Blockchain Papers

Jaswant Pakki, Yan Shoshitaishvili, Ruoyu Wang, Tiffany Bao · 5 authors

No abstract is available for this record.

Panagiotis Chatzigiannis, Foteini Baldimtsi, Konstantinos Chalkias

Enforcement of policy regulations and availability of auditing mechanisms are crucial building blocks for the adoption of distributed payment systems. In this work we review a number of existing proposals for distributed payment systems that offer some form of auditability for regulators. We identify two major distinct lines of work: payment systems that are not privacy-preserving such as Bitcoin, where regulation functionalities are typically tailored for organizations controlling many accounts, and privacy-preserving payment systems where regulation functionalities are typically targeted to user level. We provide a systematization methodology over several axes of characteristics and performance, while highlighting insights and research gaps that we have identified, such as lack of dispute-resolution solutions between the regulator and the entity under audit, and the incompatibility of ledger pruning or off-chain protocols with regulatory requirements. Based on our findings, we propose a number of exciting future research directions.

Fariba Ghaffari, E. Bertin, Noël Crespi, Shanay Behrad · 5 authors

The dramatic rise in internet-based service provisioning has highlighted the importance of deploying scalable access control methods, facilitating service authorization for eligible users. Existing centralized methods suffer from single-point-of-failure, low scalability, and high computational overhead. In addition, in these methods, users pay for the service provider as well as the network provider independently for a specific service, imposing extra cost for the user. New business models are needed to resolve such shortcomings. The realization of these models calls for sophisticated access control methods which consider the requirements of all parties who want to: 1) access a service; 2) provide that service; and 3) provide the network connection. Blockchain is an enabling technology that provides unprecedented opportunities to novel distributed access control methods for new business models. We propose an Attribute-based access control solution by leveraging Blockchain to share network providers' and service providers' resources. Our solution offers access flexibility based on the requirements of the parties while fulfilling reliability, accountability, and immutability. Besides, it decreases the overall service cost which is beneficial for each party. Our solution makes it possible for service providers to outsource their access control procedures without requiring a trusted third party. The experiments confirm that our solution can provide a fast, comprehensive, and scalable access control mechanism.

Sunoo Park, Michael A. Specter, Neha Narula, Ronald L. Rivest

Abstract Voters are understandably concerned about election security. News reports of possible election interference by foreign powers, of unauthorized voting, of voter disenfranchisement, and of technological failures call into question the integrity of elections worldwide. This article examines the suggestions that “voting over the Internet” or “voting on the blockchain” would increase election security, and finds such claims to be wanting and misleading. While current election systems are far from perfect, Internet- and blockchain-based voting would greatly increase the risk of undetectable, nation-scale election failures. Online voting may seem appealing: voting from a computer or smartphone may seem convenient and accessible. However, studies have been inconclusive, showing that online voting may have little to no effect on turnout in practice, and it may even increase disenfranchisement. More importantly, given the current state of computer security, any turnout increase derived from Internet- or blockchain-based voting would come at the cost of losing meaningful assurance that votes have been counted as they were cast, and not undetectably altered or discarded. This state of affairs will continue as long as standard tactics such as malware, zero day, and denial-of-service attacks continue to be effective. This article analyzes and systematizes prior research on the security risks of online and electronic voting, and shows that not only do these risks persist in blockchain-based voting systems, but blockchains may introduce ‘additional’ problems for voting systems. Finally, we suggest questions for critically assessing security risks of new voting system proposals.

Javier Herranz, Ramiro Pinilla, Manuel Sánchez-Raya

In an electronic voting procedure, mixing networks are used to ensure anonymity of the casted votes. Each node of the network re-encrypts the input list of ciphertexts and randomly permutes it in a process named shuffle, and must prove (in zero-knowledge) that the process was applied honestly. To maintain security of such a process in a post-quantum scenario, new proofs are based on different mathematical assumptions, such as lattice-based problems. Nonetheless, the best lattice-based protocols to ensure verifiable shuffling have linear communication complexity on N, the number of shuffled ciphertexts.

Somnath Panja, Bimal Roy

No abstract is available for this record.

