On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin - PowerPoint PPT Presentation

On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients Arthur Gervais, Ghassan O. Karame, Damian Gruber, Srdjan Č apkun ETH Zurich, NEC Research ACSAC 2014


 
 
 Bitcoin Bitcoin Peer-to-peer decentralized currency Users keep Bitcoins in a wallet 
 containing multiple addresses (@) 
 @ 1 @ 2 @ 3 @ 4 @ 5 Unlinkability between @ 
 Total $ Log of all transactions On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 2 / 19


 Bitcoin for lightweight clients Bitcoin’s scalability problems 1. Log of transactions (>25 GB) 
 2. Clients receive irrelevant 
 transactions 
 3. Limited data traffic over 3G/4G On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 3 / 19


 Bitcoin for lightweight clients Bitcoin’s scalability problems n 1. Log of transactions (>25 GB) 
 o i t c a s n a r T 2. Clients receive irrelevant 
 transactions 
 3. Limited data traffic over 3G/4G On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 3 / 19

Solution to scalability problems Enable mobile Bitcoin clients Bloom filter 0 0 0 0 0 0 0 On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 0 0 0 0 On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 1 0 0 0 0 1 0 0 0 0 0 On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 0 1 1 0 0 0 0 0 0 0 1 1 0 1 0 0 0 0 On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 0 1 1 0 0 0 0 0 0 0 1 1 0 1 0 0 0 0 On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 1 1 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 Membership test { @ 1 , @ 4 , @ 5 } On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 1 1 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 Membership test { @ 1 , @ 4 , @ 5 } On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 1 1 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 Membership test { @ 1 , @ 4 , @ 5 } On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 1 0 1 0 0 0 0 0 0 1 0 1 0 0 1 0 0 0 Membership test { @ 1 , @ 4 , @ 5 } target False Positive Rate (FPR) @ 4 False positive ! On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 1 0 1 0 0 0 0 0 0 1 0 1 0 0 1 0 0 0 Membership test { @ 1 , @ 4 , @ 5 } target False Positive Rate (FPR) @ 4 False positive ! On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems Enable mobile Bitcoin clients Insertion { @ 1 , @ 2 , @ 3 } Bloom filter 0 0 0 0 1 1 0 0 0 0 0 0 1 1 0 1 0 0 0 0 0 Membership test { @ 1 , @ 4 , @ 5 } target False Positive Rate (FPR) @ 4 False positive ! @ 5 True negative On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 4 / 19

Solution to scalability problems S imple P ayment V erification (SPV) Filter transactions not relevant for user Full Bitcoin SPV client node Full Bitcoin node On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 5 / 19

Solution to scalability problems S imple P ayment V erification (SPV) Filter transactions not relevant for user Full Bitcoin SPV client node @ 1 @ 2 @ 3 Full Bitcoin node 0 1 0 0 1 1 0 Bloom filter On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 5 / 19

Solution to scalability problems S imple P ayment V erification (SPV) Filter transactions not relevant for user Full Bitcoin SPV client node Connection Bloom filter 0 1 0 0 1 1 0 @ 1 @ 2 @ 3 Full Bitcoin node 0 1 0 0 1 1 0 Bloom filter On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 5 / 19

Solution to scalability problems S imple P ayment V erification (SPV) Filter transactions not relevant for user Full Bitcoin SPV client node Connection Bloom filter 0 1 0 0 1 1 0 transactions Is transaction relevant @ 1 for Bloom filter ? @ 2 @ 3 Full Bitcoin node 0 1 0 0 1 1 0 Bloom filter On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 5 / 19

Solution to scalability problems S imple P ayment V erification (SPV) Filter transactions not relevant for user Full Bitcoin SPV client node Connection Bloom filter 0 1 0 0 1 1 0 Relevant transactions transactions Is transaction relevant @ 1 for Bloom filter ? @ 2 @ 3 Full Bitcoin node 0 1 0 0 1 1 0 Bloom filter On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 5 / 19

Solution to scalability problems S imple P ayment V erification (SPV) Filter transactions not relevant for user Full Bitcoin SPV client node Connection Bloom filter 0 1 0 0 1 1 0 Relevant transactions transactions Is transaction relevant @ 1 for Bloom filter ? @ 2 @ 3 Full Bitcoin node 0 1 0 0 1 1 0 Bloom filter On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 5 / 19

Solution to scalability problems S imple P ayment V erification (SPV) Filter transactions not relevant for user Full Bitcoin SPV client node Connection Bloom filter 0 1 0 0 1 1 0 Relevant transactions transactions Is transaction relevant @ 1 for Bloom filter ? @ 2 @ 3 Full Bitcoin node Promise: 0 1 0 0 1 1 0 33 mio addresses in the Blockchain Bloom filter target FPR: 0.1 % "User addresses hidden amongst 33 000" false positives On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 5 / 19

Main contributions Main contributions 1. Given one Bloom filter, Bitcoin addresses partially linkable 
 - Addresses linkable if < 20 addresses in wallet 2. Given multiple Bloom filter, addresses nearly always linkable 
 3. Propose a lightweight and efficient countermeasure 
 - Significantly enhances the privacy offered by SPV clients 
 - Requires minimum modifications to Bitcoin Bloom filter 0 1 0 0 1 1 0 On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 6 / 19

Experimental setting Model and Privacy measure Blockchain SPV client Adversary On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 7 / 19

Experimental setting Model and Privacy measure Blockchain 0 1 0 0 1 1 0 Bloom filter 1 + parameters SPV client Adversary (seed, FPR) On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 7 / 19

Experimental setting Model and Privacy measure Blockchain All addresses of the Blockchain 0 1 0 0 1 1 0 Bloom filter 1 + parameters SPV client Adversary (seed, FPR) On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 7 / 19

Experimental setting Model and Privacy measure Blockchain All addresses of the Blockchain 0 1 0 0 1 1 0 @ @ @ Bloom filter 1 Positive Positive + parameters SPV client Positive Adversary (seed, FPR) On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 7 / 19

Experimental setting Model and Privacy measure Blockchain All addresses of the Blockchain + @ 0 1 0 0 1 1 0 @ @ @ Bloom filter 1 Positive Positive + parameters SPV client Positive Adversary (seed, FPR) On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 7 / 19

Experimental setting Model and Privacy measure Blockchain All addresses of the Blockchain + @ 0 1 0 0 1 1 0 Bloom filter 2 0 1 0 0 1 1 0 @ @ @ Bloom filter 1 Positive Positive + parameters SPV client Positive Adversary (seed, FPR) On the Privacy Provisions of Bloom Filters in Lightweight Bitcoin Clients - Arthur Gervais 7 / 19