multi-billion dollar industry [13]. Althoughthenetworkingstackisonlyoneavenuefordeanonymiza-
:
v Cryptocurrencies exhibit two key properties: egalitarian- tionattacks,itisanavenuethatispowerful,poorly-understood,
i ismandtransparency. Inthiscontext,egalitarianism means and often-ignored. To better convey the problem, we begin
X
that no single party wields disproportionate power over the with a brief primer on Bitcoin and its networking stack.
r network’s operation. This diffusion of power is achieved by
a
asking other network nodes (e.g., other Bitcoin users) to 1.1 BitcoinPrimer
validate transactions, instead of the traditional method of
BitcoinrepresentseachuserandeachunitofBitcoincur-
usingacentralizedauthorityforthispurpose. Moreover,all
rencybyapublic-privatekeypair. Auser“possesses”acoin
transactionsandcommunicationsaremanagedoverafully-
byknowingitsprivatekey. AnytimeauserAlicewishesto
distributed, peer-to-peer (P2P) network.
transfer her coin m to Bob, she generates a signed transac-
Cryptocurrenciesaretransparentinthesensethatalltrans-
tion message, which states that Alice (denoted by her pub-
lic key) transmitted m (denoted by its public key) to Bob
(denoted by his public key). This transaction message is
broadcast to all active Bitcoin nodes, at which point min-
ers, or nodes whochoose to helpvalidate transactions, race
to append the transaction to a global ledger known as the
blockchain. Specifically, each miner aggregates a group of
transaction messages into a block, or list, and then com-
pletesacomputationalproof-of-workfortheblock;thefirst
ACMISBN978-1-4503-2138-9.
DOI:10.1145/1235 miner to complete a proof-of-work appends their block to
1
theblockchainandreapsarewardofnewly-mintedbitcoins nodes diffuse transactions symmetrically over the network,
and transaction fees. researchers were able to link Bitcoin users’ public keys to
theirIPaddresseswithanaccuracyofupto30%[7]. More-
1.1.1 Bitcoinmessagepropagation over, the source estimators used in these papers are simple,
Thispaperfocusesononekeystepinthepipeline: broad- andexploitonlyminimalknowledgeoftheP2Pgraphstruc-
casting transactions to other nodes. The broadcasting pro- tureandthestructuredrandomnessofdiffusion. Wehypoth-
cess is critical because it affects which nodes can reap a esizethatevenhigheraccuraciesmaybepossiblewithmore
transaction’sminingreward(byvirtueofthedeliverydelays sophisticated estimation tools.
todifferentnodes),anditalsoaffectstheglobalconsistency TheseattacksdemonstratethatBitcoin’snetworkingstack
of the network (e.g., if only a subset of the users receive a is inadequate for protecting users’ anonymity. Moreover,
given transaction). theBitcoinnetworkingcodebaseiscopiedalmostdirectlyin
To understand the mechanics of broadcasting, note that othercryptocurrencies,sotheproblempervadestheecosys-
cryptocurrencies can be abstracted into two layers: the ap- tem. To some extent, this is to be expected: Bitcoin’s net-
plicationlayerandthenetworklayer. Theapplicationlayer working stack was taken directly from Satoshi Nakamoto’s
handlestasksliketransactionmanagement,blockchainpro- originalnetworkimplementation,whichappearstohavebeen
cessing, and mining. Nodes are identified by their public a product of expediency. However, in the decade since Bit-
keys in the application layer. The network layer handles coin’srelease,thenetworkingstackanditsanonymityprop-
communicationbetweennodes,whichoccursoveraP2Pnet- erties have not been systematically studied.
work of inter-node TCP connections. In the network layer,
nodes are identified by their IP addresses. As we shall see 1.2 ProblemStatementandContributions
momentarily, a node’s IP address and public key should re-
WeaimtoaddresstheBitcoinP2Pnetwork’spooranonymity
main unlinkable for privacy reasons.
properties through a ground-up redesign of the networking
Bitcoin’speer-to-peerbroadcastoftransactionsandblocks
stack. We seek a network management policy that exhibits
isbasedonfloodinginformationalonglinksintheP2Pnet-
twoproperties: (a)stronganonymityagainstanadversarial
work. When a node learns of a new transaction or block,
groupofcolludingnodes(whichareafractionpofthetotal
it passes the message to its neighbors who have not yet
network size), and (b) low broadcasting latency. We define
seen the message with an independent, exponential delay.
these notions formally in Section 2. Critically, these net-
The process continues recursively until all reachable peers
workingprotocolsshouldbelightweightandprovidestatisti-
receive the message. This broadcast protocol is commonly
calanonymityguaranteesagainstcomputationally-unbounded
known as a diffusion process; it forms the basis of Bitcoin’s
adversaries. Lightweight statistical solutions are comple-
global, eventually consistent log and is therefore of utmost
mentary to cryptographic solutions, which aim to provide
importance to its correct and fair operation.
worst-caseanonymityguarantees,usuallyinthefaceofcom-
putationally bounded adversaries. Lightweight anonymiza-
1.1.2 DesirableNetworkProperties
tion methods lower the barrier to adoption since a more ef-
Bitcoin’snetworklayershouldexhibittwoprincipalprop- ficient,fasterprotocolleadstoabetteruserexperienceand
erties: low latency and anonymity. also places less burden on developers to significantly mod-
Low latencymeansthatthemaximumtimeforamessage ify existing code; their study is also of basic scientific and
to reach all network nodes should be bounded and small. engineering interest. Such is the goal of this paper.
Latencymattersbecauseifthenetworkfailstodelivermes- Part of the novelty of our work is that the Bitcoin P2P
sages within a predictable time bound, the network risks networkingstackhasnotbeenmodeledinanydetailedway
reaching an inconsistent state. (muchlessanalyzedtheoretically),tothebestofourknowl-
Anonymity meansthattheadversaryshouldbeunableto edge. In addition to modeling this complex, real-world net-
link transaction messages (and hence, the associated public working system, our contributions are threefold:
keys) to the IP address that originated a transaction. Re- (1) Fundamental anonymity bounds. The act of user
call that every transaction made by a public key is listed deanonymization can be thought of as classifying transac-
in plaintext in the blockchain. Therefore, if a public key tions to source nodes. Precision and recall are natural per-
can be linked to an IP address, the adversary can link all formance metrics. Recall is simply the probability of de-
of that user’s transactions. In some cases, the IP address tection, a common anonymity metric that captures com-
could even be used to learn a node operator’s human iden- pleteness of the estimator, whereas precision captures the
tity. Thus, deanonymization attacks can result in a user’s exactness. We define these terms precisely in Section 2.4.