Markulf Kohlweiss, Varun Madathil, Kartik Nayak, Alessandra Scafuro

In proof-of-stake (PoS) blockchains, stakeholders that extend the chain are selected according to the amount of stake they own. In S&P 2019 the "Ouroboros Crypsinous" system of Kerber et al. (and concurrently Ganesh et al. in EUROCRYPT 2019) presented a mechanism that hides the identity of the stakeholder when adding blocks, hence preserving anonymity of stakeholders both during payment and mining in the Ouroboros blockchain. They focus on anonymizing the messages of the blockchain protocol, but suggest that potential identity leaks from the network-layer can be removed as well by employing anonymous broadcast channels.In this work we show that this intuition is flawed. Even ideal anonymous broadcast channels do not suffice to protect the identity of the stakeholder who proposes a block.We make the following contributions. First, we show a formal network-attack against Ouroboros Crypsinous, where the adversary can leverage network delays to distinguish who is the stakeholder that added a block on the blockchain. Second, we abstract the above attack and show that whenever the adversary has control over the network delay – within the synchrony bound – loss of anonymity is inherent for any protocol that provides liveness guarantees. We do so, by first proving that it is impossible to devise a (deterministic) state-machine replication protocol that achieves basic liveness guarantees and better than (1−2f) anonymity at the same time (where f is the fraction of corrupted parties). We then connect this result to the PoS setting by presenting the tagging and reverse tagging attack that allows an adversary, across several executions of the PoS protocol, to learn the stake of a target node, by simply delaying messages for the target. We demonstrate that our assumption on the delaying power of the adversary is realistic by describing how our attack could be mounted over the Zcash blockchain network (even when Tor is used). We conclude by suggesting approaches that can mitigate such attacks.

Iván Gutiérrez-Agüero, Sergio Anguita, Xabier Larrucea, Aitor Gómez-Goiri · 5 authors

The concept of identity has become one common research topic in security and privacy where the real identity of users must be preserved, usually covered by pseudonym identifiers. With the rise of Blockchain-based systems, identities are becoming even more critical than before, mainly due to the immutability property. In fact, many publicly accessible Blockchain networks like Ethereum rely on pseudonymization as a method for identifying subject actions. Pseudonyms are often employed to maintain anonymity, but true anonymity requires unlinkability. Without this property, any attacker can examine the messages sent by a specific pseudonym and learn new information about the holder of this pseudonym. This use of Blockchain collides with regulations because of the right to be forgotten, and Blockchain-based solutions are ensuring that every data stored within the chain will not be modified. In this paper we define a method and a tool for dealing with digital identities within Blockchain environments that are compliant with regulations. The proposed method provides a way to grant digital pseudo identities unlinked to the real identity. This new method uses the benefits of key derivation systems to ensure a non-binding interaction between users and the information model associated with their identity. The proposed method is demonstated in the Ethereum context and illustrated with a case study.

Wei Dai

No abstract is available for this record.

Cheman Shaik

A cryptographic method of digitally securing cryptocurrency wallet seed phrase through Blind Key Encryption is discussed wherein two blind keys random in nature are generated and used to produce two ciphertexts. The mathematical algorithm used in blind key encryption is described in detail and also an explanation is provided as to how the encryption defeats hackers even after they could successfully compromise a ciphertext of the seed phrase along with its decryption key. Different scenarios of storing the ciphertexts are documented.

Lihua Song, Xinran Ju, Zongke Zhu, Mengchen Li

Abstract Information security has become the focus problem in the Internet of Things, and the traditional centralized access control model is faced with threats such as single point failure, internal attack, and central leak. In this paper, we proposed a model to improve the access control security of the Internet of Things, which is based on zero-knowledge proof and smart contract technology in the blockchain. Firstly, we deployed the attribute information of access control in the blockchain, which relieves the pressure and credibility problem brought by the third-party information concentration; Secondly, the encrypted access control token is used to gain the access permission of the resources, which makes the user's identity invisible and effectively avoids the attribute ownership exposure problem; Besides, the use of smart contracts solves the problem of low computing efficiency of Internet of Things devices and the waste of blockchain computing power resources; Finally, a prototype of Internet of Things access control system based on blockchain and zero-knowledge proof technology is implemented. The test analysis results show that the model achieves effective attribute privacy protection, compared with the Attribute-Based Access Control model of the same security level, the access efficiency increases linearly with the increase of access scale.

Alexander Mühle, Andreas Grüner, Christoph Meinel

In the public mind, Bitcoin has often been associated with censorship circumvention and evasion of surveillance measures, specifically in the context of monetary transactions. However, this perceived anonymity is a false sense of security as both on-chain transactions and the underlying message exchange in the peer-to-peer network are attack vectors for deanonymisation and monitoring, as shown in other research. Nonetheless, there has been an increase in Bitcoin usage not only for end-users but also in the context of cybercrime in the form of cryptojacking and ransomware. So there are a number of reasons why proxies might be used in the Bitcoin network, either as a privacy-preserving measure of end-users or as obfuscation in cybercrime.

Chen Fang, Zifan Li, Bozhong Li, Chunxue Deng · 8 authors

With the increasing application of the IoT, more and more scenarios need to establish efficient and stable dedicated communication networks. In the 5G era, communication network operators can lease customized optical network slices to users, to meet users' different needs in the application scenarios of the IoT. However, in the multi-user transaction process of optical network slicing, there will be untrusted mechanisms and important data security issues. This paper uses blockchain technology to ensure the optical network slicing lease transaction environment, so that users can complete slicing transactions more safely and build a high-quality dedicated communication network for IoT application scenarios.

Syada Tasmia Alvi, Mohammed Nasir Uddin, Linta Islam, Sajib Ahamed

For the development of society and the enhancement of citizen's civic knowledge, voting plays an incredibly important role in many forms of practice as a guiding factor for the true growth of democracy. The world's electoral mechanism has been marked by several structural problems, leading in an election being held by a dishonest candidate. Scientists were mentally, psychologically, socially and critically worried about the mismanagement of electoral processes documented at various stages of selecting a leader. Deal with the question about how to protect dishonest participants in elections from unethical practices such as bribery and spoofing are a great concern. The results of making a dishonest participant a winner are bad administration, uncertainty and diversification for the financial benefit of public funds. Approaches ought to be created to fix the issues of the electoral processes. Thus, this paper concentrated on a systematic analysis of multiple forms of voting with blockchain and without blockchain by numerous researchers as a forum to find vulnerabilities or weaknesses and propose a perfect voting mechanism to fulfill all the properties requires in voting system.

Takeshi Miyamae, K. Matsuura

In blockchain-based anonymous cryptocurrencies, due to their tamper-resistance and transparency characteristics, transaction data are initially required to be anonymous, with the help of various cryptographic techniques, e.g., commitment schemes and zero-knowledge proofs. Also, cryptocurrencies are different from existing anonymous messaging protocols regarding the software architecture and the underlying security model. Due to these differences, the sense of anonymity must be specifically defined for anonymous cryptocurrencies, and the anonymity in each anonymous cryptocurrency must be analyzed and evaluated based on the specific architecture model. In this paper, we first propose a specific architecture model with three software layers to anonymous cryptocurrencies. Next, we introduce definitions of fundamental privacy properties (Pfitzmann's anonymity, unlinkability, and pseudonymity) and comprehensively analyze each privacy property for each architecture layer of anonymous cryptocurrencies to establish a privacy evaluation policy for anonymous cryptocurrencies. Finally, we fairly compare the privacy of current leading anonymous cryptocurrencies (e.g., Zerocash, CryptoNote, and Mimblewimble) using the privacy evaluation policy.

Роман Алексеев

The purpose of the research is to use blockchain technology in the electoral process. The study was conducted on the example of blockchain technologies used in elections in the United States, Canada, Australia, Sierra Leone, Switzerland, Spain, Russia and other countries. The methodological basis of the research is based on the methods of comparative analysis and component analysis of definitions. Empirical methods of expert assessment and interviewing were used. The pros and cons of blockchain technologies and the possibility of using this innovative technology in elections of different levels are revealed. The advantages of inclusive blockchain technology include the mobility and accessibility of voting; minimizing the costs of organizing and conducting elections; de-bureaucratization by reducing the staff of election commissions; the possibility of excluding the impact on voters from participants in the electoral process; reducing the time for processing ballots and determining the results of voting; increasing the level of trust in electoral procedures on the part of citizens who usually do not participate in voting. Among the disadvantages of blockchain technologies, we can highlight: technical failures and hacker cyber-attacks; the possibility of hackers using data about voters, in case of hacking electronic databases; violation of the secrecy of voting.

