For the bday paradox I am agreeing, I am really meaning that it does not make the t figure of 1/3 naive. The quorum figures are well established mathematically, however not really related to stopping the birthday paradox, a higher % quorum just makes it more difficult. I think it’s best to just say regardless of all of this if we have a network with many sections (which disjoint sections vastly reduces as pure kademlia has as many sections as addresses ) then we need mechnisms that distribute attackers as efficiently as possible and at the same time drive costs of such an attack as high as possible.
So to calculate the % an attacker needs we do need to consider
The quorum
Number of sections
Nodes per section (you and @tfa are doing this part and brilliantly)
Then
Node age (infants, adults etc. to force time and effort to be increased by a considerable amount, i.e. an attack can be reasoned to be, if it costs the attacker X much more than any possible return then it’s more secure (never totally)).
Forced relocation
Targetted relocation (not allowing a node to create an address in a section, but create an address between the furthest 2 nodes in a section).
Penalties (huge area as @mav poked about at a good bit, but much more to do there).
I am sure I have forgotten a lot here …
After all that there is the economics (or cryptoeconomics as some say in a confusing and elitest way ) Where safecoin comes in, I prefer to keep this to way last as humans are, well humans
Okay I think I need to read about disjoint sections maybe there is details that I should be aware of…
… I even was thinking that it might make sense to release a fork of the vault software that performs this attack… So many people can try to succeed and hopefully block each other… But then again it didn’t seem to me to be the best approach …
Ps:
Problem is that you cannot identify an attacker until he attacks… But ofc you are well aware of that… Preventing someone from being able to target a specific section is essential but doesn’t prevent statistical local effects to kick in…
(and if you would need to be in control of 2 specific sections to perform such an attack that would drive the price for such an attack significantly higher than just demanding a higher % quorum I would think)
+we need to consider someone just trying to disrupt… And for the local effects to kick in on this the network share you need is not super high… So I think there needs to be a backup plan in case this happens …
I am mainly thinking loud here and hope there is/will be more than I see right now… Because if not mavs mass-vault-control software (not entirely sure if he released that… Anyway), knowing some rust and renting many servers early on for some weeks might turn out to be very beneficial …
Agreed, however there is further thought here as well. Attack time. By that I mean, if the network just lets anyone start a node and be an active voting member at any time then this attack is really a big issue. However there are 2 things to consider there.
One infant per section (limits a flood of new nodes to a small extent).
Only allow infants when needed.
Is an area of debate. I prefer the network balances its resources verses its requirements. So like safecoin balancing, where the network encourages more vaults by making more payments in times of the network needing more space (etc.). In the same way, I feel the network should not allow new nodes to join unless it needs them. This is the debate and cost of security I feel.
Then an attacker not only needs to let his nodes age but also needs to wait in a queue to join the network. As this is not an instant join of 13% of nodes (say) then a 13% attack would be much more difficult. If the time to join was over a period, then its likely that “good” nodes will also be trying to join, so diluting an attackers army of bad nodes up front.
The downside is folk will find it harder to farm, but that is perhaps natural? (debate ensues, madness in the streets and cries of doom and destruction can be heard all over ) Seriously though it needs consideration. It is probably easier to loosen the security of these parts over time, but that needs evaluated.
The other side of this equation is also important: what is the scale of damaging actions from one malevolent section? From two, etc?
But I’d rather you had your break David than answer now. I’m just pointing out that it is part of the equation, and makes a 51% of network blockchain attack which allows the attacker complete control, a very different proposition to a 12% of network attack (assuming that’s accurate) where the attacker controls a section and has some fraction of control.
One section can be completely damaging if taken over, right now. There are mitigations like require chains of sections to make a safecoin etc. but I doubt these are needed.
I don’t think we have a 12% attack really, or anywhere near that, but it’s much more complex than a single figure as you see above. The bday pardox is like creating many networks from a single population and seeing a % such as 12% bad nodes can exist in one of those networks as the quorum (whatever that quorum is). So I see this much as bitcoins 25 || >50% attack where a % is not so important, the cost is though. I suspect our % is much closer to >33% (and can be way above that, but this means section chains) than it is to 12 or 13%, but the cost in terms of both time and money are important.
