Plausibly Deniable Content Discovery for Bitswap Using Random Walks

TL;DR

This work tackles privacy leakage in Bitswap content discovery by introducing RaWa-Bitswap, a random-walk-based proxy mechanism that performs discovery on behalf of the requester, thereby providing plausible deniability for the source of a lookup. The method splits discovery from retrieval and leverages a privacy-subgraph to steer random walks, with configurable parameters that balance privacy and performance. A PoC implementation based on Bitswap (boxo) and a code-driven simulation demonstrate improved privacy against passive observers with only modest performance overhead, while highlighting limitations against active adversaries and network-scale dynamics. The approach offers a practical privacy-enhancement for IPFS/Bitswap deployments, with clear avenues for mitigation and further optimization.

Abstract

Bitswap is the data exchange protocol for the content-addressed peer-to-peer overlay network IPFS. During content discovery, Bitswap reveals the interest of a peer in content to all neighbors, enabling the tracking of user interests. In our paper, we propose a modification of the Bitswap protocol, which enables source obfuscation using proxies for content discovery. The proxies are selected via a random-walk. Enabling content discovery through proxies introduces plausible deniability. We evaluate the protocol modification with a simulation. The protocol modification demonstrates enhanced privacy, while maintaining acceptable performance levels.

Figures (4)

• Figure 1: Phases of RaWa-Bitswap.
• Figure 2: Message sequence of RaWa-Bitswap.
• Figure 3: Precision and recall for different $p$ in comparison to Vanilla-Bitswap.
• Figure 4: TTFB for different $p$ in comparison to Vanilla-Bitswap.