zcash-android-wallet-sdk icon indicating copy to clipboard operation
zcash-android-wallet-sdk copied to clipboard

Add randomness to the block download timer

Open defuse opened this issue 3 years ago • 1 comments

As @ccjernigan noticed, the block downloading timout interval will cause all clients with synchronized clocks to hit the server around the same time, potentially DoSing the server.

private fun calculatePollInterval(fastIntervalDesired: Boolean = false): Long {
    val interval = POLL_INTERVAL
    val now = System.currentTimeMillis()
    val deltaToNextInteral = interval - (now + interval).rem(interval)
    // twig("sleeping for ${deltaToNextInteral}ms from $now in order to wake at ${now + deltaToNextInteral}")
    return deltaToNextInteral
}

This was done in order so that timing of requests would not leak information about the wallet's state to the server. We can fix the DoS issue without adding a privacy leak by adding a random offset to deltaToNextIntegral in the code above. The random offset should be chosen anew for each poll interval (since a constant offset amount would help the server identify the wallet).

defuse avatar Jan 10 '22 18:01 defuse