discv5: Add admission-control parameter rationale by oascigil · Pull Request #272 · ethereum/devp2p

oascigil · 2026-07-06T14:11:47Z

Adds the admission-control parameter rationale document and figures under discv5/.

Files:

discv5/admission_parameter_rationale.md

The first draft to rationalise the default admission-control parameters, including Pocc, C, etc in the waiting time function.

harnen · 2026-07-21T08:48:41Z

+
+## 1. Objective
+
+This report motivates the choice of parameter values for the registrar-side admission protocol used for topic advertisement registration. The admission protocol regulates access to a finite advertisement cache (ad cache). Its purpose is not merely to keep the cache below its capacity, but to decide *how to prioritise* registrations when admitting them to the cache by imposing *waiting times* to the registration requests. The waiting times determine the delay in which each request is to wait before its ad is stored in the ad cache. 


We could maybe make it a bit less wordy.

harnen · 2026-07-21T08:49:11Z

+| `Pocc` | Occupancy exponent | `10` |
+| `G` | Small safety constant in the waiting-time expression | `1e-7` |
+
+The admission waiting-time expression contains three conceptually distinct components: an occupancy term, a topic-similarity term, and an IP-diversity term. The occupancy term makes admission more conservative as the cache fills. The topic-similarity term discourages a single service topic from dominating the cache. The IP-diversity term discourages many registrations from the same or similar IP prefixes. The parameter rationale therefore has to answer two questions simultaneously: first, whether the cache remains usable for honest advertisers; second, whether the mechanism prevents cheap cache capture by abusive advertisers.


This also could be less wordy :)

harnen · 2026-07-21T08:51:32Z

+
+In a target-topic starvation attack, the attacker repeatedly registers advertisements for a single target topic. The attacker's objective is to dominate the registrar's entries for that topic, thereby excessively delaying or preventing honest registrations for the same topic and biasing topic lookup results towards attacker-controlled advertisements.
+
+In the target-topic experiments, 50% of honest registrations use the target topic and the remaining honest registrations are distributed over other topics. The attackers register ads for only the target topic.


What's the benign topic distribution?

harnen · 2026-07-21T08:52:13Z

+
+### 2.2 Cache occupation attack
+
+In a whole-cache occupation attack, the attacker spreads registrations over many (random) topics. The objective is to consume registrar ad cache capacity. Imposing IP diversity makes this attack more difficult (i.e., costly), as advertisers must register ads from diverse IP addresses. 


Is there only one attacker with a single IP?

harnen · 2026-07-21T08:53:02Z

+
+## 3. Evaluation questions
+
+The evaluation is organised around five questions. Each question is associated with a specific parameter or mechanism component.


Not sure we need this section. Basically, we just want to choose the optimal parameters.

harnen · 2026-07-21T09:40:33Z

+
+Capacity should be viewed primarily as a resource-sizing parameter rather than a direct security parameter. Increasing `C` can reduce honest waiting time, but it also weakens scarcity and permits a larger attacker presence. The default value `C = 1000` avoids the extreme delays observed for very small caches while preserving enough scarcity for the admission mechanism to constrain attacker share.
+
+## 7. Q3: Rationale for the IP-diversity score


Actually, do we need this section? We're not setting any parameter here.

harnen · 2026-07-21T09:41:30Z

+The cost imposed on concentrated attackers is also visible in attempts per admission. Under the `/24` attack, enabling IP scoring increases attacker attempts per admission from about 14 to about 85. This indicates that the IP-diversity term does not merely reduce cache share; it also changes the cost curve faced by the attacker. Concentrated attackers can still obtain admissions, but they must make substantially more attempts per successful admission.
+
+
+## 8. Q4: Cost of topic similarity for popular honest topics


I'd also potentially scrape it. This justifies the design and could go to the rationale file.

harnen · 2026-07-21T09:44:03Z

+
+This is acceptable if discovery is expected to use multiple registrars and if popular services can be represented across the network rather than relying on unrestricted dominance at each registrar. The design implication is that topic similarity improves robustness and diversity at the cost of some delay for legitimately popular topics.
+
+## 9. Q5: Robustness under increasing attack intensity


Should this be part of the selection process? Comparing different set of parameters might be useful. Currently, it's difficult to tell whether 140 attempts is a lot or not.

harnen · 2026-07-21T09:44:36Z

+
+These results support interpreting admission control as a cost-imposition mechanism rather than an absolute exclusion mechanism. Increasing attacker rate still increases attacker cache share, but the marginal cost of admitted advertisements also increases substantially. This supports the default parameter choice because it provides graceful degradation under stronger attack intensity rather than immediate cache capture.
+
+## 10. Recommended parameter values


We don't have any tests for E and G, right?

