I would like to jump on the blockchain bandwagon. I would like to be able to say that blockchain is the solution to the longstanding problem of secure identity on the Internet. I would like to say that everyone in the world will soon have a digital identity. Put yourself on the blockchain and never again ask yourself, Who am I? - you are your blockchain address.
Emre Yavuz, Ali Kaan Koc, Umut Can Çabuk, Gökhan Dalkılıç
There is no doubt that the revolutionary concept of the blockchain, which is the underlying technology behind the famous cryptocurrency Bitcoin and its successors, is triggering the start of a new era in the Internet and the online services. While most people focus only at cryptocurrencies; in fact, many administrative operations, fintech procedures, and everyday services that can only be done offline and/or in person, can now safely be moved to the Internet as online services. What makes it a powerful tool for digitalizing everyday services is the introduction of smart contracts, as in the Ethereum platform. Smart contracts are meaningful pieces of codes, to be integrated in the blockchain and executed as scheduled in every step of blockchain updates. E-voting on the other hand, is another trending, yet critical, topic related to the online services. The blockchain with the smart contracts, emerges as a good candidate to use in developments of safer, cheaper, more secure, more transparent, and easier-to-use e-voting systems. Ethereum and its network is one of the most suitable ones, due to its consistency, widespread use, and provision of smart contracts logic. An e-voting system must be secure, as it should not allow duplicated votes and be fully transparent, while protecting the privacy of the attendees. In this work, we have implemented and tested a sample e-voting application as a smart contract for the Ethereum network using the Ethereum wallets and the Solidity language. Android platform is also considered to allow voting for people who do not have an Ethereum wallet. After an election is held, eventually, the Ethereum blockchain will hold the records of ballots and votes. Users can submit their votes via an Android device or directly from their Ethereum wallets, and these transaction requests are handled with the consensus of every single Ethereum node. This consensus creates a transparent environment for e-voting. In addition to a broad discussion about reliability and efficiency of the blockchain-based e-voting systems, our application and its test results are presented in this paper, too.
In this work, we propose a novel approach, called Conflicts Check Protocol (CCP), which enables preventing potential attacks on bitcoin system. Based on the observation and discovery of a common symptom that many attacks may generate, an arbitration mechanism is proposed to determine the approval or abandon of certain transactions involved in confliction. Experimental results verified our statistical assumption and proved that the CCP is robust in handling many transactions in confliction scenarios and can significantly enhance the security of the current bitcoin systems. Unlike many of the existing efforts, this work examines the security issue of bitcoin from a new perspective, which can be extended further to a much larger scope of attack analysis and prevention.
Blockchain-based distributed computing platforms enable the trusted execution\nof computation - defined in the form of smart contracts - without trusted\nagents. Smart contracts are envisioned to have a variety of applications,\nranging from financial to IoT asset tracking. Unfortunately, the development of\nsmart contracts has proven to be extremely error prone. In practice, contracts\nare riddled with security vulnerabilities comprising a critical issue since\nbugs are by design non-fixable and contracts may handle financial assets of\nsignificant value. To facilitate the development of secure smart contracts, we\nhave created the FSolidM framework, which allows developers to define contracts\nas finite state machines (FSMs) with rigorous and clear semantics. FSolidM\nprovides an easy-to-use graphical editor for specifying FSMs, a code generator\nfor creating Ethereum smart contracts, and a set of plugins that developers may\nadd to their FSMs to enhance security and functionality.\n
Since 2004, different research was handling the challenges in the centralized voting systems, e-voting protocols and recently the decentralized voting. So electronic voting puts forward some difficulties regarding the voter anonymity, the secure casting of the votes and to prevent the voting process from frauding. The Decentralized property of the technology called "blockchain" could have the solution for many of the challenges in voting research area and brings a new secure mechanism of safe and transparent voting. In this paper, a broad comparison between ongoing voting systems has studied by analyzing their structure and the drawbacks that should consider in future to improve the whole election process from keeping the privacy of the voter, casting a vote with the possibility to check if it was counted correctly to publishing the results. The result of the paper will give a new approach to extend the target of the election from small scale to large scale despite the fact of Ethereum limitation which can cast on the blockchain just five votes per minute. The primary challenge is to find an answer for this question: "How to balance between voter privacy and transparency without breaking the important rule where the voter can proof for a specific candidate that he voted for him in a bribe situation?".
