How does the system sustain regular low-effort "splitting attacks"?

Question

The whitepaper focuses mainly on attacks in which an attacker tries to double-spend. So the section about the splitting attack examines the case that an attacker tries to effectively create two forks of the tangle and spend tokens in both branches.

However, what about an attacker who only wants to sabotage the network and who does not care about whether the network will eventually agree which of the conflicting transactions he issued is to be accepted or if both of them are abandoned (also mentioned in the whitepaper)? The goal of the attacker is not to double-spend but to keep the tangle busy resolving a large number of conflicts.

In a large tangle (and it is supposed to be huge!) conflicting transactions slipped into the network at different places spread widely before they are recognized as such by a majority of the nodes. The whitepaper (on page 25) explicitly states "It is worth noting that the attacker’s task [i.e. trying to balance the two forks to maintain the split] is very difficult because of network synchronization issues: They may not be aware of a large number of recently issued transactions". Unfortunately this seems to be true for every well-behaving node in the network as well.

A node validating transactions cannot know for sure if conflicting transactions were issued somewhere else in the network so the attacker's transactions will inevitably be confirmed frequently before being dismissed.

The whitepaper argues that such conflicts will be resolved eventually. Maybe this is the case, but resolving the conflict can mean a significant effort and delay. Many transactions would have to be reissued because they built on the part of the tangle that ends up abandoned. For someone issuing an urgent transaction it would be risky in a sense to confirm two tip transactions because they are more likely to turn out contradicting others. On the other hand, the attacker needs only minimal effort but forces the network to do a lot of unnecessary work.

The only option I see is to isolate the malicious nodes issuing the conflicting transactions from the network through the transaction routing protocol. However, I don't understand how that would be possible given the network topology. Maybe I'm missing a simple solution. Are there any resources on this kind of attack and appropriate countermeasures?

Answer 1

You're tackling a few points there. The first remark that I have is right in the title. A splitting attack is not performed regularly. It's more precisely described as one sustained attack. A splitting attack's goal is to split the tangle in two parts that they can identify and spend on both.

Then, the attacker hopes that roughly half of the network would contribute to each ranch so that they would be able to “compensate” for random fluctuations, even with a relatively small amount of personal computing power. If this technique works, the attacker would be able to spend the same funds on the two branches.

[...] To defend against such an attack, one needs to use a [...] rule that makes it too hard to maintain the balance between the two branches. (IOTA WP 1.3, page 24)

Let's have a second look at the potential gain of the attacker—it determines how much effort someone might be willing to spend after all. They want to spend the same funds twice. The amount of those original funds is not relevant to the attack since the amount per transaction is not limited. It's however the maximum gain of the attacker. The plan has to be to sell that amount (i.e. get a non-IOTA currency for it). To do that you'll have to reach a certain approval on your transaction selling the IOTAs. That amount of transactions based on your selling the IOTAs has to be performed by the network before the splitting attack founders.

When it founders the attacker will either want the half of the network to win where they didn't spend anything or they'll spend on both halves. The latter is more likely since it would be even harder to make sure onto which half the network falls.

Thus, the technical goal of the attacker is to keep the splitting attack long enough alive to have his sales confirmed. Remember that confirmation is based on transactions that are based on your transaction.

Goal of the splitting attack: Split long enough to have two transactions confirmed.

The defense against that is listed in the whitepaper as well, "make it too hard to maintain the balance between the two branches."

To maintain such a balance an attacker would have to counterbalance the two parts of the network in order to bring all honest nodes to pick transactions from both sides with a chance close enough to 50% that neither of the sides win. In order to do that an attacker would need a remarkable knowledge of the network—and potentially the future—since a large bunch of issued transactions on one side could easily tip the whole thing to one side.

That makes it obvious that this kind of attack gets naturally harder and harder the more active the network is. A network that's more active has more nodes that would have to pick almost equally on both sides and there are more transactions which could be issued based one side without the attacker having the possibility to counterbalance them—both making it harder to maintain the split.

Considering the decentralized nature of the tangle it is quite hard to maintain such a balance. Especially if you factor in peaks in transactions (it's a high-load attack-vector after all), network latencies and other issues that make it unlikely that the attacker has enough knowledge to issue transactions that would keep the split-balance.