entirebankinghistorybeingrevealed. Cryptocurrencyusers Given a networking protocol, the adversary has a region
are typically recommended to choose fresh public keys and of feasible (recall, precision) operating points, which are
“mix” their coins with others to obscure their transaction achieved by varying the source classification algorithm. We
history [43, 11] (in practice, few users do so [27, 31]). How- give fundamental bounds on the best precision and recall
ever, these techniques are useless if the IP address of the achieved by the adversary for any networking protocol, as
source of the transaction can be recovered. illustrated in Figure 1; here p refers to the ratio of collud-
ing nodes to the total number of nodes in the network. We
1.1.3 HowtheCurrentNetworkFails
show that a (recall, precision) point is feasible only if it lies
In recent years, security researchers have demonstrated betweentheredandbluelinesinFigure1. Moreover,every
multiple deanonymization attacks on the Bitcoin P2P net- networking protocol yields an achievable (recall, precision)
work. These attacks typically use a“supernode”that con- region to the adversary that intersects with the shaded re-
nects to active Bitcoin nodes and listens to the transac- gion (a) in Figure 1 in at least one point.
tion traffic relayed by honest nodes [28, 7, 8]. Because (2) Optimal algorithm. We propose a simple network-
2
1 challengesofimplementingDandelion,andproposessome
simple, heuristicsolutions. We discuss the relation between
DandelionandpriorrelatedworkinSection7,andconclude
with some open problems in Section 8.
2. SYSTEMMODEL
n
o (a)
si WemodelthreecriticalaspectsofBitcoin’sP2Pnetwork:
ci the network topology, the message propagation protocol,
e
r
P andthedeanonymizingadversary’scapabilities. Thesemod-
els are based on existing protocols and observed behavior.
Diffusion
p (simulated) 2.1 P2PNetworkModel
2p2 log(2) Dandelion The Bitcoin P2P network contains two classes of nodes:
1−p p
p2 serversandclients. Clientsarenodesthatdonotacceptin-
00pp22 pp 11 comingTCPconnections(e.g.,nodesbehindNAT),whereas
RReceaclalll servers do accept incoming connections. We focus in this
Figure 1: Bounds on the precision and recall of any net- workonserversbecause(a)theyaremorepermanentinthe
working protocol, plotted for p = 0.2. Dandelion has network, and (b) it is straightforward to generalize server-
stronganonymityproperties,achievingaprecision-recallre- oriented anonymity solutions to also protect clients.
gion close to the fundamental lower bounds. We model the P2P network as a graph G(V,E), where
V is the set of all server nodes and E is the set of edges,
or connections, between them. For a node v, Γ(v) denotes
ingprotocolcalledDandelion,whoseachievableprecision- thesetofv’sneighborsinG. SimilarlyforasetofnodesU,
Γ(U)denotesthesetofallneighborhoodsetsofthenodesin
recall region is nearly optimal, in the sense that it is con-
U. Tomodelthegraph’stopology,wefirstdiscussBitcoin’s
tained in the achievable region of (nearly) every other pos-
network management protocols.
sible networking protocol.
Dandelion consists of two phases. In the first phase, Each node in the Bitcoin P2P network has an address
manager—a list of other nodes’ contact information repre-
each transaction is propagated on a random line; that is,
sented as a (IP address, port) pair, along with a time es-
eachrelaypassesthemessagetoexactlyone(random)node
timate of when that node was last active. When a server
forarandomnumberofhops. Inthesecondphase,themes-
sage is broadcast as fast as possible using diffusion. Dan- first joins the network, its address manager is empty, but
delion has two key constraints: (a) in the first phase, all thenodecanlearnarandomsetofactiveaddressesbycon-
tacting a hard-coded DNS server. During normal network
transactionsfromallsourcesshouldpropagateoverthesame
operation,nodesperiodicallyrelayentriesfromtheiraddress
line, and (b) the adversary should not be able to learn the
managers, which helps spread information regarding active
structure of the line beyond the adversarial nodes’ immedi-
peers. We model address managers by assuming that each
ate neighbors.
The point labeled ‘Dandelion’ in Figure 1 is the Pareto node possesses the contact information for every other Bit-
frontier of Dandelion’s achievable precision-recall region. coin server. In practice, address managers actually contain
a random sample of population IP addresses.
Wecomparethistotheachievableregionfordiffusion. The
Each server is allowed to establish up to eight outgoing
point labeled ‘Diffusion’ was obtained by simulating a dif-
connections to nodes in the server’s address manager. An
fusion process on a snapshot of the Bitcoin server network
outgoing connection from Alice to Bob is one that is initi-
from2015[32],andusingasuboptimalsourceclassifier. Be-
atedbyAlice. However,theseTCPconnectionsarebidirec-
causeofthis,theachievableregionmustcontaintheplotted
tionalonceestablished. Wethereforemodelthesubgraphof
point, but may be larger. Not only is the region for diffu-
sionasupersetoftheoneforDandelion,butDandelion’s server-to-server connections as a random 16-regular graph.
Inpractice,thedegreedistributionisnotquiteuniform—we
region is nearly as small as possible. We revisit Figure 1 in
revisit this issue in Section 6.
greater detail in Sections 3 and 5.
(3) Practical implementation. We outline the practi- 2.2 TransactionModel
calchallengesassociatedwithimplementingDandelion. In
particular, constructing the graph for Dandelion in a dis- As explained in Section 2.3, the network is partitioned
into honest nodes and colluding, adversarial nodes, who at-
tributedfashion,andenforcingtheassumptionthatthead-
tempt to deanonymize users. In this work, we assume that
versarycannotlearnthegraph,arenontrivial. Wetherefore
all honest nodes generate one transaction in the time pe-
propose simple heuristics for addressing these challenges in
riod of interest. In practice, servers generate transactions
practical implementations.
atdifferentrates;however,alltransactionsbyasinglenode
Paper Structure. We begin by discussing Bitcoin’s P2P are identified by the node’s public key (as long as the node
networking stack and our problem of interest, which we does not generate fresh keys). Therefore, we treat multiple
modelinSection2. Wethenpresentfundamentalboundson transactions from the same node as a single transaction to
ouranonymitymetricinSection3;theseboundsareusedfor bedeanonymized. Wealsoassumetheexacttimewheneach
comparisonwithvariousnetworkingpolicieslaterinthepa- serverstartsbroadcastingitstransactionisunknowntothe
per. InSection4,wepresentsomefirst-ordersolutions,and adversary. A typical transaction can take up to 60 seconds
explainwhytheydonotwork. Wepresentourmainresult, to propagate through the Bitcoin network [16], so estimat-
Dandelion, in Section 5. Section 6 discusses the systems ing its time of origin at a useful granularity of a second or
3
sub-second can be difficult. X is the set of all transaction w
messagesfromhonestservers. X isthetransactionmessage |V |=7
v H t=2
originating from honest server v and X is a vector contain-
ing the ground truth mapping between source nodes v and |VA|=3 u t=1
transactions Xv. We model the mapping between servers Su ={(Xv,w,2),...} v Xv
and transaction messages as being drawn uniformly from
the set of all such mappings.
