8

If I understand correctly, when new bitcoin node wants to join the network, it must be introduced by guiding nodes -- DNS seeds. DNS seeds can thereafter help new node discover more existing nodes.

So during the bootstrap phase, DNS seeds are the entry points for the new nodes. By looking at the source code of BitcoinJ:

   dnsSeeds = new String[] {
            "seed.bitcoin.sipa.be",         // Pieter Wuille
            "dnsseed.bluematt.me",          // Matt Corallo
            "dnsseed.bitcoin.dashjr.org",   // Luke Dashjr
            "seed.bitcoinstats.com",        // Chris Decker
            "seed.bitnodes.io",             // Addy Yeow
            "bitseed.xf2.org",              // Jeff Garzik
            "seed.bitcoin.jonasschnelli.ch" // Jonas Schnelli
    };

They are pretty much hard coded in the software. What if all of those DNS seeds are dishonest nodes? In this case, new nodes would be surrounded by dishonest nodes and it doesn't have chances to connect even one honest node and retrieve the genuine blockchain. Therefore, new nodes would be fooled in this case.

Does that mean bitcoin network still needs some extent of trust? And would it be a concern in reality?

Improve this question

1 Answer 1

Reset to default
2

What you are saying is correct.

I'll quickly elaborate on why these hardcoded dns seeds are required. The attack you mention is called "peer list poisoning", a strategy that can be used to segregate someone from the network. There are two main types of peer list poisoning:

  1. Dishonest nodes: the attacker poisons your peer list with real nodes, but malicious ones. All of your transactions would always be forced through these nodes.
  2. Void nodes: the attacker poisons your peer list with non-working nodes, a strategy often used to dismantle malicous P2P botnets.

You may think the DNS seed require an element of trust but it doesn't. There are ways to verify that a DNS seed is honest: if you run your own 24/7 Bitcoin Node with the right setup then your address should be available in a list returned by a DNS seed. They crawl the whole network and regularly revisits known nodes to check their availability. DNS seeds do not return a full list, so it's not very practical.

There are alternatives to using DNS seeds, such as crawling the network yourself, or even bruteforcing IP addresses and attempting a connection.

Improve this answer
5
  • 1
    Your node would only be given out if you are accepting incoming connections. The DNS seeders also don't give out their full list of nodes, just some of them (10 or 20 I think).
    – Ava Chow ♦
    Commented Jul 6, 2017 at 16:47
  • @Penquin Thanks for the excellent answer. But who runs the checking, new comers' node or DNS seeds? If new comers run the checking, what kind of algorithm can be used to check the honesty? If the DNS seeds run the checking, how can new comers believe in the DNS seeds is actually running the checking?
    – Bo Ye
    Commented Jul 10, 2017 at 1:45
  • Regarding the IP brute-forcing of the who internet, it sounds a plausible method to connect to a honest node, but is it efficient enough? On average, how long does it take to connect to a node which actually can respond the bitcoin protocols?
    – Bo Ye
    Commented Jul 10, 2017 at 1:52
  • Nobody runs the checking, but you can if you want to but I haven't seen any source code available for it yet. Bruteforcing is a really terrible inefficient method to be honest. See the introduction of this paper, given a large size it takes a few thousand attempts
    – Penquin
    Commented Jul 10, 2017 at 12:32
  • @Penqin thanks for clarifying, that's very helpful!
    – Bo Ye
    Commented Jul 16, 2017 at 10:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.