Identity Amortization: Shared Resources and the Cost of Sybil Attacks

Abstract

Sybil defenses commonly price identities by requiring a resource for each one. When one resource can support several identities, an adversary can pay less per identity than the defense intends. We call this identity amortization: a strict reduction in the minimum cost of provisioning identities when resources may be shared, relative to provisioning each one independently. It is a second route to the gap that a Sybil attack exploits. When influence is assigned per identity, a defense calibrated to the nominal price can overestimate the cost of a Sybil threshold by up to the number of identities one resource supports. For any resource catalogue, we give exact tests for when identity amortization occurs, where it begins, and its largest error; a sharing cap below the onset removes it. Because the tests need only prices and capacities, they apply to any defense that admits identities against a shareable resource, telling designers whether the assumed per-identity cost is paid, how wrong it can be, and which intervention restores it most cheaply for honest participants. On published phone-verification prices, per-account estimates overstate provisioning cost 1.6 to 4.3 times; Tor's raised per-address relay limit cut modeled attack cost by 8 to 72%, depending on the address-to-relay price ratio.