SpreadingModel. OnceaBitcointransactioniscomplete,
Figure 2: Red nodes are adversarial spies; blue nodes are
thesourcebroadcaststhetransactionmessageoverthenet-
honest. Message X reaches the spy w at time t=2.
work. The protocol for broadcasting transactions should v
ensure low transaction latency, in order to provide network
consistency and fairness.
Bitcoincurrentlyusesadiffusion propagationmechanism to the adversary plays a special role.
to broadcast transactions, in which each transaction source Inadditiontothetransactiontimestamps,theadversaries
orrelaypassesthetransactiontothenode’sneighborswith can also learn the network structure G, partially or com-
independent, exponential delays. Once a node has received pletely, over time. The extent of such knowledge depends
a particular transaction, the node does not accept future on the dynamism of the network, and will be made clear in
relays of the transaction. This diffusion spreading serves as the context of the specific networks being considered. For
a baseline for our algorithmic improvements. It has good example,ifthenetworkisstaticoveranextendedperiodof
latency properties due to its exponential spreading [5]. time then adversaries can learn the entire graph G. On the
More generally, in this work, we consider spreading poli- otherhand,inafastchangingnetwork,theadversarieshave
ciesthataresymmetricintheneighbornodeIDs;thatis,a knowledgeofonlytheirlocalneighborhoodΓ(VA). Forease
forwardingnodedoesnotusetheIPaddressvalues(orother ofexposition,letus,fornow,useΓtodenotetheadversary’s
metadata) of its neighbors to influence its forwarding deci- knowledge of the graph.
sions. This holds for diffusion spreading, but we constrain Oncethetimestampshavebeencollected,theadversarial
our proposed solutions to also satisfy the same property. nodescolludetoinferthetransactionsource. Theadversary
uses its observations O = (S,Γ) to output a mapping be-
2.3 AdversarialModel tween transactions and honest servers; we let M(Xv) ∈ VH
denote the server associated withtransaction X inthe ad-
We consider an adversary whose goal is to deanonymize v
versary’smapping. Thismappingischosentomaximizethe
users by linking their transactions (and hence, their public
adversary’s deanonymization payoff, defined in Section 2.4.
keys) to their IP addresses. In particular, we are interested
indefendingagainstbotnets—largesetsofmalware-infected
2.4 AnonymityMetric
hosts that are controlled remotely, often without the host
owners’ knowledge [47]. Botnets are a commonly-studied A common metric for measuring a broadcasting scheme’s
adversarialmodelforvariousBitcoinattacks[3],largelybe- anonymityisprobability of detection. Forafixedtrans-
cause they are easy to access, cheap, and pervasive in the action and estimator, probability of detection is defined as
Bitcoinnetwork[37]. Whilebotnetscanhavemanyuses,we
wish to defend against a botnet that aims to deanonymize P (detection)= (cid:80)v∈VHP(M(Xv)=v), (1)
users. M,G n˜
Wemodelthebotnetadversaryasasetofadversarial,col-
luding“spy”nodes that participate in the Bitcoin network or the probability that the estimator outputs the correct
as if they were honest nodes (i.e., honest-but-curious). We sourceofasingletransaction,computedoveralltransaction
denote honest nodes by V and adversarial nodes by V . sources v ∈ V , mappings between sources and transac-
H A H
Foraparameterp,weassumeafixednumberofadversarial tions X, realizations of the message propagation trajectory,
nodes (|V |=np) and honest nodes (n˜ =|V |=(1−p)n). and graph realizations G (if the graph is random). While
A H
The adversarial nodes are dispersed uniformly at random probability of detection considers a single source, our prob-
in the network; this reflects the botnet’s ability to obtain lemconsidersthejointdeanonymizationoftransactionsfrom
IP addresses uniformly across the IP address space. How- distinctsources. Inthiscase,probabilityofdetectioninher-
ever, for a given topology, the actual locations of the hon- ently captures the recall, or completeness, of an estimator.
est/adversarial nodes are random. We further assume that We propose to augment this metric by also studying preci-
allnodesknowthecompletelistofactiveIPaddresses,and sion, which captures the exactness of an estimator.
honestnodescannotdistinguishbetweenanadversarialand Precision and recall are performance metrics commonly
honest IP address. used in information retrieval for binary classification. Sup-
Wheneveratransactionisbroadcastoverthenetwork,the pose we have n data items, each associated with a class: 0
adversarialnodeslogthetimestampsandthehonestneigh- or 1. We are given a classifier that labels each data item
bors from which they receive the transaction. We assume as either a 0 or a 1, without access to the ground truth.
a continuous-time system, in which simultaneous transmis- We designate one of these classes (e.g. class 1) ‘positive’.
sions do not occur. For each honest server node v, we let For a given classifier output on a single item, a true posi-
S denotethesetof(transaction,receivingspynode,times- tive meanstheitemwascorrectlyassignedtoclass1,anda
v
tamp) tuples (x,u,T (x)) such that transaction x was for- truenegative meanstheitemwascorrectlyassignedtoclass
u
wardedbyhonestnodevtoadversaryu∈V attimeT (x) 0. A false positive means a 0 item was incorrectly classified
A u
(Fig. 9);SisthevectorofallS ’s. WeshallseeinSection5 as a 1, and a false negative means a 1 item was incorrectly
v
thatthehonestserverwhofirst deliversagiventransaction classifiedasa0. Ifwerunthisclassifieronallndataitems,
4
precision and recall are defined as follows: then, are the overall expected precision D =E[D ] and re-
M M
callR =E[R ]. Thisexpectationistakenoverfourrandom
|True Positives| M M
Precision = variables: thegraphrealizationG(whichcanberandomin
|True Positives|+|False Positives| general),themappingbetweenserversandmessagesX,the
|True Positives| observedtimestampandtopologicalinformationO,andthe
Recall =
|True Positives|+|False Negatives| adversary’s mapping strategy M. Similarly let DM(v) and
D (v) denote the instantaneous and expected precisions at
M
where|·|denotesthecardinalityofaset,and‘TruePositives’ a server v ∈ V , and let R (v) and R (v) denote the in-
H M M
denotesthesetofalldataitemswhoseclassificationoutput stantaneous and expected recalls. Let D and R de-
OPT OPT
was a true positive (and so forth). note the precision and recall, respectively, of the precision-
Precision can be interpreted as the probability that a maximizing and recall-maximizing mapping strategies, re-
randomly-selected item with label 1 is correct, whereas re- spectively. Theoptimalprecisionisnotnecessarilyachieved
call can be interpreted as the probability that a randomly- by the same mapping strategy as the optimal recall. The
selecteddataitemfromclass1iscorrectlyclassified. Adapt- adversary is computationally unbounded.
