Abstract
Cryptocurrency software implements cryptocurrency operations (including the distributed consensus protocol and peer-to-peer networking) and often involves the open-source community. We design a software assurance scheme for cryptocurrency and advance the cryptocurrency handshaking protocol by providing the verification capability of the Bitcoin software by peers and preventing any potential peer from establishing a connection with modified Bitcoin software. Since we focus on Bitcoin (the most popular cryptocurrency) for implementation and integration, we call our scheme Version++, built on and advancing the current Bitcoin handshaking protocol based on the Version message. Our Version++ protocol providing software assurance is distinguishable from previous research because it is permissionless, distributed, and lightweight for its cryptocurrency application. Our scheme is permissionless since it does not require a centralized trusted authority (unlike the remote software attestation techniques from trusted computing); it is distributed since the peer checks the software assurances of its own peer connections; and it is designed for efficiency/lightweight to support the dynamic nature of the peer connections and large-scale broadcasting in cryptocurrency networking. Utilizing Merkle Tree for the efficiency of the proof verification, we implement and test Version++ on Bitcoin software and conduct experiments in an active Bitcoin node prototype connected to the Bitcoin Mainnet. Our prototype-based performance analyses demonstrate the lightweight design of Version++. The peer-specific verification grows logarithmically with the number of software files in processing time and in storage. Furthermore, the Version++ verification overhead is small compared to the version-verack handshaking process; we measure the overhead to be 0.524% in our local networking environment between virtual machines and between 0.057% and 0.282% (depending on the peer location) in our more realistic cloud-based experiments with remote peer machines.