📅 Original date posted:2014-08-19 📝 Original message:Encryption is of little ...

Jeff Garzik [ARCHIVE] /

npub1kf0…3f58

2023-06-07 15:25:21

in reply to nevent1q…0en0

📅 Original date posted:2014-08-19
📝 Original message:Encryption is of little value if you may deduce the same information
by observing packet sizes and timings.

On Tue, Aug 19, 2014 at 7:38 PM, J Ross Nicoll <jrn at jrn.me.uk> wrote:
> The concern is that if you can monitor traffic in and out of a single node,
> you can determine which transactions originate from it vs those which it
> relays. That's not great, certainly, but how many nodes actually require
> that level of security, and surely they can use Tor or VPN services if so?
>
> Further, unless the remote nodes are in some way trusted, you're changing
> the attack from read-only to requiring the ability to perform a man in the
> middle attack - that doesn't seem much harder to me.
>
> As Gregory states, there's been at least two recent serious if not
> catastrophic OpenSSL bugs, and the consequences of Heartbleed if the Bitcoin
> network had been vulnerable are the stuff of nightmares.
>
> Very difficult to see the risk/reward payoff being worthwhile.
>
> Ross
>
>
> On 19/08/2014 18:35, Johnathan Corgan wrote:
>
> On 08/19/2014 09:38 AM, Gregory Maxwell wrote:
>
> We've dodged several emergency scale vulnerabilities by not having TLS.
>
> I'm still trying to understand the original premise that we want
> encrypted communications between nodes.
>
> I can certainly see the value of having *authenticated* traffic with
> specific nodes, using an HMAC for the protocol messages in place of the
> current checksum.
>
>
>
> ------------------------------------------------------------------------------
>
>
>
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>
>
>
> ------------------------------------------------------------------------------
> Slashdot TV.
> Video for Nerds. Stuff that matters.
> http://tv.slashdot.org/
> _______________________________________________
> Bitcoin-development mailing list
> Bitcoin-development at lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/bitcoin-development
>

--
Jeff Garzik
Bitcoin core developer and open source evangelist
BitPay, Inc. https://bitpay.com/

Author Public Key

npub1kf0ppcjaguxekg24yx6smgxlu73qn0k8lm0t2wrqc0scpl7u3sgsmf3f58

Show more details

Published at

2023-06-07 15:25:21

Kind type

1 Short Text Note

Event JSON

{ "id": "8f5bca6a842a5efa7434bac1be7b1df1592a10e0cc8761968054ac92f684aa06", "pubkey": "b25e10e25d470d9b215521b50da0dfe7a209bec7fedeb53860c3e180ffdc8c11", "created_at": 1686151521, "kind": 1, "tags": [ [ "e", "f7d80207f3f3e09247c97d3e8c17b8e8b9ffc855be5e4ac09f019815084b2528", "", "root" ], [ "e", "28a3f185e5fcad3024ad56e92827fb57e39850f7edec29010c00ff5c972d7dc8", "", "reply" ], [ "p", "4aa6cf9aa5c8e98f401dac603c6a10207509b6a07317676e9d6615f3d7103d73" ] ], "content": "📅 Original date posted:2014-08-19\n📝 Original message:Encryption is of little value if you may deduce the same information\nby observing packet sizes and timings.\n\n\nOn Tue, Aug 19, 2014 at 7:38 PM, J Ross Nicoll \u003cjrn at jrn.me.uk\u003e wrote:\n\u003e The concern is that if you can monitor traffic in and out of a single node,\n\u003e you can determine which transactions originate from it vs those which it\n\u003e relays. That's not great, certainly, but how many nodes actually require\n\u003e that level of security, and surely they can use Tor or VPN services if so?\n\u003e\n\u003e Further, unless the remote nodes are in some way trusted, you're changing\n\u003e the attack from read-only to requiring the ability to perform a man in the\n\u003e middle attack - that doesn't seem much harder to me.\n\u003e\n\u003e As Gregory states, there's been at least two recent serious if not\n\u003e catastrophic OpenSSL bugs, and the consequences of Heartbleed if the Bitcoin\n\u003e network had been vulnerable are the stuff of nightmares.\n\u003e\n\u003e Very difficult to see the risk/reward payoff being worthwhile.\n\u003e\n\u003e Ross\n\u003e\n\u003e\n\u003e On 19/08/2014 18:35, Johnathan Corgan wrote:\n\u003e\n\u003e On 08/19/2014 09:38 AM, Gregory Maxwell wrote:\n\u003e\n\u003e We've dodged several emergency scale vulnerabilities by not having TLS.\n\u003e\n\u003e I'm still trying to understand the original premise that we want\n\u003e encrypted communications between nodes.\n\u003e\n\u003e I can certainly see the value of having *authenticated* traffic with\n\u003e specific nodes, using an HMAC for the protocol messages in place of the\n\u003e current checksum.\n\u003e\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e\n\u003e\n\u003e\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\n\u003e\n\u003e\n\u003e ------------------------------------------------------------------------------\n\u003e Slashdot TV.\n\u003e Video for Nerds. Stuff that matters.\n\u003e http://tv.slashdot.org/\n\u003e _______________________________________________\n\u003e Bitcoin-development mailing list\n\u003e Bitcoin-development at lists.sourceforge.net\n\u003e https://lists.sourceforge.net/lists/listinfo/bitcoin-development\n\u003e\n\n\n\n-- \nJeff Garzik\nBitcoin core developer and open source evangelist\nBitPay, Inc. https://bitpay.com/", "sig": "23a24d24d893d68092e5cf792dd65ad8f944eb157e22b667aa29777a10dd0404cac8881711a18203dfa32947d5e12fc37f8baf9d547bae24a933bbbc7af408fe" }