中本聪致达斯汀·特拉梅尔：回复：一些想法——攻击分类（2009 年 1 月 15 日）
历史档案 / 镜像
打开历史存档来源说明
Published verbatim by Dustin Trammell in November 2013. Full mbox archive distributed as Satoshi_Nakamoto.zip via Trammell's blog (https://blog.dustintrammell.com/i-am-not-satoshi/).
我把攻击分为两类：
- 只有实际位于通信链路中的人才能实施的攻击
- 互联网上任何地方的任何人都能实施的攻击
第 1 类会让你暴露在你家中或公司里本地局域网上的人、 沿途各 ISP 的管理员，以及 收件人一侧局域网的攻击之下。第 2 类则会让你暴露给十亿人， 他们可以自行选择成为攻击者，并在开发出一种可攻击多个受害者的技术后 获得规模经济。
通过 IP 发送时会请求一个新的公钥，所以没错，它容易受到 第 1 类中间人攻击。如果对此有所顾虑，发送到 比特币地址就没有这个漏洞，尽管这要在隐私上作出一点权衡。 我觉得大多数时候，人们会从非 SSL 网站和 未签名的明文电子邮件中获取比特币地址，而这些渠道通过 DNS 投毒 本来就容易受到第 1 类和第 2 类攻击。
一种解决办法是在发送时同时使用 IP 地址和比特币地址 （也许是 1.2.3.4-1Kn8iojk...），由收件人使用 比特币地址的公钥为新公钥签名， 以证明你发送的对象确实是你所认为的那个人。如果这个系统开始用于 真正的商业用途，我肯定会实现这一点。另一个解决办法是使用 SSL。
目前，如果你发送到某个 IP，显然你没有 提供有关收件人的任何其他身份信息，因此 你其实是在盲目地发送给任何响应这个 IP 的人。
以后还可以增加一个加密钱包的选项。
如果我正确理解了它的实现方式，你只是把这笔 交易计算进区块链，然后让预定的收件人 “发现”它，对吗？
没错。
另一种办法可以是让网络 节点提供解析服务，它们在网络中询问某个比特币地址的 网络地址；如果该节点在线，那么一旦网络就该地址 达成共识，发送方的比特币应用程序就直接连接到那里。
如果只需要比特币地址，而 IP 可以在幕后 自动确定，那会很好。可能会有隐私或拒绝服务方面的问题。 当然，在实现另一种发送方式之前，现在有充足的时间 彻底考虑清楚这个设计，并确保它是最佳方案。
中本聪
英文原文
展开英文原文
I group attacks into two classes:
- Attacks that can only be done by someone actually in the chain of communication
- Attacks that can be done by anyone on the Internet from anywhere
Type 1 exposes you to people in your house or company on your local LAN, admins at ISPs in between, and the LAN on the recipient's side. Type 2 exposes you to a billion people who can self-select to be attackers and get economy of scale when they develop one technique to attack multiple victims.
Sending by IP requests a new public key, so yes, it's vulnerable to type 1 man-in-the-middle. If that's a concern, sending to a Bitcoin address doesn't have that vulnerability, although there's a small privacy tradeoff. I have a feeling most of the time people will get Bitcoin addresses off of non-SSL websites and unsigned cleartext e-mail, which is already vulnerable to type 1 and type 2 through DNS poisoning.
One solution would be to use both the IP and Bitcoin addresses when sending (maybe 1.2.3.4-1Kn8iojk...), where the recipient uses the public key of the Bitcoin address to sign the new public key to prove that you're sending to who you think you are. If the system starts to be used for real business purposes, I will certainly implement that. Another solution is to use SSL.
For now, it's pretty obvious that if you send to an IP, you didn't give any other identifying information about the recipient, so you're blindly sending to whoever answers that IP.
Another feature for later is an option to encrypt your wallet.
If I understand how that is done correctly, you just compute the transaction into the block chain and let the intended recipient 'discover' it, correct?
That's correct.
An alternative could be to allow the network nodes to provide a resolution service, where they ask around for the network address of a BitCoin address, and if that node is online, once a consensus is agreed upon by the network for that address the sending BitCoin application connects directly there.
It would be nice to only need the Bitcoin address and have the IP worked out behind the scenes. Might have privacy or denial of service issues. Certainly before another sending method is implemented, there's plenty of time now to fully think through the design and make sure it's the best way.
Satoshi