It depends a lot on the threat model. Let's consider two scenarios:
1. Mallory is monitoring all traffic to a given IP address (no Tor, or Tor is completely broken) and wants to learn which outputs it controls. Every transaction downloaded by that IP address which doesn't belong to its wallet increases the anonymity set of the transactions which do belong to that IP addresses's wallet. Because BIP157/8 involves downloading whole blocks (typically a few thousand transactions), it would create decent-sized anonymity sets even if there was never a false positive; adding the occasional false positive block just improves that.
By comparison, Bitcoin Core is like having a 100% false positive rate; now the anonymity set is every transaction in the entire best block chain.
2. Mallory knows a Bitcoin address and wants to find the IP address of the wallet controlling that Bitcoin address (again, no Tor). If Mallory has the ability to surveil IP addresses that the wallet might be using, she can spent a tiny bit of money to that address to get the wallet to download that block. Many other wallets will also download that block, either because they had transactions in it or because of the false positive rate, so that's the initial anonymity set. Mallory can then send another tiny bit of money to the address. The wallet she's interested in will download that new block but many of the other wallets which previously downloaded it won't (they didn't have a tx in that block or it wasn't a false positive for them). This shrinks the anonymity set. Each time Mallory sends a bit more money to the address, the anonymity set shrinks further, until she finds the IP address.
By comparison, Bitcoin Core is immune to this attack. It downloads every seemingly-valid block unconditionally.
David A. Harding /
npub1syl…6ksu
2023-04-17 18:33:47
in reply to nevent1q…rrz9
Author Public Key
npub1syluunzwwmc70d85d9alzqc2jrc6pdur7xrax2vqpfxas6tljavsa46ksuPublished at
2023-04-17 18:33:47Event JSON
{
"id": "8f1cf1e59f422466f65560dca4275b40b88a31cf31865872b1c5c3d9f55ecad6",
"pubkey": "813fce4c4e76f1e7b4f4697bf1030a90f1a0b783f187d329800a4dd8697f9759",
"created_at": 1681749227,
"kind": 1,
"tags": [
[
"e",
"2bebbd6a14ee3ac032a9c15c1523ffb049b5fa68f0acc367fc88a56ed4b9e482",
"",
"root"
],
[
"e",
"65f7938950cce4debc4eea043f0899b0dba23c59fc7b10767b00cd4c4502e3f1",
"",
"reply"
],
[
"p",
"b7ed68b062de6b4a12e51fd5285c1e1e0ed0e5128cda93ab11b4150b55ed32fc"
],
[
"p",
"813fce4c4e76f1e7b4f4697bf1030a90f1a0b783f187d329800a4dd8697f9759"
]
],
"content": "It depends a lot on the threat model. Let's consider two scenarios:\n\n1. Mallory is monitoring all traffic to a given IP address (no Tor, or Tor is completely broken) and wants to learn which outputs it controls. Every transaction downloaded by that IP address which doesn't belong to its wallet increases the anonymity set of the transactions which do belong to that IP addresses's wallet. Because BIP157/8 involves downloading whole blocks (typically a few thousand transactions), it would create decent-sized anonymity sets even if there was never a false positive; adding the occasional false positive block just improves that.\n\nBy comparison, Bitcoin Core is like having a 100% false positive rate; now the anonymity set is every transaction in the entire best block chain.\n\n2. Mallory knows a Bitcoin address and wants to find the IP address of the wallet controlling that Bitcoin address (again, no Tor). If Mallory has the ability to surveil IP addresses that the wallet might be using, she can spent a tiny bit of money to that address to get the wallet to download that block. Many other wallets will also download that block, either because they had transactions in it or because of the false positive rate, so that's the initial anonymity set. Mallory can then send another tiny bit of money to the address. The wallet she's interested in will download that new block but many of the other wallets which previously downloaded it won't (they didn't have a tx in that block or it wasn't a false positive for them). This shrinks the anonymity set. Each time Mallory sends a bit more money to the address, the anonymity set shrinks further, until she finds the IP address.\n\nBy comparison, Bitcoin Core is immune to this attack. It downloads every seemingly-valid block unconditionally.",
"sig": "a4e4001fdf42077d92b5263dca880fba8c3c0b0d0aef9f44d87f5f8ab041ed7a202eb42dbc34e32d2ac04b741cfa56cd52fbe6e29f19165a7b403068f38e8f3b"
}