Blockchain and Security – Solving the challenge of Privacy, Identity and Trust discusses key security challenges with blockchain such as identity, privacy, trust, and cryptography. It explores solutions like permissioned blockchains, homomorphic encryption, and zero knowledge proofs to address these issues. The document also examines cases like Silk Road and MtGox that demonstrate security failures with blockchain.

1. Blockchain and Security – Solving
the challenge of Privacy, Identity
and Trust
Anish Mohammed
MIT DCI – 25th August 2016

2. Blockchain – what makes it unique
● Pseudonmity- The ability that
users are not easily identified
● Censorship resistance – gives the
ability to bypass authorities
● Decentralised – distributed hence
hard to track down

3. Blockchain – key security challenges
● Identity- General approach has been to
support pseudonyms
● Privacy – Blockchain as a paradigm
expects all data to be available
● Trust – Question of trust in a
decentralised system

4. Blockchain – key security challenges (contd)
● Cryptography – choice of algorithms and
parameters not necessarily considered
traditional. Also the question of QC
resistance brought up by some vendors
● Infrastructure – Generally considering the
whole Blockchain ecosystem, esp Bitcoin

5. Blockchain and Post Quantum Cryptography
● Shor’s algorithm
● Grover’s algorithm
● Current crop of QC resistant
algorithms

6. Privacy
● Permissioned Blockchain – having Blockchain
which has permission
● Homomorphic encryption – Allowing
operations with out revealing content

7. Smart Contracts and Privacy
● “The basic idea behind smart contracts is that many kinds of
contractual clauses (such as collateral, bonding, delineation of
property rights, etc.) can be embedded in the hardware and
software we deal with, in such a way as to make breach of
contract expensive (if desired, sometimes prohibitively so) for
the breacher.”
● “Smart contracts combine protocols, user interfaces, and
promises expressed via those interfaces, to formalize and secure
relationships over public networks. This gives us new ways to
formalize the digital relationships which are far more functional
than their inanimate paper-based ancestors”
● “Smart contracts reduce mental and computational transaction
costs.”
– “Formalizing and Securing Relationships on Public Networks,” Nick Szabo

8. Contracts Systems evolution

9. Permissioned Blockchain
● Permissioned Blockchain – Bitcoin
Blockchain is non-permissioned, nodes could
have permission to read or write

10. Homomorphic Encryption
● Homomorphic Encryption – the challenge of
processing without knowing what is being
asked
Function
f
x
search
query Google
search
Search results
x
f(x)

11. Homomorphic Encryption
● Homomorphic Encryption – Oct 2008 Craig
Gentry came up with solution
Function
f
x
Enc(x)
Enc(f(x))
search
query
Search results
Google
search

12. Homomorphic – under multiplication
● Some encryption algorithms already have
multiplicative homomorphic properties, e.g.
RSA 𝐸 𝑚1 = 𝑚1
𝑒
𝐸 𝑚2 = 𝑚2
𝑒
which implies 𝐸 𝑚1 × 𝐸 𝑚2
= 𝑚1
𝑒 × 𝑚2
𝑒
= (𝑚1 × 𝑚2) 𝑒
= 𝐸(𝑚1 × 𝑚2)

13. Homomorphic – under addition
● Other Encryptions were additively
homomorphic
𝐸 𝑚1 + 𝐸 𝑚2 = 𝐸(𝑚1 + 𝑚2)
Additive Homomorphism

14. Enigma – the possible answer from MIT

15. MtGox – yet another case

16. Provisions – privacy preserving way to prove solvency

17. Trust
● Trust model – Bitcoin Blockchain has a
distributed model of trust. So everyone
trusts everybody else.
● Intermediaries in the ecosystem – real life
implementation of Bitcoin ecosystem
requires one to trust various intermediaries
with varying results.

18. Bitcoin/Blockchain – malware
● Malware which mines (steals CPU/GPU
cycles)
● Malware which steals Bitcoin from
wallets
● Ransomware – accepts Bitcoins to
release keys

19. Bitcoin/Blockchain – malware

20. Identity
● Identity- General approach has been to
support pseudonyms
● Identity verification – strength of
verification of identity is as good as
onboarding

21. Identity – some interesting examples

22. Blockchain and graph analysis

23. Silkroad – A case of failure

24. Smart Contracts – security challenges (moritorium)

25. Smart Contracts – security challenges (the hack)

26. Other tools - Trusted Computing

27. Trust

28. Trustworthy systems

29. Trusted Platform Module

30. Direct Anonymous Attestation

31. Zero Knowledge Proofs

32. Zero Knowledge protocols - properties
● Completeness -If prover is telling the truth, then they
will eventually convince the verifier.
● Soundness -Prover can only convince verifier if they're
actually telling the truth.
● Zero-knowledgeness -Verifier doesnt learn anything
else about prover's solution
According to Goldwasser, Micali and Rackoff

33. Blockchain and expert opinions

34. Dilbert’s take on Security

35. Anish Mohammed
@anishmohammed