Skip to content

coordinator attack: add clearnet/Tor attack and inconsistent round id attack #1867

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
MarnixCroes wants to merge 1 commit into
base: master
Choose a base branch
from
Open

coordinator attack: add clearnet/Tor attack and inconsistent round id attack #1867

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions docs/FAQ/FAQ-Introduction.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -146,6 +146,20 @@ _**Privacy & Availaibility Concerns**_
Other users would also notice a lack of mixed coins.
Learn more about this attack [here](https://github.com/WalletWasabi/WabiSabi/blob/master/protocol.md#attacks-on-privacy).

- **Client to Coordinator communication**:
- IP address leak when not using Tor:
This allows the coordinator to link all communication and inputs and outputs of the coinjoin and thus complete de-anonymisation.
This is why Wasabi communicates over Tor by default.
- (Theoretical) Tor network-level de-anonymisation:
Wasabi uses Tor by default, assuming that this is the most available and usable anonymous way to communicate, and that it cannot be de-anonymised at the network level.
If Tor does not uphold these assumptions, the client could be de-anonymised.
Comment on lines +151 to +155
Copy link
Collaborator

@yahiheb yahiheb Jan 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nit: "anonymization" is used elsewhere in the docs.

Suggested change
This allows the coordinator to link all communication and inputs and outputs of the coinjoin and thus complete de-anonymisation.
This is why Wasabi communicates over Tor by default.
- (Theoretical) Tor network-level de-anonymisation:
Wasabi uses Tor by default, assuming that this is the most available and usable anonymous way to communicate, and that it cannot be de-anonymised at the network level.
If Tor does not uphold these assumptions, the client could be de-anonymised.
This allows the coordinator to link all communication and inputs and outputs of the coinjoin and thus complete de-anonymization.
This is why Wasabi communicates over Tor by default.
- (Theoretical) Tor network-level de-anonymization:
Wasabi uses Tor by default, assuming that this is the most available and usable anonymous way to communicate, and that it cannot be de-anonymized at the network level.
If Tor does not uphold these assumptions, the client could be de-anonymized.


- **Inconsistent Round ID**:
The client asks the coordinator for the active rounds, and the coordinator returns the _Round ID_.
The round ID is the resulting hash of information about the round, such as when the round started and the parameters. The coordinator could create rounds that do not match the parameters and/or create rounds with inputs that were supposed to be registered in different rounds.
This allows the coordinator to de-anonymize and/or link users' coins.
To mitigate against this, the client calculates the round ID by itself to verify, and will abort if it detects the coordinator is doing this.
Copy link

@nothingmuch nothingmuch Jan 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that doesn't mitigate anything because ownership proof "verification" trusts the coordinator to provide prevouts

even if they were, the round id is insufficient to ensure consistency


- **Metadata Leak**:
While this is not a direct attack by the coordinator, if a client disconnects after registering multiple coins, the coordinator may assume that these coins belong to the same owner as they all stop sending the subsequent required requests.

Expand Down