原文鏈接：
Github:Dandelion: Privacy-Preserving Transaction Propagation 帶有隱私保護的交易傳播
相關新聞：
Bitcoin Developers Publish BIP For 'Dandelion' Privacy Project
自己嘗試翻譯難免有錯漏，歡迎各位大神指正~
Abstract 摘要
Dandelion is a new transaction broadcasting mechanism that reduces the risk of eavesdroppers linking transactions to the source IP.?
蒲公英是一種新的交易廣播機制，可以降低竊聽者將交易與源IP關聯的風險。
Dandelion transaction propagation proceeds in two phases: first the “stem” phase, and then “fluff” phase. During the stem phase, each node relays the transaction to a *single* peer. After a random number of hops along the stem, the transaction enters the fluff phase, which behaves just like ordinary flooding/diffusion. Even when an attacker can identify the location of the fluff phase, it is much more difficult to identify the source of the stem.
蒲公英交易傳播分兩步進行：首先是“莖”階段，然后是“絨毛”階段。在莖階段期間，每個節點將交易傳達到*單一*對等節點。在沿著莖走過隨機數跳數之后，交易進入絨毛階段，其行為就和普通的區塊鏈溢流/擴散行為類似了。即使攻擊者可以識別絨毛階段的開始位置，識別莖的來源會相對而言更難一些。（peer 本文中翻譯成對等節點 不知道更好的翻譯是什么）
Illustration 示意圖:
Motivation?動機
Bitcoin transaction propagation does not hide the source of a transaction very well, especially against a “supernode” eavesdropper that forms a large number of outgoing connections to reachable nodes on the network [1,2,3]. From the point of view of a supernode, the peer that relays the transaction *first* is the most likely to be the true source, or at least a close neighbor of the source. Various application-level behaviors of Bitcoin Core enable eavesdroppers to infer the peer-to-peer connection topology, which can further help identify the source [2,3]. 比特幣交易傳播不能很好地隱藏交易的來源，特別是針對 和網絡上可達節點之間有大量輸出鏈接的“超級節點”竊聽者。從超級節點的角度來說，*最先*傳達交易的對等節點最有可能是真正的來源，或者至少是來源的近鄰。比特幣核心的各種應用級行為使得竊聽者能夠推斷出端對端對等節點互相連接的拓撲結構，進一步幫助識別來源。
The Dandelion protocol obscures the source by propagating each transaction along the stem (away from the source), before initiating the diffusion process at a safe distance. Dandelion was introduced in [4] and presented at ACM Sigmetrics 2017. This BIP discusses a more practical and robust variant of Dandelion called Dandelion++ (research article forthcoming [5]). For the sake of this document, we ignore the ++ distinction and just call the proposal Dandelion overall.?
蒲公英協議在 達到安全擴散過程的距離之前 是通過沿著莖（遠離源）來傳播每比交易的，以此來遮蔽來源。蒲公英在[4]中被介紹并在ACM Sigmetrics 2017上公開演講。這個比特幣改進建議（BIP，Bitcoin Improvement Proposal）討論了一個更實用和更強大的蒲公英變種，被稱為蒲公英++（研究文章即將出版[5]）。
Dandelion exhibits two key properties: first, its anonymity properties are near-optimal among propagation mechanisms that do not obfuscate transactions (e.g., using encryption). The intuition is that under Dandelion, transactions from different nodes generate statistically similar propagation patterns; hence, adversarial nodes will be unable to use those propagation patterns to reliably infer the source IP. The relevant analysis and proofs are included in [4]. Second, Dandelion does not significantly increase transaction propagation latency. Dandelion's latency overhead (compared to the status quo) is equal to the time spent in stem phase. Although [4] does not measure this latency explicitly, our simulations suggest that the average overhead will be on the order of seconds, and we are currently running experiments to empirically measure this latency distribution.
