Creating trust through blockchain?

Creating trust through blockchain?

Ten years after the Bitcoin whitepaper was published, the term “blockchain” is still primarily associated with cryptocurrencies. Rightly so, one might say, as the added value is inextricably linked to the underlying data structure of Bitcoin. However, there is also an increase in the number of voices pursuing the use of these technologies in areas that are not concerned with the direct (peer-to-peer) exchange of virtual currencies. In particular, distributed systems that do not rely on individual trusted third parties, enable traceability and transparency, and log transactions immutably and unambiguously are inspirations for interesting deployment scenarios.

Therefore, it is essential to examine the fundamental mechanisms and guarantees of blockchain technologies with special focus on their suitability for specific application scenarios. It may therefore come as a surprise that many of the fundamental properties of Bitcoin or blockchain technologies have not yet been fully researched and understood from a scientific perspective; in particular, the game-theoretic aspects.1 For example, potential attacks against Bitcoin and similar protocols are known to be more profitable strategies for miners than honest behavior.2 Nevertheless, such attacks are rarely carried out in practice and are mostly limited to lesser-known cryptocurrencies.

If one is now tempted to leave these game-theoretic elements up front when using a blockchain protocol, various basic assumptions change. However, in a Bitcoin-like construction, the included currency aspects are integral to security and correctness. This does not mean that blockchains without a currency component are inherently insecure; merely that further assumptions, such as additional consensus protocols or greater trust in participants, are necessary to ensure the expected guarantees and properties of the blockchain even in a new application scenario.

It can be quite similar with the functionality of the Blockchain-based system provided to participants. If, for example, there is the possibility of creating smart contracts oneself, defining simple validity conditions for transactions, or attaching additional data to a transaction, this can lead to a variety of possible attacks and undesirable side effects. For example, the resources consumed to verify and execute a transaction should be in proportion to the actual transaction fee, otherwise denial-of-service attacks may become possible.3 It can also happen that unwanted data from users is encoded into a blockchain.4 The latter problem highlights an exciting dichotomy between the intended construction of a blockchain as an immutable history of transactions and the need to be able to not only selectively withhold certain information, but even remove it entirely. Systems in which such variability exists5 raise the question of who can initiate these edits and how much trust in third parties is again necessary as a result.

Another important aspect to be critically questioned is the use of additional complex cryptographic protocols, especially to improve privacy through so-called “zero-knowledge proofs”. Potential benefits can have far-reaching consequences in the case of a faulty implementation or incorrect formal construction and endanger the general consistency of the blockchain. As a cautionary example, a flawed cryptographic construction of the anonymity-focused cryptocurrency ZCash could theoretically have allowed an attacker to generate any number of units of the virtual currency out of thin air, largely unnoticed6. The concept used was thought up by renowned cryptographers, published at excellent conferences and technically implemented by cryptography experts; nevertheless, this flaw was able to sneak into the protocol.

Critical voices against blockchain technologies may feel vindicated because of the examples mentioned. However, it is not our goal to spread skepticism. Rather, we want to show that precisely those areas in which blockchains and distributed ledger technologies can find meaningful application often have strong requirements for security and correctness. In this respect, traditional system architectures must also meet the high requirements and be constructed or revised to the best of their ability. A blockchain is not a standalone system, but always part of a more complex infrastructure consisting of software and hardware components that we must also be able to trust.

Blockchain technologies in themselves should not be seen as a mechanism to increase trust in a system. Rather, they can help distribute trust away from single entities and points to multiple instances for greater resilience to errors and attacks. Further, any potential use of blockchain should always be carefully considered, as different application scenarios have very different requirements that cannot be met by a single generic solution. The use of blockchain technologies does not avoid paying the necessary attention to the issue of “security” and thus justifying trust.

References

  1. https://eprint.iacr.org/2019/775
  2. Zhang and Preneel, Lay down the common metrics: Evaluating proof-of-work consensus protocols’ security, Proc. of 2019 IEEE Symposium on Security and Privacy, 2019.
  3. https://blog.ethereum.org/2016/09/22/ethereum-network-currently-undergoing-dos-attack/
  4. Matzutt et al., A Quantitative Analysis of the Impact of Arbitrary Blockchain Content on Bitcoin, Proceedings of the 22nd International Conference on Financial Cryptography and Data Security (FC), 2018.
  5. Ateniese et al., Redactable Blockchain–or–Rewriting History in Bitcoin and Friends,IEEE European Symposium on Security and Privacy (EuroS&P), 2017.
  6. https://electriccoin.co/blog/zcash-counterfeiting-vulnerability-successfully-remediated/

(By Mag. Daniela Friedl, SBA Research)