Message digest algorithms are one of the underlying building blocks of\nblockchain platforms such as Ethereum. This paper analyses situations in which\nthe message digest collision resistance property can be exploited by attackers.\nTwo mitigations for possible attacks are described: longer message digest sizes\nmake attacks more difficult; and, including timeliness properties limits the\namount of time an attacker has to determine a hash collision.\n
We analyze the economic incentives generated by the proof-of-stake mechanism discussed in the Ethereum Casper upgrade proposal. Compared with proof-of-work, proof-of-stake has a different cost structure for attackers. In Budish (2018), three equations characterize the limits of Bitcoin, which has a proof-of-work mechanism. We investigate their counterparts and evaluate the risk of double-spending attack and sabotage attack. We argue that PoS is safer than PoW agaisnt double-spending attack because of the tractability of attackers, which implies a large "stock" cost for the attacker. Compared to a PoW system whose mining equipments are repurposable, PoS is also safer against a sabotage attack.
Blockchains and distributed ledgers, the technologies underlying Bitcoin and other decentralized transaction systems, have been garnering increasing interest in the theoretical distributed comput- ing community. The current column, by Antonio Fernández Anta, Chryssis Georgiou, Kishori Konwar, and Nicolas Nicolaou, starts with an informative overview of the world of distributed ledgers and motivates the need for rigorous approaches. The authors present an approach for formally specifying a distributed ledger in the context of several popular consistency conditions. The authors then give algorithms that implement the di erent variants in message-passing systems subject to crash failures. The article closes with a discussion of intriguing open questions. Many thanks to Antonio, Chryssis, Kishori and Nicolas for their timely contribution!
This paper presents an innovative solution to manage security and trustiness in Osmotic Computing. Osmotic Computing dynamically manages Cloud, Edge and IoT resources across federated environments set up by different and cooperating stakeholders. In this context, the Software Defined Membrane (SDMem) is the main component responsible to orchestrate the osmotic transfer of microelements (MELs) across different environments straightening the security needs of such a complex ecosystem. The basic idea presented in this paper is to leverage Private Blockchain technologies in SDMem implementation over federated systems. Data access activities will be logged in a private distributed Blockchain-based ledger. This will allow to have a certified, non-repudiable record of all the data accessed performed by distributed computing, thus assuring the overall ownership and integrity of data and processes running in MELs. The resulting SDMem solution allow us to isolate data and workflows in distributed environments where heterogeneous resources and devices are exploited.
The provenance (tracing) system of agricultural products is important for ensuring food safety. However, the stakeholders (growers, farmers, sellers etc.) are numerous and physically dispersed, making it difficult to manage data and information with a centralized approach. As a result, the production procedure remains non-transparent and trust is hard to build. In this paper, we propose an agricultural provenance system based on techniques of blockchain, which is featured by decentralization, collective maintenance, consensus trust and reliable data, in order to solve the trust crisis in product supply chain. Recorded information includes the management operations (fertilizing, irrigation, etc.) with certain data structure. Applying blockchain techniques to the provenance of agricultural product not only widens the application domain of blockchain, but also supports building a reliable community among different stakeholders around agriculture production.
Distributed ledger technologies, such as blockchain systems, have in recent years emerged as promising platforms for machine-to-machine commerce and other forms of multi-stakeholder applications. However, despite the potential demonstrated by projects such as Bitcoin, Ethereum, and Hyperledger Fabric, the disk space typically required to host a copy of a ledger may be prohibitively large for many categories of devices. In this paper, we introduce an approach for reducing ledger size in blockchain systems, based on arbitrary pruning predicate functions, allowing each network participant to independently select and remove any already applied transactions. We also show that if only pruning certain ledger transactions, the ability to derive an unmodified state data structure from the remaining transactions is maintained. The approach is validated through a supply chain use case utilizing a modified version of Hyperledger Fabric, in which ledger size is reduced by about 84.49% via selective transaction pruning.
We describe a general attack on proof-of-stake (PoS) blockchains without checkpointing. Our attack leverages transaction fees, the ability to treat transactions "out of context," and the standard longest chain rule to completely dominate a blockchain. The attack grows in power with the number of honest transactions and the stake held by the adversary, and can be launched by an adversary controlling any constant fraction of the stake. With the present statistical profile of blockchain protocols, the attack can be launched given a few years of prior blockchain operation; hence it is within the realm of feasibility for PoS protocols. Most importantly, it demonstrates how closely transaction fees and rewards are coupled with the security properties of PoS protocols. More broadly, our attack must be reflected and countered in any future PoS design that avoids checkpointing, as well as any effort to remove checkpointing from existing protocols. We describe several mechanisms for protecting against the attack that include context-sensitivity of transactions and chain density statistics.