harnen · 2026-07-21T09:44:50Z

+
+The central rationale is that the default setting should prioritise cache diversity and abuse resistance while preserving usable, though not maximal, cache utilisation. `Pocc = 10` and `C = 1000` should be understood as pragmatic defaults rather than universal optima. They are appropriate for the evaluated workload and attack rates, but deployments with different resource constraints or threat models may tune them differently.
+
+## 11. Summary


Probably not needed.

oascigil changed the title ~~Add admission-control parameter rationale~~ Discv5: Add admission-control parameter rationale Jul 6, 2026

oascigil changed the title ~~Discv5: Add admission-control parameter rationale~~ discv5: Add admission-control parameter rationale Jul 6, 2026

oascigil and others added 6 commits July 14, 2026 14:05

Add admission-control parameter rationale

eb0be8d

Update admission_parameter_rationale.md

ebaa523

Update admission_parameter_rationale.md

e83e9b8

Smaller Figures; some are placed side-by-side

8faff6b

Smaller figures and some side-by-side

bd08573

Fixed figure sizes

54f77dd

srene force-pushed the admission-parameter-rationale branch from 1ff72b4 to 54f77dd Compare July 14, 2026 12:12

srene mentioned this pull request Jul 21, 2026

Task 2.8: Rationale for admission control parameter values datahop/go-ethereum#85

Open

harnen reviewed Jul 21, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

discv5: Add admission-control parameter rationale - #272

discv5: Add admission-control parameter rationale#272
oascigil wants to merge 6 commits into
ethereum:masterfrom
datahop:admission-parameter-rationale

oascigil commented Jul 6, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

harnen Jul 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants


		## 1. Objective

		This report motivates the choice of parameter values for the registrar-side admission protocol used for topic advertisement registration. The admission protocol regulates access to a finite advertisement cache (ad cache). Its purpose is not merely to keep the cache below its capacity, but to decide how to prioritise registrations when admitting them to the cache by imposing waiting times to the registration requests. The waiting times determine the delay in which each request is to wait before its ad is stored in the ad cache.


		In a target-topic starvation attack, the attacker repeatedly registers advertisements for a single target topic. The attacker's objective is to dominate the registrar's entries for that topic, thereby excessively delaying or preventing honest registrations for the same topic and biasing topic lookup results towards attacker-controlled advertisements.

		In the target-topic experiments, 50% of honest registrations use the target topic and the remaining honest registrations are distributed over other topics. The attackers register ads for only the target topic.


		### 2.2 Cache occupation attack

		In a whole-cache occupation attack, the attacker spreads registrations over many (random) topics. The objective is to consume registrar ad cache capacity. Imposing IP diversity makes this attack more difficult (i.e., costly), as advertisers must register ads from diverse IP addresses.


		## 3. Evaluation questions

		The evaluation is organised around five questions. Each question is associated with a specific parameter or mechanism component.


		Capacity should be viewed primarily as a resource-sizing parameter rather than a direct security parameter. Increasing `C` can reduce honest waiting time, but it also weakens scarcity and permits a larger attacker presence. The default value `C = 1000` avoids the extreme delays observed for very small caches while preserving enough scarcity for the admission mechanism to constrain attacker share.

		## 7. Q3: Rationale for the IP-diversity score

		The cost imposed on concentrated attackers is also visible in attempts per admission. Under the `/24` attack, enabling IP scoring increases attacker attempts per admission from about 14 to about 85. This indicates that the IP-diversity term does not merely reduce cache share; it also changes the cost curve faced by the attacker. Concentrated attackers can still obtain admissions, but they must make substantially more attempts per successful admission.


		## 8. Q4: Cost of topic similarity for popular honest topics


		This is acceptable if discovery is expected to use multiple registrars and if popular services can be represented across the network rather than relying on unrestricted dominance at each registrar. The design implication is that topic similarity improves robustness and diversity at the cost of some delay for legitimately popular topics.

		## 9. Q5: Robustness under increasing attack intensity


		These results support interpreting admission control as a cost-imposition mechanism rather than an absolute exclusion mechanism. Increasing attacker rate still increases attacker cache share, but the marginal cost of admitted advertisements also increases substantially. This supports the default parameter choice because it provides graceful degradation under stronger attack intensity rather than immediate cache capture.

		## 10. Recommended parameter values


		The central rationale is that the default setting should prioritise cache diversity and abuse resistance while preserving usable, though not maximal, cache utilisation. `Pocc = 10` and `C = 1000` should be understood as pragmatic defaults rather than universal optima. They are appropriate for the evaluated workload and attack rates, but deployments with different resource constraints or threat models may tune them differently.

		## 11. Summary

Uh oh!

Conversation

oascigil commented Jul 6, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants