The Blockchain Litmus Test

Size: px

Start display at page:

Download "The Blockchain Litmus Test"

Polly Bates
5 years ago
Views:

Me BS and MS from the U of M in computer science and sowware engineering Five years at General Dynamics, three at Adven:um Published several

4 Introduc:ons About Adven:um Labs Founded 2002, 30 employees, Minneapolis Technical: System Engineering, Automated Reasoning, Cyber Security Ongoing Research Thrusts: Cyber Physical Systems Safety and Security Model-Based Systems Engineering Security for Virtualized Systems About Me BS and MS from the U of M in computer science and sowware engineering Five years at General Dynamics, three at Adven:um Published several ar:cles on blockchain, IEEE paper in December Blockchain: Beyond the Hype Blockchain Introduc:on Podcast Looking for nails for my blockchain hammer

5 Blockchain Intro Blockchain is a distributed database with correctness guaranteed by proof-of-work. As long as the processing-majority of par:cipa:ng nodes are honest, the longest chain is guaranteed to be the right one. Processing majority refers to the available CPU/GPU power, not the number of par:cipants. The longest chain is the blockchain with the most signed blocks. There are varia:ons to the proof approach, such as proof-of-stake. These varia:ons are rela:vely new and present addi:onal risks. 12/12/17 Adven:um Labs,

6 What blockchain is Nonce Nonce Nonce Previous Block Hash Previous Block Hash Previous Block Hash Data Data Data Hash Hash Hash These hash values are easy-to-verify numbers demonstra:ng both the integrity of the block and the work performed by the signer. The rules for what cons:tutes a valid signature are determined by community consensus. 12/12/17 Copyright 2017 Adven:um Labs 6

7 Block Signing A hash is a one way func:on. It is quick to compute but expensive to reverse. Blockchain miners perform a brute-force reverse hash. Signing a block means proving that you have spent money compu:ng the hash of the block many :mes. 12/12/17 Copyright 2017 Adven:um Labs 7

Guess a Nonce Compute the Hash Hash does

8 Block Signing The nonce is just an arbitrary number. Block 002 Hash Block 003 Tx1 Tx2 Tx n Block 002 Hash Block 003 Tx1 Tx2 Tx n Block 002 Hash Block 003 Tx1 Tx2 Tx n Block 003 Hash The hash is a number generated from the rest of the informa:on in the block. Hash meets threshold Any change to the block causes an unpredictable change to the hash. Publish the Block or Collect Transac:ons Guess a Nonce Compute the Hash Hash does not meet threshold Try Again 12/12/17 Copyright 2017 Adven:um Labs 8

9 What blockchain is not Immutable A Blockchain is not immutable. Long chains are difficult to manipulate and easy to verify. Cloud A Blockchain is NOT inherently in the cloud. Anonymous Blockchain has no iden:ty concepts. Bitcoin is pseudonymous. 12/12/17 Copyright 2017 Adven:um Labs 9

Applica:on Blockchain Security The implementa:on resists

10 When is Blockchain Useful? Trust The origin of data held in the blockchain is verifiable. Applica:on Blockchain Security The implementa:on resists tampering, either through proof-of-work, proof-ofstake, or restricted access. Dependability Security Trust Dependability Users are mo:vated to invest in the blockchain and content managed by the blockchain is accessible. 12/12/17 Adven:um Labs,

11 Blockchain Risks Digital Contract Errors Mistakes Are Hard to Revert Nonce Previous Data SHA256 Nonce Previous Data SHA256 Nonce Previous Data SHA256 Incorrect Input Stolen Keys Community support dries up The risks of blockchain come from everything between you and the blockchain. 12/12/17 Copyright 2017 Adven:um Labs 11

12 Recommended Reading Brief: IEEE Spectrum: Do You Need a Blockchain? How Bitcoin works under the hood (Youtube) In depth: Blockchain for Recordkeeping: Help or Hype? Bitcoin: A Primer for Policymakers Applica:on Blockchain Trust Security Dependability 12/12/17 Copyright 2017 Adven:um Labs 12