蒲公英展示了兩個關鍵特性：
首先，其匿名性質在不模糊交易的傳播機制（例如，使用加密）中接近最優。直觀上看就是用蒲公英時，來自不同節點的交易會產生統計上相似的傳播模式；因此，有不良企圖的節點將無法使用這些傳播模式來可靠地推斷源IP。相關分析和證明都包含在論文[4]中。
其次，蒲公英不會顯著增加交易傳播延遲。蒲公英的延遲開銷（與現狀相比）等于“莖”階段花費的時間。雖然[4]中沒有明確地測量這個延遲，我們的模擬表明平均開銷將在幾秒鐘左右，我們目前正在進行實驗來經驗性地測量這個延遲的分布。
Specification 具體規范
The Dandelion protocol is based on three mechanisms: 蒲公英協議基于三種機制：
1. *Stem/fluff propagation.* Dandelion transactions begin in “stem mode,” during which each node relays the transaction to a single randomly-chosen peer. With some fixed probability, the transaction transitions to “fluff” mode, after which it is relayed according to ordinary Bitcoin flooding/diffusion.
1. *莖/絨毛傳播*
蒲公英交易以“莖模式”開始，在此期間每個節點將交易傳達到單個隨機選擇的對等節點。 以某個固定的概率為準，交易會轉入為“絨毛”模式，之后再使用普通的比特幣溢流/擴散進行傳達。
2. *Mempool Embargo.* During the stem phase, each stem node (Alice) stores the transaction in an “embargoed” state. During the embargo period, Alice behaves as though she has not seen the transaction. That is, Alice will not include the embargoed transaction when responding toMEMPOOLrequests, and will not respond to GETDATA requests from another node (Bob) unless Alice previously sent an INV to Bob. The embargo period ends as soon as Alice receives an INV advertising the transaction as being in fluff mode.
2.*內存池禁運.*
在莖階段，每個莖節點（Alice節點）將交易存儲在“禁止”狀態。在禁運期間，Alice節點假裝沒有看到交易（此處指禁止狀態的交易）。也就是說，Alice在響應MEMPOOL請求時不會包含被禁止的交易，并且不會響應來自另一個節點（Bob）的GETDATA請求，除非Alice先前向Bob發送了INV。一旦Alice收到INV禁運期就結束了，該交易即將進入絨毛模式。
MEMPOOL注(mastering bitcoin第六章）：
Almost every node on the bitcoin network maintains a temporary list of unconfirmed transactions called thememory pool,mempool, ortransaction pool. Nodes use this pool to keep track of transactions that are known to the network but are not yet included in the blockchain.比特幣網絡中幾乎每個節點都會維護一份未確認交易的臨時列表，被稱為內存池或交易池。節點們利用這個池來追蹤記錄那些被網絡所知曉、但還未被區塊鏈所包含的交易
GETDATA和INV注(mastering bitcoin第六章）：
The peer that has the longer blockchain has more blocks than the other node and can identify which blocks the other node needs in order to "catch up." It will identify the first 500 blocks to share and transmit their hashes using an inv (inventory) message. The node missing these blocks will then retrieve them, by issuing a series of getdata messages requesting the full block data and identifying the requested blocks using the hashes from the inv message.
This process of comparing the local blockchain with the peers and retrieving any missing blocks happens any time a node goes offline for any period of time. Whether a node has been offline for a few minutes and is missing a few blocks, or a month and is missing a few thousand blocks, it starts by sendinggetblocks, gets aninvresponse, and starts downloading the missing blocks.Figure 6-6shows the inventory and block propagation protocol.
擁有更長區塊鏈的對等節點比其他節點有更多的區塊，可以識別出哪些區塊們是其他節點需要“補充”的。它會識別出第一批可供分享的500個區塊，通過使用inv（inventory）消息把這些區塊的哈希值傳播出去。缺少這些區塊的節點便可以通過各自發送的getdata消息來請求得到全區塊信息，用包含在inv消息中的哈希值來確認是否為正確的被請求的區塊，從而讀取這些缺失的區塊。
每當一個節點離線，不管離線時間有多長，這個與對等節點比較本地區塊鏈并恢復缺失區塊的過程就會被觸發。如果一個節點只離線幾分鐘，可能只會缺失幾個區塊；當它離線長達一個月，可能會缺失上千個區塊。但無論哪種情況，它都會從發送getblocks消息開始，收到一個inv響應，接著開始下載缺失的區塊庫存清單和區塊廣播協議如下圖所示。
3. *Robust propagation.* Privacy enhancements should not put transactions at risk of not propagating. To protect against failures (either malicious or accidental) where a stem node fails to relay a transaction (thereby precluding the fluff phase), each node starts a random timer upon receiving a transaction in stem phase. If the node does not receive any INV messages for that transaction before the timer expires, then the embargo ends and the node diffuses the transaction normally.