ing this terminology to our problem, we have a multiclass
classificationproblem;eachserverisaclass,andeachtrans- 2.5 ProblemStatement
action is to be classified. For a given server v and mapping As network designers, we control two aspects of the net-
M, the precisionDM(v) comparing class v to all other classes work: thegraphcreation/maintenancestrategyandthespread-
is computed as1 ingprotocol. Ourgoalistochooseagraph-selectionstrategy
1{M(X )=v} and a spreading protocol that simultaneously give low av-
DM(v)= (cid:80) 1{Mv(X )=v}, (2) erage latency, precision, and recall guarantees. We restrict
w∈VH w ourselves to the following model of graph generation: For
a fixed topology τ, we assume that the nodes are equally
and the recall is computed as
likely to assume each possible label ordering in τ. Moving
R (v)=1{M(X )=v} (3) forward, G(V,E) will describe the resulting, labeled graph.
M v
LetT denotethesetofallgraphtopologiesovernnodes,
where 1{·} denotes the indicator function. In multiclass and Σ the set of graph-independent spreading strategies.
classification settings, precision and recall are often aggre- The adversary controls only the estimation algorithm for
gatedthroughmacro-averaging,whichconsistsofaveraging mappingtransactionstonodes. Givenatopologyτ ∈T and
precision/recall across classes. This approach is typically aspreadingstrategyσ∈Σ,letM denotethesetofmap-
τ,σ
usedwhenthenumberofitemsineachclassisequal[44],as ping strategies that map n˜ transactions to n˜ servers, with
in our problem. We therefore average the precision and re- all knowledge derived from the topology and the spreading
calloverallserversandtakeexpectation,givinganexpected strategy. If τ and σ are clear from context, we simply use
mreacacrlloo-afvEer[RagMe]d=prn˜1e(cid:80)cisvio∈nVHofEE[R[DM(Mv])=]. n1˜ (cid:80)v∈VHE[DM(v)]and Mdetetcotidoennroetgeiothnefospraτcaenodfmσaapsptihnegssettroafteagciheise.vWabeledperfienceistiohne
Wenowexplainwhyprobabilityofdetectiondoesnotcap- and recall operating points:
turethedistinctionbetweenprecisionandrecall. First,note
Ω(τ,σ)={(D,R) | ∃ M∈M , D=D ,R=R }.
that the expected per-node recall is identical to the proba- τ,σ M M
bility of detection. Now consider two estimators: in the Note that the detection region always contains the origin.
first, the adversary’s strategy is to assign all n˜ transactions The adversary’s goal is to find estimators that achieve the
toonerandomly-selectedserverv. Inthesecond,theadver- boundary points of the region, whereas our goal is to make
sarycreatesarandommatchingbetweenthen˜ transactions the detection region as small as possible.
and honest servers. Both estimators have a probability of Problem: Characterizefundamental,protocol-independent
detection (i.e., expected per-node recall) of 1/n˜. However, bounds on the detection region. Further, identify a (τ∗,σ∗)
the first estimator has an expected per-node precision of pair whose detection region is a subset of the detection re-
1/n˜2, while the second has an expected per-node precision gion of every graph-generation and spreading strategy:
of1/n˜. Operationally,thiscanbeinterpretedasadifference
in plausible deniability: the implicated node v in the first Ω(τ∗,σ∗)= (cid:92) Ω(τ,σ). (4)
casecandenybeingthesourceofanygiventransaction,be- σ∈Σ,τ∈T
cause it could not have generated all n˜ transactions. If a It is unclear a priori if such a strategy pair exists. In this
node is correctly implicated in the second estimator, it has work, we show a simple networking policy that closely ap-
noplausibledeniability. Probabilityofdetectionalonedoes proximates condition (4).
not capture this difference, and is therefore insufficient as a
standalone metric. 3. ANONYMITYMETRICPROPERTIES
In this work, we quantify anonymity through a combi-
Precision and recall are not generally used as anonymity
nation of expected macro-averaged precision (or“pre-
metrics,sincemostanonymitysystemsprovideper-userano-
cision”for short) and expected macro-averaged recall
nymityguarantees[17,20,41,18]. Weinsteadwantguaran-
(or“recall”, or probability of detection). Higher precision
teesagainstastrongeradversarythatjointlydeanonymizes
and recall favor the adversary. For a mapping strategy M
multiple users. The goal of this section is to give intuition
let D and R denote the average precision and recall, re-
M M aboutprecisionandrecallasmetrics,andtoprovidefunda-
spectively,obtainedinarealization. Ourmetricsofinterest,
mental bounds on both.
1Following convention we define D (v) = 0 if both the nu- Ourproblemdiffersfromtraditionalclassificationinthat
M
merator and denominator are 0 in Equation (2). there is only one data item (transaction) per class (server).
5
11 1
Thisrestrictsthesetofachievablemacro-averagedprecision-
(12)
recall points in a somewhat unconventional way. We first
epxropvlaeinfuhnodwamperenctiasliobnouannddsretchaaltlialrluesttyrpaitceatllhyeuwseady,sainndwthhiechn on (5a) on
ourproblemdiffersfromtraditionalclassificationproblems. recisinoisicerP (5b) recisi
Precision-Recall Curves. Mostbinaryclassifiershavean P (ii) P
internal parameter (e.g., a threshold) that can be varied to p (i) (11)
give the classifier different precision and recall character- pp22
istics. Sweeping this parameter typically yields a tradeoff 00 pp RReecacllall 11 0 Recall 1
between precision and recall. While this tradeoff has been
studied theoretically [38], it is most often illustrated em- Figure3: Boundsontheprecision-recalldetectionregionfor
pirically for a given classifier, through curves like Figure 3 anynetworkingpolicy(left). Eachboundislabeledwiththe
(right). Notably, a classifier can achieve high recall (≈ 1) correspondingequationnumberfromSection3. Exampleof
attheexpenseofprecisionbyassigningalldataelementsto a typical precision-recall curve (right).
