Fully anonymise timestamps in version messages when broadcasting transactions #3300
Labels
A-network
Area: Network protocol updates or fixes
C-security
Category: Security issues
I-privacy
Zebra discloses private information
S-needs-investigation
Status: Needs further investigation
Motivation
Zebra should broadcast user-generated transactions using anonymised connections. (These transactions can be generated by
lightwalletd
wallets.)Currently, Zebra's isolated connections send a truncated timestamp in their
version
messages. But truncated clock skew can still be used to track users, so it would be better if we just set that field to zero. (There are statistical attacks that check when truncated values change.)But first, we need to check that
zcashd
accepts transactions sent with this kind ofversion
message.Existing Designs
This could be an improvement on the draft Stolon RFC:
https://github.com/ZcashFoundation/zebra/blob/main/book/src/dev/rfcs/drafts/xxxx-stolon.md#isolated-minimally-distinguishable-connections
Suggested Solution
Timestamp:
zcashd
does anything with theversion
timestampRemote Peer Services:
zcashd
does anything with theaddress_recv
peer servicesThe text was updated successfully, but these errors were encountered: