0

I do not see any way to trustlessly generate a blackballs database without running full nodes for malicious fork coins, which I do NOT want to do (and don't even have hardware resources to do). However, I need a working blackballs database to protect my rings against using outputs which are publicly known to be compromised across chains. Rock, meet hard place, with privacy-conscious users in between.

In this discussion on another question, a helpful user is distributing a blackballs list. As I observed it, it lists 16,427,618 txids 64-digit hex strings (Edit: see my comment to user36303's helpful answer). I appreciate the apparent helpfulness; however, hmmm... Attack: Distribute a malicious blackballs list containing 16,427,618 txids 64-digit hex strings which should not be blackballed. If I grok, this would be much worse than useless: It would significantly skew the probability toward randomly selecting outputs which should be blackballed.

Additionally, if the malicious blackballs database is large enough, I hypothesize that distributing different versions to different users may fingerprint them by differently skewing the distribution of output selection. I am less worried about this, due to the magnitude of numbers involved. I doubt it is a useful attack.

Note: I am not 100% sure of any of this. I have expertise in other coins, but I'm a n00b with XMR. Trying to do my homework, avoid common pitfalls.

Improve this question
1
  • I emphasize: I assume that it's a good blackballs database. However, I never blindly download and import/execute/use anything of any kind! If a thing is not trustless, "Trust, but verify". In this case, I am grateful to the user providing the downloadable blackball database; but I cannot import it without some means of verification.
    – rkmv6jph
    Aug 20, 2018 at 2:36

1 Answer 1

Reset to default
1

A blackball list is a set of outputs which are known to be spent - or so the claim is. As you surmise, if that list lists outputs which are not known to be spent, but does not list outputs which are known to be spent, this will indeed cause the wallet to use a weaker ring.

If you do not want to scan the blockchains yourself, a way to mitigate this is to ge lists from two different sources and compare them. At the moment, sgp is planning on making such a list available in the near future.

Last, txids aren't blackballed. The blackballing process is done at the output level, since an transaction might create an output which is later known to be spent, and another which is not. For reference, there are currently about 29 million outputs, and 4.9 million transactions on the Monero blockchain. This makes the 16 million txid number highly suspect.

Improve this answer
4
  • n00b mistake; thanks for the correction. I saw 64-digit hex strings, and assumed they were txids. They could reasonably represent any 32-octet data. I don't know how the implementation of blackballing works; I only have basic comprehension of the theory. All I know for certain is that the file I downloaded has 16,427,618 lines, with each line containing exactly one string which is a valid 64-digit hex value. grep -Ei '^[0-9a-f]{64}$' blackballs | wc -l matches wc -l blackballs. On visual inspection, the hex strings appear to have a word sort order of little-endian with 16-bit word size.
    – rkmv6jph
    Aug 20, 2018 at 2:19
  • A transparent observatory where people could compare their blackball lists would be a good idea. Secure and efficient comparison of lists might be done with Merkle chains, based on the latest block observed on both chains. Declaration: "As of Monero block hash X and Greedfork block hash Y, the tip of the Merkle chain of my blackball list is Z." As newly compromised output(s) are observed across chains, hash canonically sorted new list entr(ies) with the previous blackball-chain tip. This would be helpful for people who love running a Monero node, loathe running a forkcoin node.
    – rkmv6jph
    Aug 20, 2018 at 2:52
  • 16 million txids is suspect. However is 16 million of outputs suspect too?
    – el00ruobuob
    Aug 20, 2018 at 5:34
  • An interesting idea. Those 64 character values are output one time public keys. Ask sgp for how many blackballed outs he found, the new version of monero-blockchain-blackball also has statistics on the number of known spent outputs, and why they're known spent (I expect a lot of them are known spent because they were spent specifically without fake outs).
    – user36303
    Aug 20, 2018 at 10:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.