Christian Pauletto

Recognition of foreign qualifications for authorising the exercise of a regulated profession gains importance in globalised economies and in international organisations such as the UNESCO. However, national procedures for such recognition have not yet experienced the transformative changes that occurred in other sectors of public administration. The study of “transborder digitisation” is still in its infancy. While governments consider the adoption of blockchain applications for the e-administration of trade-related procedures, for example customs procedures, it is timely to give some thoughts to recognition as well. After explaining the role of recognition in international relations this article explores the features of recognition procedures that are relevant for the choice of a technology. It then aims to identify recognition authorities’ needs in terms of administrative tools and to find out the options and potential benefits of blockchain technology in view of those needs. It aims to find whether there are reasons to select that particular technology rather than conventional methods. This is highlighted in a concrete description of what could be a possible configuration of a blockchain solution for recognition procedures. Since opportunities are always balanced by limitations, the article also inquires into ithe expected challenges in adopting a blockchain system between different countries’ recognition authorities. The article’s overall aim is to offer an assessment of blockchain technologies’ potential in that field and to highlight developments in technology that could ease their adoption. The article finds that the advantages brought by DLT technologies and the needed features of recognition processes coincide in several respects. However, some critical challenges and limitations for the application of blockchain in this field also exist. An adoption of that technology for that particular branch of public administration could occur provided that the technology continues to improve. Such improvements include interoperability, interface with other protocols and legacy databases, portability, and a higher degree of safety regarding privacy.

Syada Tasmia Alvi, Mohammed Nasir Uddin, Linta Islam, Sajib Ahamed

Democracy plays a significant part in voting. If the voting process is not clear, stable and tamper proof, the integrity and legitimacy of the entire system is at risk. In recent years, neither civilians nor elected leaders have appreciated traditional ballots. Elections are surrounded by vote falsification, bribery and other voting problems. Often an individual must stand in a long line of people while casting votes and the procedure is quite lengthy. There has to be an exceptional feature of modern technologies to upgrade the existing system. Block chain provides the various features that will alter the scenario. But to implement ethereum based blockchain is expensive as for each transaction there is a computation cost. So we have used the sidechain concept to provide a cost effective blockchain based voting mechanism as sidechain extends the capabilities of blockchain by performing some operation besides it using duplicate currency and returns the result to mainchain for its use.

Danil Annenkov, Mikkel Milo, Jakob Botsch Nielsen, Bas Spitters

We implement extraction of Coq programs to functional languages based on MetaCoq's certified erasure. As part of this, we implement an optimisation pass removing unused arguments. We prove the pass correct wrt. a conventional call-by-value operational semantics of functional languages. We apply this to two functional smart contract languages, Liquidity and Midlang, and to the functional language Elm. Our development is done in the context of the ConCert framework that enables smart contract verification. We contribute a verified boardroom voting smart contract featuring maximum voter privacy such that each vote is kept private except under collusion of all other parties. We also integrate property-based testing into ConCert using QuickChick and our development is the first to support testing properties of interacting smart contracts. We test several complex contracts such as a DAO-like contract, an escrow contract, an implementation of a Decentralized Finance (DeFi) contract which includes a custom token standard (Tezos FA2), and more. In total, this gives us a way to write dependent programs in Coq, test them semi-automatically, verify, and then extract to functional smart contract languages, while retaining a small trusted computing base of only MetaCoq and the pretty-printers into these languages.

Syada Tasmia Alvi, Mohammed Nasir Uddin, Linta Islam, Sajib Ahamed

Voting seem to be a very significant sign of political action, but it is very pathetic that a substantial majority of the world `s population do not have confidence in their voting system. There are different drawbacks and problems for a very long time in the conventional voting system. Several countries prefer to use a centralized voting process that may cause certain inconsistencies. The security and transparency issue is a challenge to the traditional structure from worldwide elections. One of the solutions to all of these challenges is Blockchain technology. New ideas are being provided to create new forms of digital services. Since it strains a decentralized structure and multiple people own the whole database system. Blockchain will reduce the deception of database abuse by implementing blockchain in a voting framework. In order to ensure a safe voting system, we have proposed a blockchain-based distributed infrastructure that offers fairness, transparency and flexibility over the current system. To assess our protocol, we have implemented it on Ethereum and done performance analysis based on security properties and gas cost.