thepositivecategory,orhighprecision(≈1)attheexpense
of recall by classifying only data elements that are clearly
true positives. Hence the precision-recall points (0,1) and Theorem 2. The optimal precision and recall on a net-
(1,0) are typically achievable in practice. work with a fraction p of adversaries and any spreading pol-
Unliketraditionalprecision-recallcurves,wearenotinter- icy are lower bounded as
estedinthecurveforasingleestimator;wewanttoidentify
D ≥ p2 (6)
theachievabledetectionregionacrossall estimators. More- OPT
over, since ours is a multi-class classification problem, we ROPT ≥ p. (7)
consider macro-averaged precision and recall. With macro-
averaging,increasingtherecall(resp. precision)foroneclass (Proof in Section A.1.2)
will often reduce the recall (resp. precision) for another. This theorem implies that for any networking policy, the
Therefore,itisunclearwhattheprecision-recalltradeoffwill detectionregionmustincludeatleastonepointintheshaded
looklike,oreveniftheboundarypoints(0,1)and(1,0)are region of Figure 3 (left). Note that if an estimator can
achievable. The following theorem restricts the set of feasi- achieve a given (recall, precision) point, then it can also
ble,macro-averagedprecision-recallpointsforany estimator achieve points with elementwise lower precision and recall
the adversary employs. by choosing to discard observed information. The purple
curves labeled (i) and (ii) outline the boundaries of two ex-
Theorem 1. AnymappingpolicyM∈M onanetwork amples of feasible detection regions, staggered for visibility.
τ,σ
with topology τ ∈ T and spreading strategy σ ∈ Σ has a
Optimizing Estimators. Given these constraints on the
precision and recall that are bounded as
detection region, we want to understand what estimators
(a) (b)√ achievethemaximumprecisionandrecall,respectively. For
D ≤ R ≤ D . (5)
M M M a given network specification, precision and recall might be
maximized by different estimators; if this is the case, then
(Proof in Section A.1.1)
the detection region will have a nontrivial Pareto frontier,
Thistheoremfollowsfromthedefinitionofmacro-averaged
like curve (i) in Figure 3 (left). On the other hand, if the
precisionandrecall;itimpliesthatnotonlyarecornerpoints
sameestimatormaximizesprecisionandrecall,thedetection
(0,1) and (1,0) unachievable, but every estimator’s detec-
region’sParetofrontierwillbeasinglepoint,likecurve(ii).
tionregionmustliebetweentheblueandredlinesinFig. 3
We start by proving that in order to maximize precision,
(left). Given this constraint, a natural question is whether
the adversary should use a maximum-weight matching es-
there exist precision and recall points that can always be
timator, where the weights depend on the information ob-
achieved,regardlessofthenetworkingprotocol. Wedemon-
servedbytheadversary,suchasgraphstructureandtimes-
strate the existence of such points by analyzing a simple
tamps.
estimator.
Theorem 3 (Precision-Optimal Estimator). The
LowerBounds. Computinglowerboundsonprecisionand
precision-optimizing estimator for an adversary with obser-
recall is challenging because the adversary’s knowledge can
vations O = (S,Γ), is achieved by a matching over the
vary depending on the networking policy. However, the so-
bipartite graph (V ,X). Moreover, such a matching is a
calledfirst-spy estimator (whichisusedinpracticalattacks H
maximum-weight matching for edge weights P(X = x|O)
like [7]) relies only on the adversary’s knowledge of its lo- v
on each edge (v,x)∈V ×X of the graph.
calnetworkneighborhood. Theadversariesweconsiderwill H
always have access to this information. The first-spy esti- (Proof in Section A.1.3)
matoroutputsthefirsthonestnodetosendagivenmessage Theorem3givesacorollaryusedinSection4forbounding
to any of the adversarial nodes. We start by showing that the performance of various networking protocols.
thefirst-spyestimatoralwaysachievesaprecisionandrecall
of at least p2 and p, respectively, where p is the fraction of Corollary 1. Theoptimalexpectedpayoffataserverv,
spies. Thisinturnimpliesthatthemaximumprecisionand under observations O=(S,Γ) for the adversaries, is upper
recall over all estimators are individually lower-bounded by bounded as
p2 and p, respectively. E[D (v)|O]≤maxP(X =x|O). (8)
OPT v
x∈X
6
(Proof in Section A.1.4) Spreading protocol. The space of spreading protocols is
Computing the probabilities in Corollary 1 may be chal- vast. In this work, we consider a few natural, first-order
lenging, depending on how much information the adversary spreading policies, and also propose a new protocol called
has. Nonetheless, if the adversary can approximate these dandelion spreading.
probabilities with some accuracy (e.g., if it knows the un- Perhaps the most natural spreading strategy is flood-
derlying graph G), there exist polynomial-time algorithms ing, where messages are propagated with a fixed delay to
for computing max-weight matchings [21, 6]. all neighbors. A slightly refined version is diffusion, which
Theprecision-optimalmaximum-weightmatchingdoesnot adds independent randomness to the transmission delays of
necessarily maximize recall. Notice that for any matching, flooding. Diffusion is explained in Section 2.2. Flooding
its precision and recall are equal, due to the definitions of and diffusion reflect the current status quo in the Bitcoin
precision and recall. The following theorem characterizes a network.
recall-optimal estimator, which assigns each message x to Giventhatourgoalistoprovideanonymity,anothernat-
any server v for which P(X =x|O) is maximized. ural strategy is to forward a message to a randomly-chosen
v
node, which then runs diffusion or flooding. We call this
Theorem 4 (Recall-Optimal Estimator). The
spreading protocol diffusion-by-proxy.
recall-optimizing estimator for an adversary with observa-
Finally, we propose in this paper a new protocol called
tionsO=(S,Γ),isamappingthatassignseachtransaction
dandelion spreading. Dandelionspreadingforwardseach
x∈X to any server v∗ ∈argmax P(X =x|O).
v∈VH v message on a randomly-selected line before diffusing it to
therestofthenetwork. Sincedandelionspreadingisacom-
(Proof in Section A.1.5)
parativelynewprotocol(notafirst-orderbaseline),wedefer
The first-spy estimator is an instance of a recall-optimal
a detailed discussion to Section 5.
estimator for spreading models in which the exit node to
thefirst-spyisthemostlikelysource. Moreover,Theorem4 Topology. We are interested in topologies that are si-
impliesthataprecision-optimal,maximum-weightmatching multaneously simple to construct, analyzable, and good for
is only recall-optimal if it also maps each message to its anonymity. Wethereforelimitourselvestoasetofcanonical
most likely source, elementwise. For example, if k servers graph models: lines, trees, d-regular graphs, and complete
areequallylikelysourcesforkmessages,thentheprecision- graphs. These categories are not mutually exclusive; lines
optimal matching estimator is also recall-optimal. are a special case of both trees and regular graphs (we con-
siderlinesandcyclesinterchangeably),andcompletegraphs
Summary. This section provides fundamental limits on are a special case of regular graphs.
