The Pentagon says blockchains are not decentralized

A Trail of Bits report was published a few days ago detailing the results of an analysis conducted by the Pentagon’s Defense Advanced Research Projects Agency (DARPA), a government agency that deals with new technologies for military use.

Blockchains lack decentralization according to the Pentagon

The report identifies several scenarios in which the immutability of blockchain could be subverted, not by exploiting cryptographic vulnerabilities, but by subverting protocol, network or consensus ownership. 

They argue, for example, that most Bitcoin nodes would have significant incentives to behave dishonestly, and that a minority of network service providers, including Tor, have control over the routing of most traffic to the blockchain. Since the data being sent to the Bitcoin blockchain is not encrypted, this would open the door to the so-called “attacker-in-the-middle” attacks. 

60% of unencrypted traffic related to the Bitcoin protocol passes through only 3 ISPs, which could arbitrarily degrade or deny their services to nodes using them. 

The report reveals that only a relatively small number of Bitcoin nodes take an active part in the consensus process by communicating with miners, but it is worth mentioning that this is still many thousands of nodes. 

In addition, the researchers found that 21% of Bitcoin nodes run an outdated version of the Bitcoin Core client, which is plagued by known vulnerabilities, yet it must be said that 79% of nodes do not use it. This does reduce the amount of hashrate needed to perform a 51% attack. 

The report also points out that the 4 largest mining pools collectively hold more than 51% of the hashrate.

It also hypothesizes that it would be possible to carry out an attack on the Stratum protocol for mining pools, theoretically going so far as to be able to estimate the hashrate and average size of rewards for pool miners by manipulating Stratum messages to steal computing power and thus rewards from other pool users. 

Some parts of the Pentagon report are not entirely clear

There is one passage included in this report that is not really convincing. 

They write: 

“Moreover, the number of entities necessary to execute a 51% attack on Bitcoin was reduced from 51% of the entire network (which we estimate at approximately 59,000 nodes) to only the four most popular mining pool nodes (less than 0.004% of the network)”.

In fact, it is in no way possible that only 4 nodes can impose their consent on the other 58,996. Even if they are 4 nodes that belong to the leading mining pools, at most they can impose consent on themselves, with all the other nodes that could easily and quickly notice the problem. 

In theory, they could launch an attack, but they would be quickly discovered. The attack might even be sustained for a long time if the four parties were in agreement, creating quite a few problems, but it could very hardly be sustained in the long or even medium term. 

There is another passage that raises eyebrows. 

They explain: 

“Taking control of the four largest mining pools would provide a hashrate sufficient to execute a 51% attack”.

This is just not true, because in the mining pools the hashrate is not centralized at all, and especially not controlled by the mining pools at all. All the pools do is coordinate the data coming from the thousands of miners participating in the pool, who themselves exclusively own the hashrate. Only by hacking the software that the miners use could one really take control of their hashrate, but this is a very unrealistic assumption. 

It is worth remembering that DARPA is a US government agency serving the Department of Defense, i.e., not exactly an independent body capable of impartially analyzing these dynamics. 

The issues raised by the report seem real, but there is a complete lack of quantification of the true extent of the risk. Bitcoin is not a protocol with zero risk, but with risks so low as to be negligible. To date it has withstood immense amounts of attacks very well, so much so that it has never even gone offline for a few minutes in recent years. Perhaps not even the Pentagon’s internal network can boast such performance.