Ziyuan Li, Jialu Hao, Jian Liu, Huimei Wang · 5 authors

Access control in Internet of Things (IoT) systems has long been facing with single-point-of-failure, collusion and other security issues. Deploying most of the access control procedures on blockchain makes it more trustworthy. However, the miscellaneous transaction data on the public blockchain incurs an extra burden on computing and communication overhead, which hinders its application for IoT devices. Additionally, the demands of rapid response in industrial IoT scenarios (e.g., edge computing scenarios) is hardly realized under a public blockchain. In this brief, we propose an IoT-applicable access control model under an original double-layer blockchain architecture, in which the mortgage/registration and control processes can be disaggregated. Depending on this architecture, the communication overhead for IoT devices is reduced and a rapid response is achieved. With linear secret sharing scheme, attribute-based access policies for resource objects are established to ensure fine-grained access control. We further implement a smart contract prototype on Ethereum and Fisco Bcos. Extensive experiments and numerical analysis demonstrate the feasibility of our proposed model.

Sabater, César, Bellet, Aurélien, Ramon, Jan

Learning from data owned by several parties, as in federated learning, raises challenges regarding the privacy guarantees provided to participants and the correctness of the computation in the presence of malicious parties. We tackle these challenges in the context of distributed averaging, an essential building block of distributed and federated learning. Our first contribution is a novel distributed differentially private protocol which naturally scales with the number of parties. The key idea underlying our protocol is to exchange correlated Gaussian noise along the edges of a network graph, complemented by independent noise added by each party. We analyze the differential privacy guarantees of our protocol and the impact of the graph topology, showing that we can match the accuracy of the trusted curator model even when each party communicates with only a logarithmic number of other parties chosen at random. This is in contrast with protocols in the local model of privacy (with lower accuracy) or based on secure aggregation (where all pairs of users need to exchange messages). Our second contribution is to enable users to prove the correctness of their computations without compromising the efficiency and privacy guarantees of the protocol. Our construction relies on standard cryptographic primitives like commitment schemes and zero knowledge proofs.

Muhammad Shayan, Clement Fung, Chris J. M. Yoon, Ivan Beschastnikh

Federated Learning is the current state-of-the-art in supporting secure multi-party machine learning (ML): data is maintained on the owner's device and the updates to the model are aggregated through a secure protocol. However, this process assumes a trusted centralized infrastructure for coordination, and clients must trust that the central service does not use the byproducts of client data. In addition to this, a group of malicious clients could also harm the performance of the model by carrying out a poisoning attack. As a response, we propose Biscotti: a fully decentralized peer to peer (P2P) approach to multi-party ML, which uses blockchain and cryptographic primitives to coordinate a privacy-preserving ML process between peering clients. Our evaluation demonstrates that Biscotti is scalable, fault tolerant, and defends against known attacks. For example, Biscotti is able to both protect the privacy of an individual client's update and maintain the performance of the global model at scale when 30 percent adversaries are present in the system.

Ning Lu, Yuan Chang, Wenbo Shi, Kim‐Kwang Raymond Choo

Coin mixing can be used to preserve identity privacy of Bitcoin owners, by engaging a set of middlepersons (i.e.,$Mix$) to temporarily hold the transacting Bitcoins and remove the linkage between the transacting parties. However, existing schemes are generally not scalable due to limitations associated with the anonymity set and self-credibility. In this article, we propose an efficient coin mixing scheme (hereafter referred to as CoinLayering). To achieve strong anonymity, CoinLayering randomly selects two sets of middlepersons to respectively execute Bitcoin holding and Bitcoin trading. The seller can also select lower-loaded sets of middlepersons in the shortest time possible. We also design two coin mixing protocols, CoinLayering-PA and CoinLayering-PB, to mitigate the risk due to misbehaving middlepersons and$Supervisor$. We then mathematically prove that CoinLayering achieves both strong anonymity and self-credibility, and evaluate its performance to demonstrate its scalability.