3. *穩健的傳播*
隱私增強不應置交易于不傳播的風險。為了防止故障（惡意或意外），也就是莖節點無法傳送交易（進而阻止絨毛階段），每個節點在接收到處于莖階段的交易時會啟動一個隨機定時器。如果在節點在定時器超時之前它沒有收到該交易的任何INV消息，則禁止結束同時節點正常地擴散該交易。
Dandelion stem mode transactions are indicated by a new type of inventory item and a new transaction type.蒲公英莖模式的交易是由新的存貨類型和新的交易類型標示的。
New Dandelion transaction inventory type: 新的蒲公英交易存貨類型：
MSG_DANDELION_TX = 5
MSG_WITNESS_DANDELION_TX = MSG_DANDELION_TX | MSG_WITNESS_FLAG
Dandelion transaction message type:新交易信息類型
NetMsgType::DANDELIONTX;
After receiving a Dandelion transaction, the node flips a biased coin to determine whether to propagate it in “stem mode”, or to switch to “fluff mode.” The bias is controlled by a parameter exposed to the command line, initially 90% chance of staying in stem mode (meaning the expected stem length would be 10 hops). 在收到蒲公英交易之后，節點會“拋擲有偏向性的硬幣”來決定是否以“莖模式”傳播，或是切換到“絨毛模式”。其中的偏向是由暴露給命令行的參數控制的，最初有90％的機會停留在莖模式（意味著預期的“莖”長度將為10跳）。
-dandelion=<n>
Configure Dandelion (privacy-preserving transaction propagation) stem
probability percent (default: 90, max 100, 0 to disable)
We have evaluated a spectrum of possible schemes for selecting which peers receive relayed stem transactions. We call the set of possible relays the “stem set”. On one extreme, a node could relay every stem transaction to the same peer (i.e., the stem set has size 1). On the other extreme, a node could randomly choose a new relay from its existing peers for every transaction. The tradeoffs between these options affect how much “precision” an attacker gets, and depend on how easily the attacker can infer the connection topology of the Dandelion-relay overlay. Our compromise is to maintain a stable, randomly-chosen stem set of *two* peers, and to select one randomly each time we relay a transaction. The stem set is chosen from among the outgoing (or whitelisted) connections, which prevents an adversary from easily inserting itself into the stem graph. Each node periodically re-randomizes its stem set every 10 minutes. 我們已經評估了一些可能的方案用于選擇由哪些對等節點接收中繼過來的莖交易事務。我們將可能的中繼集合稱為“莖集合”。在一個極端情況下，節點可以將每個莖交易事物中繼到同一個對等節點（也就是說莖集合大小為1）。另一方面，一個節點也可以從現有對等節點中隨機選擇一個新的來中繼每一個交易。這些選項之間的權衡會影響攻擊者可以獲得多少“精確度”，并且取決于攻擊者有多容易來推斷蒲公英 - 中繼覆蓋的連接拓撲。 我們的妥協是保持一個穩定的，隨機選擇的包含*兩個*對等節點的莖集合，并在每次中轉一個交易時隨機選擇其中一個對等節點。莖集合從輸出（或白名單）連接中選出，可防止對手輕易將自身加入到莖圖譜中。每個節點每10分鐘周期性地重新隨機化其莖集合。
Service bits: Support for Dandelion is indicated by a temporary experimental service bit. 服務位：對蒲公英的支持由臨時的實驗性服務位來表示。
NODE_DANDELION = (1 << 24)
We imagine that in the future, the service will be discovered in-band by sending “MSG_DANDELION_TX” after the hand-shake. 我們設想將來，在網絡中發送“MSG_DANDELION_TX”該服務就會被發覺。
Considerations 考慮事項
The main implementation challenges are: (1) identifying a satisfactory tradeoff between Dandelion’s privacy guarantees and its latency/overhead, and (2) ensuring that privacy cannot be degraded through abuse of existing mechanisms. In particular, the implementation should prevent an attacker from identifying stem nodes without interfering too much with the various existing mechanisms for efficient and DoS-resistant propagation.