both precision and recall, as well as detailing estimators
Dynamicity. Many network-based deanonymization at-
that optimize precision (Thm 3) and recall (Thm. 4), re-
tacksusepartialorfullknowledgeoftheconnectivitygraph
spectively. Thesefundamentallimitsandestimatorswillbe
betweennodes[45]. Weassumethatthenetworkcanchange
usefulbenchmarksasweanalyzetheprecision-recallregions
the graph at varying rates to control the adversary’s abil-
for networking policies in Sections 4 and 5.
ity to learn it. We consider two extremes on this spectrum:
staticgraphsanddynamicgraphs. Instaticgraphs,thenet-
4. BASELINEALGORITHMS
workneverchangesthegraph,sotheadversarylearnsitfully
With the fundamental bounds from Section 3, we now overtime. Indynamicgraphs,thegraphischangedatarate
tackle our main problem: designing a networking policy such that the adversary only knows its local neighborhood
with a minimal detection region. A key message of our at any given point in time.
work is that statistical anonymity requires mixing of mes-
sages: users should spread their own messages and those of Intheremainderofthissection,wefirstexploretheregions
their peers in a way that is difficult to distinguish. Degree ofourtaxonomybystudyingthreebaselinenetworkingpoli-
of mixing depends on three key properties of a networking cies: flooding, diffusion, and diffusion-by-proxy. Although
policy: (1) the spreading protocol, (2) the topology of the none of these baselines has satisfactory anonymity guaran-
network, and (3) the dynamicity of the network (i.e., how tees,theassociatedanalysisprovidesvaluableintuitionthat
oftentheP2Pgraphchanges). Forexample,thecurrentBit- helps us design better policies in Section 5.
coin network uses diffusion spreading over a static, roughly
4.2 Flooding
16-regular topology. This policy has poor mixing—i.e., a
largedetectionregion—becausedifferentnodeshaveunique To model flooding, we assume that messages propagate
spreading patterns and can therefore be deanonymized. alongeachgraphedgewithadeterministicdelay,andnodes
Inthissection,wefirstidentifyataxonomyofnetworking forward incoming messages to their neighbors with a con-
policies, based on the properties above. We then system- stant delay. On undirected topologies, flooding has poor
atically evaluate the anonymity of various first-order, natu- source-hidingduetosymmetryandthedeterministicspread-
ral networking policies from this taxonomy. We show that ingscheme. However,itisunclearifdirectedtopologiesfare
mostofthesebaselinepolicieshavepooranonymityguaran- better. Webeginbyshowingthatfloodinghaspoorperfor-
tees,andweextractrulesofthumbforimprovingapolicy’s mance on directed, static, d-regular graphs.
anonymity. Theserulesofthumbwillbuildthegroundwork Proposition 1. The expected precision of flooding on a
for our main result, Dandelion, presented in Section 5. static d-regular graph is at least D ≥(1−(1−p)d)≥p.
OPT
4.1 TaxonomyofNetworkingPolicies
(Proof in Section A.2.1)
Our taxonomy has three axes: spreading protocol, topol- Floodingperformspoorlyonstaticregulargraphsbecause
ogy, and dynamicity. We consider multiple categories along eachhonestnodehasauniquespreading“timestampsigna-
each axis. ture”,andtheadversarycanpredictthesesignatures. That
7
is, if node v is the source, then the adversarial nodes re- Proposition 3. Theexpectedfirst-spyprecisionofdiffusion-
ceive all messages from v in a deterministic timing pattern. by-proxy is bounded as
Moreover, the adversary can predict this pattern from the p
D ≥ (1−ep−1). (9)
structure of the graph, due to the fixed nature of flooding. FS 1−p
This reasoning suggests that if the adversary does not
(Proof in Section A.2.3)
know the graph, it cannot predict nodes’ spreading pat-
Intuitively, this statement holds because each node de-
terns, and therefore cannot deanonymize nodes. However,
livers its own message to the adversary with probability p,
thefollowingpropositionshowsthatevenwhenthegraphis
and few other nodes report to the adversary over the same
dynamic, the adversary can achieve a high precision.
edge. Soeventhoughdiffusion-by-proxybreaksthesymme-
Proposition 2. Floodingprecisionfordynamicd-regular tryofdiffusion,italsoprovidesmanypathsformessagesto
graphs is bounded as D ≥cp for some constant c>0 in- reachtheadversary. Sincetherearemanytotalpathstothe
OPT
dependent of p. adversary, each path sees (relatively) less traffic, which in
turn reduces the amount of mixing that happens. A simple
(Proof sketch in Section A.2.2) countermeasureistoreducethenumberofpathsoverwhich
This result highlights that even if the adversary cannot messages can flow.
predicttheexacttimestamppatternforagivennode,itcan
Lesson: Thereisanonymityinnumbers;densegraphsachieve
infercertainstatisticalpropertiesofthepatternthataresuf-
poormixingbecausetheydonotconstrainmessagestoflow
ficient for deanonymization. In short, as long as the topol-
over the same paths.
ogy allows messages to flood in more than one direction,
the adversary can use the statistics of observed timestamp
5. MAINRESULT:DANDELION
signatures to infer the source of a message.
ThebaselinespreadingprotocolsfromSection4provideus
Lesson: Do not flood content in multiple directions on the
withakeyguidelineforbuildingmoreanonymousnetwork-
graph at the same rate.
ing policies: spread asymmetrically over a sparse graph. In
4.3 Diffusion this vein, we propose a new protocol: dandelion spread-
ing. Whilethebasicintuitionofdandelionspreadingisused
Diffusionisanaturalsuccessortoflooding; insteadofus-
inseveralpoint-to-pointanonymouscommunicationsystems
ing deterministic delays, it uses random ones. By introduc-
[17, 41], it has not been formally studied in the context of
ing uncertainty into the adversary’s timing estimates, dif-
anonymous broadcast messaging.
fusion reduces the adversary’s overall precision and recall.
