Bitcoin and Cryptocurrency Technologies

Things get worse over time. ​History shows that deanonymization algorithms usually improve over
time when the data is publicly available as more researchers study the problem and identify new
attack techniques. Besides, more auxiliary information becomes available that attackers can use to
attach identities to clusters. This is something to worry about if you care about privacy.
The deanonymization techniques we’ve examined so far are all based on analyzing the graphs of
transactions in the block chain. They are collectively known as ​transaction graph analysis.
Network-layer deanonymization. ​There’s a completely different way in which users can get
deanonymized that does not rely on the transaction graph. Recall that in order to post a transaction
to the block chain, one typically broadcasts it to Bitcoin’s peer-to-peer network where messages are
sent around that don't necessarily get permanently recorded in the block chain.
In networking terminology, the block chain is called the ​application layer​and the peer-to-peer
network is the ​network layer​. Network-layer deanonymization was first pointed out by Dan Kaminsky
at the 2011 Black Hat conference. He noticed that when a node creates a transaction, it connects to
many nodes at once and broadcasts the transaction. If sufficiently many nodes on the network collude
with each other (or are run by the same adversary), they could figure out the first node to broadcast
any transaction. Presumably, that would be a node that’s run by the user who created the
transaction. The adversary could then link the transaction to the node’s IP address. An IP address is
close to a real-world identity; there are many ways to try to unmask the person behind an IP address.
Thus, network-layer de-anonymization is a serious problem for privacy.
Figure 6.6​. ​Network level deanonymization. ​As Dan Kaminsky pointed out in his 2011 Black Hat talk,
“the first node to inform you of a transaction is probably the source of it.” This heuristic is amplified
when multiple nodes cooperate and identify the same source.
176