主要的實施挑戰是：（1）在蒲公英的隱私保證與其延遲/間接費用之間找到的令人滿意的折衷方案，以及（2）確保通過濫用現有機制不會降低隱私性。 尤其要注意的，蒲公英的實施應該在不嚴重影響現有的各種高效和帶DoS抗性傳播現有機制前提下，防止攻擊者識別莖節點。
The privacy afforded by Dandelion depends on 3 parameters: the stem probability, the number of outbound peers that can serve as dandelion relays (i.e., the “stem set” size), and the time between re-randomizations of the stem set. These parameters define a tradeoff between privacy and broadcast latency/processing overhead. Lowering the stem probability harms privacy but helps reduce latency by shortening the mean stem length; based on theory, simulations, and experiments, we have chosen a default of 90%. Lowering the stem set size (from a default size of 2 to 1) makes dandelion’s privacy guarantees fragile to adversaries that can learn the stem set of each node; here we choose robustness over optimal privacy. Reducing the time between each node’s re-randomization of its stem set reduces the chance of an adversary learning the stem sets for each node, at the expense of increased overhead. These tradeoffs are outlined more precisely in a forthcoming article [5]. 蒲公英提供的隱私性取決于三個參數：莖的概率，就是可用作蒲公英中轉的外圍對等節點的數量（即“莖集合”大小）以及莖集合的兩次再隨機化之間的時間。這些參數定義了隱私性和廣播延遲/處理開銷之間的折衷。 降低莖的概率會危害隱私性，但縮短平均莖的長度有助于減少延遲; 基于理論，模擬和實驗，我們選擇了90％的默認值。降低莖集合的大小（從默認的2到1）會使蒲公英的隱私保證在攻擊者面前免得很脆弱，因為他們可以學習每個節點的莖集合; 這里我們選擇魯棒性而不是選最優隱私性。 減少每個節點對其莖集合再次隨機化之間的時間減少了攻擊者學習每個節點莖集合的機會，但要付出更多的開銷。 在即將出版的文章[5]中更詳細地概述了這些權衡。
When receiving a Dandelion inventory item, the request skips the usual “mapAlreadyAskedFor” priority queue, which adds a 2-minute timer before asking the next node. Otherwise, an eavesdropper would be able to probe whether a node has received stem transactiontxby sending INV(tx) and checking whether or not GETDATA(tx) is received in response.
當收到蒲公英存貨清單項目時，該請求將跳過通常的“mapAlreadyAskedFor”優先級隊列，該優先級隊列添加了在詢問下一個節點之前計時2分鐘的定時器。如果不這樣做，竊聽者將能夠通過發送INV（tx）來探測節點是否接收到莖交易，并檢查響應中是否接收到GETDATA（tx）。
When receiving or asking for a Dandelion stem transaction, we avoid placing that transaction in filterInventoryKnown. This way, transactions can also travel back “up” the stem in the fluff phase.在接收或要求蒲公英莖交易時，我們避免將交易放進filterInventoryKnown。 這樣一來，在絨毛階段交易也可能回傳回到莖經過的節點。
Like ordinary transactions, Dandelion transactions are only relayed after being successfully accepted to mempool. This ensures that nodes will never be punished for relaying Dandelion transactions, and that existing replace-by-fee and fee-filter behavior is preserved.
像普通交易一樣，蒲公英的交易只有在被成功被MEMPOOL接受之后才被中轉傳遞。 這確保節點中轉蒲公英交易將永遠不會受到懲罰（此處不理解），并且現有的替代費用和費用過濾行為得以保留。（此處不理解）
If an orphan transaction is received in Dandelion mode, it is added tomapOrphanTransactions, and also marked as stem-mode. If the transaction is later accepted to mempool, then it is relayed as a Dandelion transaction (either stem mode or fluff mode, depending on a coin flip).如果在蒲公英模式下接收到孤立交易，它會被添加為 mapOrphanTransactions，并將其標記為莖模式。 如果該交易稍后被mempool接受，則將其作為蒲公英交易進行中轉（可能以莖模式或絨毛模式中轉，取決于拋硬幣結果）。
If a node receives a child transaction that depends on one or more currently-embargoed Dandelion transactions, then the transaction is also relayed in stem mode, and the embargo timer is set to the maximum of the embargo times of its parents. This helps ensure that parent transactions enter fluff mode before child transactions.