Alberto Sonnino, Mustafa Al-Bassam, Shehar Bano, Sarah Meiklejohn · 5 authors
Coconut is a novel selective disclosure credential scheme supporting distributed threshold issuance, public and private attributes, re-randomization, and multiple unlinkable selective attribute revelations. Coconut integrates with blockchains to ensure confidentiality, authenticity and availability even when a subset of credential issuing authorities are malicious or offline. We implement and evaluate a generic Coconut smart contract library for Chainspace and Ethereum; and present three applications related to anonymous payments, electronic petitions, and distribution of proxies for censorship resistance. Coconut uses short and computationally efficient credentials, and our evaluation shows that most Coconut cryptographic primitives take just a few milliseconds on average, with verification taking the longest time (10 milliseconds).
Abstract A functional credential allows a user to anonymously prove possession of a set of attributes that fulfills a certain policy. The policies are arbitrary polynomially computable predicates that are evaluated over arbitrary attributes. The key feature of this primitive is the delegation of verification to third parties, called designated verifiers. The delegation protects the privacy of the policy : A designated verifier can verify that a user satisfies a certain policy without learning anything about the policy itself. We illustrate the usefulness of this property in different applications, including outsourced databases with access control. We present a new framework to construct functional credentials that does not require (non-interactive) zero-knowledge proofs. This is important in settings where the statements are complex and thus the resulting zero-knowledge proofs are not efficient. Our construction is based on any predicate encryption scheme and the security relies on standard assumptions. A complexity analysis and an experimental evaluation confirm the practicality of our approach.
This paper investigates a critical access control issue in the Internet of Things (IoT). In particular, we propose a smart contract-based framework, which consists of multiple access control contracts (ACCs), one judge contract (JC), and one register contract (RC), to achieve distributed and trustworthy access control for IoT systems. Each ACC provides one access control method for a subject-object pair, and implements both static access right validation based on predefined policies and dynamic access right validation by checking the behavior of the subject. The JC implements a misbehavior-judging method to facilitate the dynamic validation of the ACCs by receiving misbehavior reports from the ACCs, judging the misbehavior and returning the corresponding penalty. The RC registers the information of the access control and misbehavior-judging methods as well as their smart contracts, and also provides functions (e.g., register, update, and delete) to manage these methods. To demonstrate the application of the framework, we provide a case study in an IoT system with one desktop computer, one laptop and two Raspberry Pi single-board computers, where the ACCs, JC, and RC are implemented based on the Ethereum smart contract platform to achieve the access control.
The Internet pervades many aspects of modern life offering up seemingly boundless opportunities to connect, inform and be informed. As the range and number of sources for information online explode, how people go about selecting and interpreting information has become a pertinent area for study, not least in the recent light of the prevalence of fake-news—as people are well known to act upon information they believe to be trustworthy. Where the decision to act incurs risk, an inability to accurately select and assess the credibility of information presents a challenge. <br/><br/>This extended abstract summarizes findings from a study of 57 Bitcoin users. Our analysis shows that this self-identifying technical and expert community was not significantly influenced by confirmation bias (a facet of fake-news). However, the same users also failed to demonstrate a true reliance upon the facts contained in news articles, often deferring trust to the source of the news which could still render them susceptible to fake-news, and, in turn, place their speculation of the crypto-currency at risk.
