[论文解读] Probing Channel Balances in the Lightning Network

Sergei Tikhomirov, Rene Pickhardt+2 more|arXiv (Cornell University)|Apr 1, 2020

Lightning and Electromagnetic Phenomena参考文献 11被引用 22

一句话总结

本文表明，攻击者可利用一种低成本、可逆的探测技术，通过HTLC-based错误响应，高效探测并推断闪电网络通道中的余额分布。该方法每条通道探测时间不足一分钟，资本投入极低，暴露出LN设计中隐私与效率之间的关键权衡。

ABSTRACT

As Lightning network payments are neither broadcasted nor publicly stored. Thus LN has been seen not only as scalability but also as privacy solution for Bitcoin. The protocol guarantees that only the latest channel state can be confirmed on channel closure. LN nodes gossip about channels available for routing and their total capacities. To issue a (multi-hop) payment, the sender creates a route based on its local knowledge of the graph. As local channel balances are not public, payments often fail due to insufficient balance at an intermediary hop. In that case, the payment is attempted along multiple routes until it succeeds. This constitutes a privacy-efficiency tradeoff: hidden balances improve privacy but hinder routing efficiency. In this work, we show that an attacker can easily discover channel balances using probing. This takes under a minute per channel and requires moderate capital commitment and no expenditures. We describe the algorithm and test our proof-of-concept implementation on Bitcoin's testnet. We argue that LN's balance between privacy and routing efficiency is suboptimal: channel balances are neither well protected nor utilized. We outline two ways for LN to evolve in respect to this issue. To emphasize privacy, we propose a modification of error handling that hides details of the erring channel from the sending node. This would break our probing technique but make routing failures more common, as the sender would not know which channel from the attempted route has failed. To improve efficiency, we propose a new API call that would let the sender query balances of channels that it is not a party of. We argue that combining these approaches can help LN take the best of both worlds: hide private data when feasible, and utilize public data for higher routing efficiency.

研究动机与目标

• 调查尽管有隐私保障，闪电网络通道余额在多大程度上仍易受探测攻击。
• 评估利用HTLC-based错误响应探测通道余额的可行性与成本。
• 识别当前LN设计中隐私与效率之间的权衡，即隐藏余额阻碍了路由效率。
• 提出改进方案，在不损害网络核心特性的前提下，提升隐私或路由效率。
• 评估探测对网络稳定性的影响以及悬挂HTLC的风险。

提出的方法

• 攻击者打开少量具有足够容量的入口通道，以探测多条路径。
• 攻击者沿多跳路径发送逐渐增加金额的HTLC，根据错误响应推断目标通道的余额。
• 该方法依赖于中间节点在通道余额不足时立即返回错误，从而暴露失败通道的余额。
• 攻击者使用多条路径，并通过使用较小的探测金额或尝试不同路径来避免存在悬挂HTLC的通道。
• 该技术具有可逆性：所有失败的HTLC在探测后均被清理，因此不会造成资金永久损失。
• 作者在比特币测试网中使用c-lightning实现并测试了该探测方法。

实验结果

研究问题

• RQ1 攻击者是否可以在不直接访问或知晓通道状态的情况下，推断出闪电网络通道的余额？
• RQ2 利用HTLC和错误响应探测通道余额的成本与时间效率如何？
• RQ3 并行通道的存在如何影响探测攻击的可靠性？
• RQ4 当前LN设计在多大程度上因错误消息中的余额泄露而损害隐私？
• RQ5 何种架构改进可提升LN中隐私与路由效率之间的平衡？

主要发现

• 攻击者可在每条通道不足一分钟的时间内探测并确定测试网中超过90%的活跃通道余额。
• 由于失败HTLC的可逆性，探测攻击仅需极低的资本投入——全范围覆盖最多仅需0.167 BTC（约1500美元）。
• 该攻击具有可扩展性：单个攻击者仅需少数入口通道，即可通过任意长的路径探测整个网络。
• 悬挂HTLC的存在会降低探测效率，但攻击者可通过使用更小的探测金额或多个入口通道来缓解此问题。
• 当前LN的错误处理机制泄露了关键的余额信息，从而破坏了洋葱路由的隐私保证。
• 研究证实，当前的余额隐私模型存在缺陷，既无法有效保护余额，也因缺乏公开的余额数据而无法实现高效的路由。