如果一個節點接收到一個子交易，它依賴于一個或多個當前禁止的蒲公英交易，那么該子交易也將以莖模式進行中轉，并且禁運定時器會設置為其母交易的禁運時間的最大值。 這有助于確保母交易在子交易之前進入絨毛模式被廣播出去。
Transaction propagation latency should be minimally affected by opting-in to this privacy feature; in particular, a transaction should never be prevented from propagating at all because of Dandelion. The random timer guarantees that the embargo mechanism is temporary, and every transaction is relayed according to the ordinary diffusion mechanism after some maximum (random) delay on the order of 30-60 seconds.
加入使用此蒲公英隱私功能的交易傳播的延遲應該盡量的小; 特別是，交易絕對不能因為使用了蒲公英而被阻止傳播。 隨機定時器保證了封鎖機制是暫時的，并且在30-60秒的最大（隨機）延遲之后，每個交易會根據普通擴散機制來中轉擴散。
Despite the best effort of the embargo mechanism, it is difficult to ensure that an attacker cannot find some other indirect way to probe whether a node has participated in the stem phase for a transaction. For example, an attacker seeing tx1 could create an invalid transaction tx2 that purports to spend an output from tx1, and send it to victim node Alice. If Alice has placed tx1 in mempool, then Alice will reject the attacker and disconnect it; if Alice has not seen tx1, then tx2 would instead go to the orphan cache. Fortunately, this example at least requires the attacker to burn one of its outgoing connections. Here we’re favoring an imperfect solution over something more complicated to implement.
盡管禁運機制盡了最大的努力，但是很難確保攻擊者無法找到其他間接方式來試探某個節點是否參與了交易的莖階段。 例如，看到tx1的攻擊者可以創建一個無效的事務tx2，它意圖基于tx1產生一個輸出，并將其發送到受害者節點Alice。 如果Alice已經將tx1放在mempool中，那么Alice將拒絕攻擊者并將其斷開; 如果Alice沒有看到tx1，那么tx2會轉到孤立交易緩存。 幸運的是，這個例子至少要求攻擊者破壞其中一個傳出的連接。 在這里，對比一個實施起來更為復雜的方案，我們選擇于一個不完美的解決方案。
Backward compatibility 向后兼容性
Dandelion is intended for gradual deployment and adoption, with privacy gains that increase monotonically with the fraction of adopting nodes. Theoretical analysis shows that at any adoption level, the privacy of Dandelion nodes will be better than the status quo, and non-Dandelion nodes will have privacy no worse than the status quo [5]. To achieve these results, we rely on two implementation decisions:?
蒲公英希望可以逐步部署和采用，隨采用節點的比重增加隱私增益也單調增加。 理論分析表明，在任何采用情況上，蒲公英節點的隱私性都將比現狀更好，非蒲公英節點的隱私性不會比現狀更差[5]。 為了實現這些結果，我們依靠兩個實施決策：
1. *Fluff mode by default.* Nodes without Dandelion support will continue to relay transactions with independent exponential delays. Hence, if a Dandelion node extends the stem to a non-Dandelion node, it is as if the transaction automatically enters the fluff phase. Thus, the fewer nodes that support Dandelion, the shorter the average stem length.
1. *默認用絨毛模式*
無蒲公英支持的節點將繼續以獨立指數延遲（？？？此處不明白）中轉交易。 因此，如果蒲公英節點將莖交易擴展到非蒲公英節點，就等于交易自動進入了絨毛階段。 因此，支持蒲公英的節點越少，平均莖長越短。
2. *Avoidance of self-reporting.* Nodes do not consider the Dandelion service bit when choosing which nodes to connect to or which nodes to relay to. Otherwise, during the initial gradual adoption period, this could give preference to attackers that signal Dandelion support.
2. *避免自我報告*
節點在選擇要連接的節點或要中轉交易的節點時，不要考慮蒲公英服務位。 否則，在最初的逐漸采用期間，這可能會賦予展示自己支持蒲公英交易的襲擊者優先權。
Implementation 實施
A reference implementation of Dandelion is available at
?https://github.com/gfanti/bitcoin/tree/dandelion
蒲公英的參考實施可以在 https://github.com/gfanti/bitcoin/tree/dandelion 找到
This implementation includes a modification to the wallet software that relays newly-created transactions as Dandelion transactions. 該實現中的修改包括對將新創建的交易作為蒲公英交易進行中轉的錢包軟件。
An incomplete testing harness, `p2p-dandelion.py`, is also included. 還包括一個不完整的測試工具`p2p-dandelion.py`。
Analysis?分析
This BIP references some theoretical analysis that is work in progress, e.g., regarding the anonymity guarantees of partially-deployed Dandelion. The following plot shows theoretical results on the expected recall (probability of linking a transaction to an IP address) as a function of the fraction of corrupt nodes.
