5

I was reading about Algorand’s core technology, and in their section on delegated proof of stake, they argue that DoS attacks are a key weakness of this, and hence Cardano‘s, model.

I was wondering what is Cardano‘s approach to address that challenge.

A related question, also comparison to Algorand; Algorand trumpets that the slot leader (in Cardano terms) picks itself via a VRF. Who picks the slot leader in Ouroboros?

Improve this question
1
  • I think you should consider whether this post should be edited to be more specific (detail the attack referred to) or more general (remove references to Algorand) and the title updated accordingly. The help center guidelines for quoting external sources should also be followed.
    – gRebel
    Commented Jan 17, 2022 at 0:27

4 Answers 4

Reset to default
4

There are around 3000 pools in Cardano network(they call them delegates in that link what you shared). I would expect at least 2 relays per pool, some pools have even more and I doubt that any pool run with just one relay. To take down whole network you will need to DoS(by the way currently nobody use DoS, but mostly DDoS, because DoS is attack from one location and it is ineffective, because you can just block that IP/location with FW and etc) 6000 servers in different locations and different hosting like AWS, OVH and etc. This will be defiantly not an easy task and not cheap, I can assure you. Additionally most hosting like AWS, OVH and etc has quite sophisticated anti-DDOS mechanism:

https://www.ovh.com/world/anti-ddos/

https://aws.amazon.com/shield/?whats-new-cards.sort-by=item.additionalFields.postDateTime&whats-new-cards.sort-order=desc

And if your pool is using other hosting it probably has some similar mechanism to prevent this.

Additionally if your pool will become target of such attacks, you can try to use hidden relays, just allow well known peers to connect to your relays and etc.

To summarize I would like to add that any service connected to internet can be target for DDoS and in theory can be taken down, even bitcoin network, but I personally think this is definitely not an issue for Cardano and in most cases if you follow best practices for system administrating, you should mitigate most of the risks.

Additionally I strongly disagree that you can easily and cheap DoS 1000 people[probably he meant servers/devices, people do not have yet IP connection, I'm still waiting for neuralink :)]

Improve this answer
2
  • There are plenty of pools with 1 relay node.
    – Matthias Sieber
    Commented Sep 15, 2022 at 19:20
  • Hi, not sure how that affects my answer... There are more then 6k known relays(and much more hidden) - adapools.org/relays. So to take down 6000 single relays or 3000 with double relays, seems for me quite a similar task... In any case, thank you for your comment.
    – os11k
    Commented Sep 16, 2022 at 7:43
3

It will take a lot more than 1 system (DoS) to take down Cardano!

But we're also protected well from DDoS attacks, here are a few reasons why:

  1. In terms of the network, the a parameter "collateral" in the transaction fee structure helps prevent someone from flooding the network with useless transactions that can cause congestion etc. They must send along some fixed ADA so that makes a DDoS attack this way very expensive.
  2. Stake pools don't expose their BP (block producer) node to the open Internet. They interface through Relay nodes so identifying and attacking the BP is difficult.
  3. Stake pools often have >1 Relays and to successfully stop block production you would need to attack all Relays registered to that pool. Not to mention private Relays that are not registered for peer discovery.
  4. Stake pool operators can take additional DDoS protection measures. Some include: stricter firewall configurations, private subnets, VPN, ets
  5. The attacker can't know who will be the next pool to produce a block. This is due to the VRF (Verifiable Random Function). It's a really interesting concept, definitely consider a read.
Improve this answer
1
  • To add to this (and answer OPs question in latest edit): Basically, the SPO (or owner of the VRF private key) is the only person who can determine the random slot number generated by the VRF and therefore only they know when a block is expected.
    – BETTR Stake Pool
    Commented Jan 9, 2022 at 8:00
3

While the above answers are both correct, they focus on the practical of how an SPO protects themselves from a DoS and the large number of nodes that would need to be attacked to be successful. The real key is the leadership schedule isn't public. An attacker cannot know when a pool will make a block until that block producer has forged and sent the block on to a relay the attacker is monitoring. At this point, it's too late to DoS the node. There's a bunch of really cool cryptography that if you want to dig into, IOG (formerly IOHK) has written many papers on, but the key point is you need to control the VRF secret key to know a block producers leadership schedule. As long as the operator doesn't share that schedule, they can't be targeted when it's their time to make a block.

Improve this answer
1
  • 1
    Commentary on other answers is a bad idea. They may be edited in future and their position is dependent on the number of votes they get. Better to focus on answering the question to the best of your ability. This comment will need to be deleted if the answer is edited appropriately.
    – gRebel
    Commented Jan 17, 2022 at 0:16
1

This is just a strategy I've been using, feel free to poke holes in it.

  1. Keep your block producer on a private subnet (it does not need to be on the public IP space).
  2. Give it a relay that is not advertised.

In the event that an attacker decides to slow your pool down, the BP still has the unadvertised relay to propagate in a timely manner.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.