14 Trust Taxonomy (Lemieux) Trust Accuracy Reliability Authen6city Completeness at point of crea6on Iden6ty Integrity Consistency (with formal rules of crea6on) Archival Bond Completeness ader crea6on Objec6vity/ Impar6ality (Naturalness) 12/12/17 Adven:um Labs,

15 Dependability Taxonomy (Avizienis) Dependability Availability Reliability Safety Integrity Maintainability 12/12/17 Adven:um Labs,

16 Security Taxonomy (Avizienis) Security Availability Confiden;ality Integrity 12/12/17 Adven:um Labs,

17 U:lity Taxonomy (blended) U:lity Dependability Security Trust Availability Confiden:ality Authen:city Accuracy Reliability Maintainability Iden:ty Integrity Completeness at point of crea:on Completeness awer crea:on Consistency (with formal rules of crea:on) Objec:vity/ Impar:ality (Naturalness) 12/12/17 Adven:um Labs,

18 Do you need a blockchain? From Morgan E. Peck s Do You Need a Blockchain IEEE Spectrum, September /12/17 18

s:ll maturing Applica:on Blockchain Trust Security Dependability

19 Mt. Gox Case Study Stolen Keys 460 Million lost to hackers Users trusted the exchange with their transac:on keys Bitcoin exchange regula:on is s:ll maturing Applica:on Blockchain Trust Security Dependability heps:// 12/12/17 Copyright 2017 Adven:um Labs 19

20 Ethereum Case Study - Contract Error 31 Million lost to hackers Users trusted shared wallet sowware that had buggy code Execu:on of a smart contract is hard to reverse Applica:on Blockchain Trust Security Dependability heps://haseebq.com/a-hacker-stole-31m-of-ether/ 12/12/17 Copyright 2017 Adven:um Labs 20

21 ICO Case Study Centralized Control 374k investor funds lost Happened November 6-8, 2017 Startup performed an Ini:al Coin Offering (ICO) then disappeared Applica:on Blockchain Trust Security Dependability heps://motherboard.vice.com/en_us/ar:cle/j5j34x/ethereum-startup-confidovanished-awer-people-invested-374k-ico 12/12/17 Copyright 2017 Adven:um Labs 21

22 Tether Case Study Immutability 30 million lost to hackers Happened 9 days ago, details are unclear Applica:on Blockchain Trust Security Dependability heps:// million-of-digital-tokens.html 12/12/17 Copyright 2017 Adven:um Labs 22

23 DAO Case Study Smart Contract Error 60 million lost to hackers Contract based on Ethereum had flaws Applica:on Blockchain Trust Security Dependability hep://fortune.com/2016/06/18/blockchain-vc-fund-hacked/ 12/12/17 Copyright 2017 Adven:um Labs 23

24 Mining in Context 12/12/17 24

25 Recommended Reading Links Brief: Do you need a blockchain? (IEEE Spectrum) This is a easy-to-follow flow chart explaining the use cases for which blockchain is appropriate. heps://spectrum.ieee.org/compu:ng/networks/do-you-need-a-blockchain "How Bitcoin works under the hood (Youtube) This video gives a visual explana:on of the working of Bitcoin, the de facto reference implementa:on of blockchain. heps:// In depth: Blockchain for Recordkeeping, Help or Hype? (University of Bri:sh Columbia) This paper provides a cri:cal view of blockchain through the archival science lens. heps:// _Blockchain_for_Recordkeeping_Help_or_Hype Bitcoin: A Primer for Policymakers This paper surveys legal issues surrounding cryptocurrencies in the United States. heps:// 12/12/17 Copyright 2017 Adven:um Labs 25

Blockchain: Applica.ons, Security Promises and Internals

Blockchain: Applica.ons, Security Promises and Internals Cyber Security & Informa3on Systems Informa3on Analysis Center (CSIAC) Dr. Yuzhe (Richard) Tang Department of EECS, Syracuse University Dec. 19,