這個比特幣改進建議參考了一些正在進行的理論分析，例如關于部分部署的蒲公英的匿名保證。 下圖顯示了預期召回（將交易連到IP地址的概率）和損壞節點比例的函數的理論結果。
Here we are assuming an adversarial model where a constant fraction of colluding nodes passively observe all transactions. These "spy" nodes try to infer the source of each transaction using observed timestamps, knowledge of the graph, and knowledge of which node delivered each transaction to each spy node. ‘Version-checking’ means that a node preferentially adds dandelion-compatible peers to its stem set. ‘No-version-checking’ means that each Dandelion node chooses its stem set without regards for dandelion-compatibility (as recommended in this BIP). The plot shows theoretical upper and lower bounds on the expected recall for *Dandelion nodes* that use each strategy, so the true expected recall for version-checking (resp. no-version-checking) is somewhere in the blue (resp. red) region. Non-Dandelion nodes will experience no change in their expected recall. These results suggest that no-version-checking is a better strategy, which also outperforms the simulated status quo (diffusion), even when deployment levels are low. For the simulated performance of diffusion, we used the suboptimal 'first-spy' estimator, where for each transaction, the adversary implicates the first honest node to deliver that transaction to any spy node. This gives a lower bound on the adversary's deanonymization power with respect to diffusion.
在這里，我們假設一個對抗模型，有一組固定比例的相互勾結的節點被動地觀察所有的交易。這些“間諜”節點嘗試使用觀察到的時間戳，圖的知識以及哪個節點向每個間諜節點遞送每個交易的知識來推斷每個交易的源。 '版本檢查'意味著一個節點會優先將蒲公英兼容的對等節點添加到其莖集合中。 “無版本檢查”是指每個蒲公英節點選擇其莖集合的時候不考慮蒲公英的兼容性（如本比特幣改進計劃中推薦的做法）。該圖顯示了在使用每個策略情況下的*蒲公英節點*的預期召回的理論上限和下限值，因此版本檢查（同理 無版本檢查）的真正預期召回位于藍色（對應 紅色）地區。（翻譯注：版本檢查對應藍色，無版本檢查對應紅色）?非蒲公英節點的預期召回將不會發生變化。這些結果表明，無版本檢查是一個更好的策略，即使在部署情況較低的情況下，性能也優于模擬現狀（擴散模式）。對于擴散模式的模擬性能，我們使用次優的“首次間諜”估計器，其中對于每個交易，對手暗示第一個誠實節點將該交易傳遞給任何間諜節點。這個做法給出了在擴散模式下對手去匿名能力的最低值。
Acknowledgements 致謝
Gregory Maxwell provided us with invaluable feedback and suggestions that guided our implementation approach.?
Gregory Maxwel 為我們提供了寶貴的反饋和建議，指導了我們的實施方法。
References 參考文獻
1. An Analysis of Anonymity in Bitcoin Using P2P Network Traffic
http://fc14.ifca.ai/papers/fc14_submission_71.pdf
2. Deanonymisation of clients in Bitcoin P2P network
https://arxiv.org/abs/1405.7418
3. Discovering Bitcoin’s Public Topology and Influential Nodes
https://cs.umd.edu/projects/coinscope/coinscope.pdf
4. (Sigmetrics 2017) Dandelion: Redesigning the Bitcoin Network for Anonymity
https://arxiv.org/abs/1701.04439
5. Dandelion++: TBA
Copyright
This document is placed in the public domain.
翻譯后疑問：
一直有個疑問，不管在傳播過程中如何掩蓋來源，只要有public address，不還是可以知道一個交易的來源嗎？如果知道某個public address 還是可以追蹤該地址底下所有相關的交易?
所以蒲公英到底提升在什么地方呢？
希望有大神可以解答。
