Block relay connections were added to bitcoin core in v0.19.0.1 in November 2019. Their purpose is to harden the peer-to-peer network against partition attacks. They do this through a clever combination of factors:
Protection from Network Topology Information Leaks
A bitcoind node will not gossip address or transaction information over a block-relay-only connection. This prevents the node from leaking network topology information. A network topology map can be dangerous for two reasons:
- It can be used to trace the origin IP of a bitcoin transaction.
- It can be used to perform an eclipse attack.
Increase Outbound Connections Without Significantly Increasing Network Traffic
Address and transaction gossip messages make up the majority of a node's network bandwidth consumption. So adding additional outbound connections that do not gossip these messages allows for a more tightly integrated network graph with a very limited impact on the bandwidth required to run a node.
Anchor Nodes
Normally, a bitcoin node will connect to random peers upon startup. An anchor connection is an outbound node connection that persists across a restart. Block-relay-only connections were converted to anchor connections in v0.21.0 released in January 2021.
Anchor connections protect from a remote restart attack, which is the most likely vector of an eclipse attack. The attack works like this:
- Flood the target node's address manager with malicious node addresses.
- Use some other exploit to force the target node to restart (or wait for a software upgrade). This tricks the target node into clearing its outbound connections and connecting only to malicious nodes.
Too many anchor nodes can be a bad thing because it will entrench a malicious node connection and make it difficult for a node to defend or recover from an eclipse attack. They can also make the network topology graph more static, and therefore easier to map and easier to partition. But you definitely want to have a few anchor nodes to protect from remote restart eclipse attacks with some redundancy. Using block-relay-only connections as anchor connections strikes a nice balance in this regard. This configuration also benefits from the fact that block-relay-only connections are difficult for an attacker to detect due to their lack of ADDR and TX messages.
Anchor connections harden the peer-to-peer network using the "one honest peer" principle. As long as a bitcoin node is connected to one honest peer it will be able to stay informed about the chain of valid blocks with the greatest total proof of work. The node is able to rely on the unforgeable costliness of proof of work as the ultimate security guarantee. This, in turn, depends on an attacker not gaining control of a majority of the hashpower on the network. To put it succinctly, block-only-relay nodes bind the peer-to-peer security model more closely to the proof of work security model.
Additional Resources