People consider money only as the measure, but I also consider time. I will try and explain in my clumsy way why a destruction attack (not vandalism or control) on a distributed network is easy if you can rent enough resource and kill the network. Now in our case, a botnet could be used, but if the botnet cannot have nodes that could store the data (like recent IOT attack from fridges ) then it fails. Also if a botnet needs to run for months it becomes much more difficult as botnets get taken down, folk switch of their machines and the botnet cannot do anything about that etc.
This is my break these convos are important to go over again and again I feel. This is a great way to explore your mind, well I feel that way anyhow
I know it’s nit picky, and it won’t change the numbers much, but 35% breaks the first assumption the white paper makes about PARSEC working. Needs 2/3 or more honest nodes.
Well - with an average of 35% globally for the network we statistically manage to get locally 2/3 majority somewhere in the network … So ability to print safecoin… I wasn’t talking about ‘only disrupting the network’ - I wanted to point out that with a way less impressive share than the 2/3 majority it might be possible to do very very very bad stuff (if I’m not missing something…)
… This simple calculation ofc doesn’t consider time and money involved to get there… (and different parties trying it and blocking each other…)…
that’s the part where I’m not that sure - i have a hard time believing we are safe enough without chaining at least 2 sections …
…to get a local majority in one section is possible imho … but to get a local majority in the right 2 sections … that’s something where this effect kicks in:
absolutely no realistic chance without 50% ownership of elders … that doesn’t sound possible to me - even with initial advantage not…
Some of the maths is a bit over my head, but after struggling through, this thread is certainly starting to help things click for me and improve my understanding of some parts of the structure of the network, if nothing else!
Anyway, I’ll let the discussion go on. Thanks for the hard work everyone
side note: an attacker would even be allowed to know which other section he would need to control for success for having this [roughly double of difficulty] - he only must not have an influence on the decision which other section the relevant one is …
I ran the simulation again from the google attack thread but using ratio of 1/3 for section.IsAttacked()
Build 100K node network
Randomly add and randomly remove 400K more nodes to give final size of 100K with ageing due to churn
Add malicious nodes, removing 1 good node for every 10 malicious nodes added, until one section is disrupted.
Test 1 2 3 4 5 | Avg
T (%) 16.9 40.3 33.2 40.5 40.6 | 34.3
So some tests it took only about 17% of all nodes to have a disrupted section, other tests over 40%. Not trying to agree or disagree with the birthday paradox dialog, just adding some more stats.
The way you present your results seems to contradict statistics. You should add a line in your table that shows the pourcentage of malicious elders when the disruption occurs.
Then I suppose the result will be more in line with the 12% asserted above.
It maybe means that 12% of active elders is needed to disturb one section while approximately 34% vaults to make it successful in tested period of time?
Yes the b’day analysis assumes that the attacker has 12% of all the elders in the network. Not 12% of the nodes in the network. This is an important point.
Pretty troubling! Only about 1% of elders required to disrupt a section.
I think adding 88 good and 12 bad nodes repeatedly would be a more relevant test, rather than initialising a good network then flooding it until the attacker achieves their goal.
The attacker still needs to get their vaults to elders which can be costly and time consuming. But the numbers are quite low, albeit for a small network (I presume they get closer to 12% as the network grows in size).
Starting condition could as well have an effect… We start at the size of 100k nodes with only honest participants…? What happens if we already start out with 10% bad actors (equally distributed) / 5% bad actors randomly distributed…?
Ps: oh - was already typing - I see you are thinking along the same line
) then we need mechnisms that distribute attackers as efficiently as possible and at the same time drive costs of such an attack as high as possible.
) then it fails. Also if a botnet needs to run for months it becomes much more difficult as botnets get taken down, folk switch of their machines and the botnet cannot do anything about that etc.
thx!