However, much research in recent years has shown that the
Algorithm 1: Dandelion Spreading. N (G,v) de-
source of a diffusion process can nonetheless be identified out
notes the out-neighbors of node v on directed graph G.
reliably [45, 46, 19, 48, 30, 39, 36, 51]. Although there are
no theoretical results on the precision or recall under our Input: Message Xv, source v, anonymity graph G,
particularadversarialmodel,severalheuristicestimational- spreading graph H, parameter q∈(0,1)
gorithmsareabletoidentifythesourceofadiffusionprocess anonPhase ← True
onmanyclassesofgraphs[36,51]. Moreover,theoreticalre- head ←v
sults exist on other adversarial models [45, 46, 48]. All of recipients ←{v}
theseresultsrelyontheintuitionthatdiffusionspreadscon- while anonPhase do
tentsymmetrically. Becauseofthis,thesourcenodeappears /* forward message to random node */
atthecenteroftheadversary’sobservedspreadingpattern, target ∼ Unif(Nout(G,head))
and can be identified. Diffusion is therefore not a satisfac- recipients ← recipients ∪{Xv} from head to target
tory solution to this problem. head ← target
u∼ Unif([0,1])
Lesson: Randomforwardingdelaysarenotpowerfulenough
if u≤q then
toprovideanonymityagainstspreadingprotocolsthatspread
anonPhase ← False
content symmetrically.
end
4.4 Diffusion-by-Proxy end
/* Run diffusion over H from ‘head’ */
Thetakeawaymessagefromdiffusionandfloodingisthat
Diffusion(X ,head,H)
symmetryofspreadingleadstodeanonymization. Tocounter v
this, we must break the symmetry of diffusion. A natural
strategy for breaking symmetry about the source is to ask Dandelion spreading consists of an anonymity phase and
someoneelsetospreadthemessage. Thatis,foreverytrans- a spreading phase (Algorithm 1). In the anonymity phase,
action,thesourcenodechoosesapeeruniformlyatrandom the protocol spreads the message over a randomly-selected
fromthepoolofallnodes. Ittransmitsthemessagetothat line for a random number of hops; in the spreading phase,
node, who then broadcasts the message. More generally, themessageisbroadcastusingdiffusionuntilthewholenet-
the network could forward each message a few hops (each work receives the message. In general, the two phases can
hopchoosinganewnodeatrandom)beforediffusingit. We occur over different graphs. In this work, we will design a
call this approach diffusion-by-proxy, and it is conceptually (possibly time-varying) graph G over which the anonymity
equivalenttopropagatingoveralinethatchangesforevery phaseoccurs,andwewillassumethespreadingphaseoccurs
transmission. Diffusion-by-proxy might seem like it should overthecurrentBitcoinP2PnetworkH. Thename‘dande-
havelowprecisionbecausethegraphissodynamic,butthat lion spreading’ reflects the spreading pattern’s resemblance
intuition turns out to be false. to a dandelion seed head (Figure 4).
8
2) Spreading Theorem 5. Theexpectedmaximumrecallfordandelion
Phase
1) Anonymity spreading on any connected graph of n nodes with a fraction
Phase p of adversaries is R =p.
OPT
(Proof in Section A.3.1)
The reason for this result is that dandelion spreading
propagatescontentunidirectionallyoveraline. Thislackof
symmetrymakesthefirst-spyestimator—whichhasarecall
of p—optimal. Theorem 5 result implies that as we explore
various topologies of dandelion spreading, we only need to
Figure 4: Dandelion spreading forwards a message in a line
analyze and minimize their precision. We do so for three
overthegraph,thenbroadcastsitusingdiffusion. Hereboth
topologies of the graph G: static trees, dynamic trees, and
phases occur over the same graph, i.e., H =G.
dynamic lines. Each topology provides intuition about how
to achieve anonymity. We find that dynamic lines achieve
Thetwo-phasenatureofdandelionspreadingallowsusto nearly-optimal average precision and recall.
separatelydesignnetworkingpoliciesthatoptimizeanonymity
5.1 StaticTrees
and latency. This separated architecture is not necessarily
optimal in terms of a latency-anonymity tradeoff; explor- Recall that our goal is to mix messages from different
ing that tradeoff is an interesting direction for future work. users; in this sense, trees are a natural topology to study.
However,diffusionisknowntohavegoodspreadingproper- Thatis,considerarooted,directedd-regulartree,witheach
ties [5], but poor anonymity properties [45]. Therefore, we edge directed toward the parent node. Dandelion spread-
combineitwithananonymityphaseofconstantduration(in ing respects the directedness of the graph, so during the
an order sense), such that the average latency is increased anonymity phase, each node passes all messages to its par-
by a small, bounded factor. We subsequently assume that ent node (i.e. toward the root). Nodes near the root are
the spreading phase can be fully deanonymized; i.e., the thereforeabletomixtheirownmessageswithexponentially-
node that launches the diffusion process can be identified. many other messages from users beneath them in the tree.
As such, we only need to analyze the precision and recall Howevernodesneartheleavesofthetreehavefewnodesbe-
of the anonymity phase. This assumption does not weaken neaththem,andthereforeexperienceminimalmixing. This
ouranonymityguaranteessinceitgivestheadversarymore fundamentalasymmetryresultsinahighaverageprecision.
power.
Proposition 4. The expected precision under a match-
A key observation for this analysis is that the anonymity
ing estimator MAT on any tree is given by D =p.
phase of dandelion spreading largely removes the need for MAT
exact timestamps. Forhonestserverv,letS(cid:48) ⊆S denotea
v v (Proof in Section A.3.2)
trimmed down version of S , in which we retain only those
v Intuitively, when the graph is known, the adversary can
transaction log tuples (x,u,T (x)) that correspond to the
u partitionnodesintowards,orsetsofhonestnodesthatshare
first time transaction x was received by an adversary from
thesamefirstspy. Eachwardcontributesequallytothead-
any honest node. That is, we only keep a tuple if u was
versary’s precision, so we would like to minimize the num-
the first spy to see message x, and x was delivered to u
ber of wards. On trees, the expected number of wards is
by honest exit node v. As before, let S(cid:48) denote the vec-
pn˜,mostofwhichconsistofasingleleafwithanadversarial
tor of all S(cid:48)’s. Then, with dandelion spreading, it holds
v parent node. This gives an overall precision of p.
that X−(S(cid:48),Γ)−S forms a Markov chain. Therefore it
Although a precision of p is an improvement over Bit-
is sufficient to use only the first observation information S(cid:48)
coin’s current networking policy, we would like to achieve a
instead of S for computing transaction likelihoods. In fact,
precision close to the lower bound of p2 (Theorem 2). We
the sufficient statistic S(cid:48) can be further simplified by ignor-
therefore consider topologies with fewer wards on average.
ing the timestamp coordinate T (x) in the tuples. This is
u
possible due to our assumption that the transactions’ origi- Lesson: Usetopologiesinwhichitisdifficultfortheadver-
nating times are unknown a priori to the adversary, which sary to partition nodes into wards.