Smart contracts can automatically perform the contract terms according to the received information, and it is one of the most important research fields in digital society. The core of smart contracts is algorithm contract, that is, the parties reach an agreement on the contents of the contract and perform the contracts according to the behaviors written in certain computer algorithms. It not only needs to make sure about the correctness of smart contracts code, but also should provide a credible contract code execution environment. Blockchain provides a trusted execution and storage environment for smart contracts by the distributed secure storage, consistency verification and encryption technology. Current challenge is how to assure that smart contract can be executed as the parties' willingness. This paper introduces formal modeling and verification in formal methods to make smart contract model and verify the properties of smart contracts. Formal methods combined with smart contracts aim to reduce the potential errors and cost during contract development process. The description of a general and formal smart contract template is provided. The tool of model checking, SPIN, is used to verify the correctness and necessary properties for a smart contract template. The research shows model checking will be useful and necessary for smart contracts.
Existing Byzantine fault tolerance (BFT) protocols face significant challenges in the consortium blockchain scenario. On the one hand, we can make little assumptions about the reliability and security of the underlying Internet. On the other hand, the applications on consortium blockchains demand a system as scalable as the Bit-coin but providing much higher performance, as well as provable safety. We present a new BFT protocol, Gosig, that combines crypto-based secret leader selection and multi-round voting in the protocol layer with implementation layer optimizations such as gossip-based message propagation. In particular, Gosig guarantees safety even in a network fully controlled by adversaries, while providing provable liveness with easy-to-achieve network connectivity assumption. On a wide area testbed consisting of 140 Amazon EC2 servers spanning 14 cities on five continents, we show that Gosig can achieve over 4,000 transactions per second with less than 1 minute transaction confirmation time.
Jia Liu, Tibor Jager, Saqib A. Kakvi, Bogdan Warinschi
Time-lock encryption is a method to encrypt a message such that it can only be decrypted after a certain deadline has passed. We propose a novel time-lock encryption scheme, whose main advantage over prior constructions is that even receivers with relatively weak computational resources should immediately be able to decrypt after the deadline, without any interaction with the sender, other receivers, or a trusted third party. We build our time-lock encryption on top of the new concept of computational reference clocks and an extractable witness encryption scheme. We explain how to construct a computational reference clock based on Bitcoin. We show how to achieve constant level of multilinearity for witness encryption by using SNARKs. We propose a new construction of a witness encryption scheme which is of independent interest: our scheme, based on Subset-Sum , achieves extractable security without relying on obfuscation. The scheme employs multilinear maps of arbitrary order and is independent of the implementations of multilinear maps.
Blockchain systems establish a cryptographically secure data structure for storing data in the form of a hash chain. We use a novel combination of distributed storage, private key encryption, and Shamirs secret sharing scheme to distribute transaction data, without significant loss in data integrity. Additionally, using Shamirs secret sharing scheme on the hash values and dynamic zone allocation, we further enhance the integrity. We highlight the tradeoff in storage cost and data loss probability with varying zone size choices. We also study the tradeoff between recovery cost and security from adversarial corruption with varying recovery mechanisms. Then, we formulate code design, given a probability of data recovery and targeted corruption, as an integer program. Using the coding scheme we establish a mechanism to insure data, for instance in blockchain-based cloud storage systems, based on the value of the data, by understanding the costs involved for the service provider.
The Intelligent vehicle is experiencing revolutionary growth in research and industry, but it still suffers from a lot of security vulnerabilities. Traditional security methods are incapable of providing secure IV, mainly in terms of communication. In IV communication, major issues are trust and data accuracy of received and broadcasted reliable data in the communication channel. Blockchain technology works for the cryptocurrency, Bitcoin which has been recently used to build trust and reliability in peer-to-peer networks with similar topologies to IV Communication world. IV to IV, communicate in a decentralized manner within communication networks. In this paper, we have proposed, Trust Bit (TB) for IV communication among IVs using Blockchain technology. Our proposed trust bit provides surety for each IVs broadcasted data, to be secure and reliable in every particular networks. Our Trust Bit is a symbol of trustworthiness of vehicles behavior, and vehicles legal and illegal action. Our proposal also includes a reward system, which can exchange some TB among IVs, during successful communication. For the data management of this trust bit, we have used blockchain technology in the vehicular cloud, which can store all Trust bit details and can be accessed by IV anywhere and anytime. Our proposal provides secure and reliable information. We evaluate our proposal with the help of IV communication on intersection use case which analyzes a variety of trustworthiness between IVs during communication.
