Mitigating Channel Jamming with Reputation Credentials: a Protocol Sketch

Summary:

Antoine Riard has proposed a formalized reputation-based scheme for solving channel jamming in the Lightning Network. The system relies on "credentials" issued by routing hops and requested to be attached to each HTLC forward request. These credentials can be used by a reputation algorithm to reward/punish payment senders and allocate channel liquidity resources efficiently. The initial distribution of the credentials can be bootstrapped leveraging one-time upfront fees paid toward the routing hops. Afterwards, subsequent credential distribution can rely on previous HTLC traffic. Flexibility is offered to node operators who make decisions on credential acquisition costs, expiration height, binding with liquidity units or additional routing policy checks. The proposed credentials system belongs more to a monetary strategy which links satoshis cost with damages caused by loopholes in the system. Routing algorithms currently track the performance of routing hops and their liquidity. While these algorithms do probabilistic estimation of balance distribution, the proposed credential system does not all rely on past statistics for its effectiveness as long as node operators require credentials of worthiness equivalent to routing fees. However, there are concerns about edge cases and ways for attackers to game the system. Decentralized reputation systems baked into a protocol could lead to bloating, inefficiency, and put protocol developers in the position of deciding who receives routing fees. Reputation systems will likely play a key part in a future Lightning Network, but they won't be managed by protocol devs. The proposal being discussed in this context aims to use reputation credentials to allow HTLC traffic-shaping, which can protect against jamming situations and enable active HTLC traffic-shaping. This framework assumes credentials are distributed at the endpoint of the network but should be flexible enough for LSPs to harvest and distribute them when needed or attach them transparently through trampoline. The mitigation proposal is effective and incentive-compatible, with a proportional relationship between reputation acquisition and liquidity resource credited in function of said reputation. Credentials harvesting can be done automatically from a pre-allocated budget, similar to the fee-bumping reserves requirement introduced by anchor output. Usage of blinded signature may allow the credentials issued during a preliminary phase to be undistinguishable during the redeem/usage phase. The implementation requires few protocol messages to modify, while landing EC blinded signature in libsecp256k1-zkp shouldn't be difficult. There could be a concern about the centralization inertia introduced by a reputation system, but a counter-argument can be made that a new routing hop can lower the acquisition cost of its issued credentials to attract more HTLC traffic. In terms of ecosystem impacts, the proposal should be studied as it would impact inbound channel routing fees and the whole liquidity toolchain. On the proposal modularity and flexibility, each routing node has oversight on its routing policy, acquisition methods, credentials to liquidity rate. The credentials framework can be extended beyond solving jamming, as a generalized risk-management framework for Bitcoin decentralized financial network. Feedback is welcome.The proposed protocol can be found here: https://github.com/lightning/bolts/pull/1043. There is also a work-in-progress proof-of-concept in LDK (on top of our coming soon^TM HTLC intercepting API): https://github.com/lightningdevkit/rust-lightning/pull/1848. The proposed reputation-based scheme builds on previous reputation-scheme research and integrates recent proposals of upfront fees as a straightforward mechanism to bootstrap the reputation system.

Updated on: 2023-06-03T10:45:43.360352+00:00