removes the observed timestamps from any temporal refer-
5.2 DynamicTrees
ence frame. Hence, in the remainder of this paper, with a
slight abuse of notation, we use S , for honest server v, to The adversary was able to partition the nodes of a static
v
denote the set of message tuples (x,u) such that (i) u was tree into wards largely because the graph was known. A
the first adversarial node to receive x and (ii) u received x natural question is whether dynamic trees have the same
from v. S denotes the vector of S ’s. problem, since most of the graph is hidden, except the ad-
v
Notethatasimilarargumentdoesnotholdforspreading versary’s local neighborhood.
mechanisms like flooding or diffusion, in which multiple in- Aperfectd-arytreeisarootedtreeinwhicheachnodehas
dependent timestamps across different nodes (i.e., not just eitherdchildrenornochildren,andallleavesareatthesame
thefirstobservationofamessage)areusedtocomputelike- depth. Again,weassumeeachedgeinsuchatreeisdirected
lihoods. The diversity of such observations allows the es- toward the parent node. We find that dandelion spreading
timator to compare timestamps across nodes, thus making on perfect d-ary trees has an expected precision similar to
them useful for detection. that of static trees.
Webeginbyshowingthatthemaximumrecallfordande-
Proposition 5. The expected precision of the first-spy
lion spreading over any connected topology is p, the lower
estimator on a perfect d-ary tree, d ≥ 2, can be bounded
bound from Theorem 2.
as D ≥p/2.
FS
9
(Proof in Section A.3.3) 1
Since the graph is now dynamic, the adversary cannot
explicitly determine every ward like it could in the static
case. However, the first-spy estimator naturally identifies
wardsthatconsistofasinglehonestleaf. Statistically,there
aremanysuchwardsontreesthatarenotlines,soweobtain
similar guarantees to the static case. This implies that the n Flooding
o
pleraovbelse.m with trees is mainly the fact that they have many ecisi Static Trees
r
P
Lesson: A dynamic graph does not mitigate the negative
impact of leaf nodes. Diffusion
p
5.3 DynamicLines: Dandelion Dynamic Trees
2p2 log(2) Dandelion
Next, we study dynamic line graphs. Lines are 2-regular 1−p pp2
trees,butunlikehigherdegreetrees,theydonotsufferfrom 0 p2 p 1
the asymmetry problems associated with leaves. However, Recall
line graphs seem to lack the strong mixing properties of
higher-degree graphs. Nonetheless, we show near-optimal Figure 6: Detection regions for studied networking policies,
precision for this class of graphs. This happens because p = 0.2. Dandelion has a detection region close to the
despite the moderate mixing on lines, the number of hon- fundamental lower bounds.
est nodes visible to the adversary is also small. As such,
theadversarycannotaccuratelypartitionnodesintowards,
the Pareto frontier for Dandelion is exactly the plotted
whichreducestheoverallprecision. Notethatthiswouldnot
point. Theotherpoliciesareanalyzedusingpossibly-suboptimal
holdinthestaticcase,sincetheadversarycouldidentifythe
estimators, so their detection regions must at least contain
wards exactly.
the plotted points.
Dandelion satisfiesthetheoreticaldemandsofourprob-
4-regular Dynamic Dynamic lem. However, implementing Dandelion in a distributed,
graph
robust fashion is nontrivial. In the next section, we dis-
Line
graph cusssomechallengesassociatedwithimplementingDande-
lion andpresentasimple,distributedimplementationwith
Dandelion Dandelion
spreading Static spreading Static empirically good performance.
Spreading Topology Dynamicity Spreading Topology Dynamicity
Protocol Protocol 6. SYSTEMSISSUES
Figure 5: The Dandelion networking policy: (1) dande-
lion spreading, (2) a line topology, (3) a dynamic graph. Theoretically,Dandelion issimpleandexhibitsdesirable
anonymity properties. However, the implementation raises
We use the name Dandelion to refer to a full network- a number of practical considerations, like how to construct
theunderlyinglinegraphandhowtoprovidesufficientgraph
ing policy (Figure 5): dandelion spreading over dynamic
dynamicity. We discuss each of these challenges, and intro-
lines(i.e.,2-regulargraphswithout-degree1). Webeginby
showing that Dandelion has near-optimal precision. duce practical, heuristic solutions for addressing them.
6.1 Constructingalinegraph
Theorem 6. The expected precision of Dandelion (i.e.,
In Dandelion, all nodes propagate their messages over
dandelion spreading on a dynamic line graph) with n nodes
the same line. To implement this, the network must build
and a fraction p<1/3 of adversaries, is upper bounded by
either a Hamiltonian circuit or a set of long, disjoint lines
2p2 (cid:18)2(cid:19) (cid:18)1(cid:19) in a fully-distributed fashion. Constructing a Hamiltonian
D ≤ log +O . (10)
OPT 1−p p n circuitischallenginginourcasebecauseitisnotaone-time
event;inordertoprovidedynamicity,thenetworkmustfre-
(Proof in Section A.3.4) quently construct a new random line. To ensure scalability,
Thisresultstatesthatforsmallp,theexpectedmaximum the algorithm for constructing such a line should be fully-
precision is within a logarithmic factor of our lower bound distributed, lightweight, and asynchronous.
of p2. The stated bound has loose constants for improved TraditionalalgorithmsforcomputingHamiltoniancircuits
readability; a tighter expression is included in the proof. are often computationally intensive and/or require central-
The proof depends heavily on the fact that the adversary izedcontrol[22,25],butrecentpapershavestudiedlightweight,
cannot reliably assign nodes to wards outside of its local distributedalternatives[26,29]. Forinstance,[29]firstgen-
neighborhood on the graph. As such, it is forced to use erates line fragments, then splices them together into a cir-
estimatorsthatwouldgivesuboptimalprecisioninthestatic cuit. However, it relies on the nodes of each line fragment
case, like variants of the first-spy estimator. knowingtheidentitiesofthefragment’sheadandtailnodes.
Figure 6 illustrates Dandelion’s detection region com- Thiscouldpartiallyrevealthegraphstructuretotheadver-
pared to those of other benchmark policies. The points for sary, which would likely change our anonymity guarantees.
diffusionandfloodingaregeneratedthroughsimulationover Ontheotherhand,[26]buildsupthecircuitsequentially;
asnapshotoftheBitcoinservergraphfrom2015[32]. Since a pair of nodes start as the circuit ‘seeds’. Each node v
dandelion spreading has optimally-low recall (Theorem 5), who joins the circuit contacts a random node u from the
10