Andreas Unterweger, Fabian Knirsch, Christoph Leixnering, Dominik Engel
Real-world smart contracts which preserve the privacy of both, their users and their data, have barely been proposed theoretically, let alone been implemented practically. In this paper, we are the first to implement a privacy-preserving protocol from the energy domain as a smart contract in Ethereum. We elaborate on and present our implementation as well as our practical findings, including more or less subtle traps and pitfalls. Despite major optimizations to our implementation, we find that while it is currently possible, it is not feasible to implement a privacy-preserving protocol of modest complexity in the Ethereum blockchain due to the high cost of operation and the lack of privacy by design.
Elli Androulaki, Artem Barger, Vita Bortnikov, Christian Cachin · 21 authors
Fabric is a modular and extensible open-source system for deploying and operating permissioned blockchains and one of the Hyperledger projects hosted by the Linux Foundation (www.hyperledger.org). Fabric is the first truly extensible blockchain system for running distributed applications. It supports modular consensus protocols, which allows the system to be tailored to particular use cases and trust models. Fabric is also the first blockchain system that runs distributed applications written in standard, general-purpose programming languages, without systemic dependency on a native cryptocurrency. This stands in sharp contrast to existing blockchain platforms that require "smart-contracts" to be written in domain-specific languages or rely on a cryptocurrency. Fabric realizes the permissioned model using a portable notion of membership, which may be integrated with industry-standard identity management. To support such flexibility, Fabric introduces an entirely novel blockchain design and revamps the way blockchains cope with non-determinism, resource exhaustion, and performance attacks. This paper describes Fabric, its architecture, the rationale behind various design decisions, its most prominent implementation aspects, as well as its distributed application programming model. We further evaluate Fabric by implementing and benchmarking a Bitcoin-inspired digital currency. We show that Fabric achieves end-to-end throughput of more than 3500 transactions per second in certain popular deployment configurations, with sub-second latency, scaling well to over 100 peers.
This paper investigates the power of quantum statistical zero knowledge interactive proof systems in the relativized setting. We prove the existence of an oracle relative to which quantum statistical zero-knowledge does not contain UP intersect coUP, and we prove that quantum statistical zero knowledge does not contain UP relative to a random oracle with probability 1. Our proofs of these statements rely on a bound on output state discrimination for relativized quantum circuits based on the quantum adversary method of Ambainis, following a technique similar to one used by Ben-David and Kothari to prove limitations on a query complexity variant of quantum statistical zero-knowledge.
As we observe a trend towards the recentralisation of the Internet, this paper raises the question of guaranteeing an everlasting decentralisation. We introduce the properties of strong and soft uncentralisability in order to describe systems in which all authorities can be untrusted at any time without affecting the system. We link the soft uncentralisability to another property called perfect forkability. Using that knowledge, we introduce a new cryptographic primitive called uncentralisable ledger and study its properties. We use those properties to analyse what an uncentralisable ledger may offer to classic electronic voting systems and how it opens up the realm of possibilities for completely new voting mechanisms. We review a list of selected projects that implement voting systems using blockchain technol- ogy. We then conclude that the true revolutionary feature enabled by uncentralisable ledgers is a self-sovereign and distributed identity provider.
In multi-prover interactive proofs (MIPs), the verifier can provide non-local resources for the provers intrinsically. In most cases, this is undesirable. Existing proofs of soundness do not account for the verifier's non-local potential. We show that this may be a problem for many MIPs. We provide a solution by constructing a generalization of the MIP model, of which standard MIPs are a special case. This new model accounts for both the prover and the verifier's non-local correlations. A new property of multi-prover zero-knowledge naturally emerges as a result.