Eclipse attack vs. Sybil attack

Question

I came across this paper Eclipse Attacks on Bitcoin’s Peer-to-Peer Network ∗ that sounds very similar to the Sybil attack.

Can someone point out the difference between both attacks.

Answer 1

An eclipse attack is when most (if not all) of your peers are malicious and they basically prevent you from being well-connected to the network to obtain information about transactions you're interested in. An eclipse attack is particular useful when a payer has sent some bitcoins to you in some transaction, then decides to also doublespend the same bitcoins. The doublespender (or payer) will use the eclipse attack to prevent you from knowing that there is also a doublespend transaction out in the open, so you get misled into believing that there's only the original transaction.

A sybil attack on the other hand is where a malicious actor is trying to spam the network with nodes that they control attempting to subvert the network's reputation system. For example, false signalling of support using version bits.

To summarise, an eclipse attack is targeted at a single party; whereas a sybil attack is network targeted. In the context of bitcoin, a sybil attack is not particularly harmful since all nodes operate based on consensus rules and any deviation will lead to said node getting DoS banned.

Answer 2

In a sybil attack, the attacker impersonates multiple identities.

In an eclipse attack, the attacker eclipses a victim from the network. That means the attacker basically controls which information the victim is able to send to the network and vice versa.

I would therefore say that a sybil attack is what an adversary uses in order to perform an eclipse attack. This is because a Bitcoin node normally connects to multiple peers. The adversary therefore would have to impersonate all peers of the victim in order to eclipse the victim from the rest of the network.