The rise in popularity of permissioned blockchain platforms in recent time is significant. Hyperledger Fabric is one such permissioned blockchain platform and one of the Hyperledger projects hosted by the Linux Foundation. The Fabric comprises various components such as smart-contracts, endorsers, committers, validators, and orderers. As the performance of blockchain platform is a major concern for enterprise applications, in this work, we perform a comprehensive empirical study to characterize the performance of Hyperledger Fabric and identify potential performance bottlenecks to gain a better understanding of the system. We follow a two-phased approach. In the first phase, our goal is to understand the impact of various configuration parameters such as block size, endorsement policy, channels, resource allocation, state database choice on the transaction throughput & latency to provide various guidelines on configuring these parameters. In addition, we also aim to identify performance bottlenecks and hotspots. We observed that (1) endorsement policy verification, (2) sequential policy validation of transactions in a block, and (3) state validation and commit (with CouchDB) were the three major bottlenecks. In the second phase, we focus on optimizing Hyperledger Fabric v1.0 based on our observations. We introduced and studied various simple optimizations such as aggressive caching for endorsement policy verification in the cryptography component (3x improvement in the performance) and parallelizing endorsement policy verification (7x improvement). Further, we enhanced and measured the effect of an existing bulk read/write optimization for CouchDB during state validation & commit phase (2.5x improvement). By combining all three optimizations1, we improved the overall throughput by 16x (i.e., from 140 tps to 2250 tps).
Xin Sun, Quanlong Wang, Piotr Kulicki, Mirek Sopek
This paper proposes a simple voting protocol based on Quantum Blockchain. Despite its simplicity, our protocol satisfies the most important properties of secure voting protocols: is anonymous, binding, non-reusable, verifiable, eligible, fair and self-tallying. The protocol could also be implemented using presently available technology.
Proof of Work systems are used in cryptocurrencies to obtain consensus in distributed peer-to-peer systems that share no trust. Miners of cryptocurrency compete by engaging in the Proof of Work to solve a cryptographic challenge. The first to successfully provide a solution to the challenge wins by minting new currency. The process of mining also simultaneously prevents double-spending through the creation of an append-only distributed database known as the blockchain. The most widely adopted Proof of Work is the Hashcash scheme and the most widely deployed miners are ASIC-based. Despite the popularity of Hashcash, two issues are commonly identified its use. Firstly, the high energy consumption of the scheme is perceived as wasteful because the solutions found provide no useful output, and secondly, the computational complexity class of the scheme is not formally known. Based on these deficiencies, we propose a novel Proof of Work system which achieves the following goals:
Paul Ezhilchelvan, Amjad Aldweesh, Aad van Moorsel
Summary The two‐phase commit (2PC) protocol has long been known to have a provably inevitable vulnerability to blocking or non‐progress amidst server crashes, even when the distributed database system guarantees the most demanding timing‐related or “synchrony” requirements. Our aim here is to eliminate this vulnerability by using a blockchain for coordinating 2PC execution. We present the impossibilities, the possibilities, the cost, and the trade‐offs in this blockchain‐based approach to blocking‐free management of distributed transactions. We prove that a non‐blocking and blockchain‐coordinated 2PC protocol can exist only if both the blockchain and distributed database systems meet synchrony requirements; otherwise, although blocking remains eliminated, transactions can unnecessarily abort. We present a blockchain‐coordinated 2PC protocol and provide rigorous arguments for its correctness under the synchrony requirements. We then implement this protocol on the Ethereum Testnet and demonstrate, through our experiments, that the monetary cost of executing smart contracts is quite small, that the protocol performance slows down when using a public blockchain like Ethereum, and that even major violations of synchrony requirements lead only to relatively small increases in unnecessary aborts. We thus identify a trade‐off between improving protocol performance and admitting a risk that transactions could occasionally abort unnecessarily.
A specific number of transaction confirmation blocks determines average time of receiving and accepting payments at cryptocurrencies, and the shortest confirmation time for the same level of blockchain security provides the best user properties. Existing papers on transaction confirmation blocks for Bitcoin use implicit assumption of prompt spreading of Bitcoin blocks over the network (that is not always the case for the real world conditions). The newer publications with rigorous analysis and proofs of Bitcoin blockchain properties that take into account network delays provide asymptotic estimates, with no specific numbers for transaction confirmation blocks.
This position paper describes how blockchains facilitate the implementation of distributed self-adaptive systems. We demonstrate how the master/slave decentralised control pattern for self-adaptive systems, integrated with a permissioned blockchain, can protect nodes of a network against attacks by continuously adapting the membership of an access control list. Whenever malicious behaviour is detected, consensus on an updated access control list is reached, and that node is removed from the network. Using a smart home, as an example, we demonstrate that a permissioned blockchain is able to maintain a consistent view of a network of Internet of Things (IoT) devices in the presence of malicious nodes.
Yandamuri, Sravya, Abraham, Ittai, Nayak, Kartik, Reiter, Michael K.
A smart contract on a blockchain cannot keep a secret because its data is replicated on all nodes in a network. To remedy this problem, it has been suggested to combine blockchains with trusted execution environments (TEEs), such as Intel SGX, for executing applications that demand privacy. Untrusted blockchain nodes cannot get access to the data and computations inside the TEE. This paper first explores some pitfalls that arise from the combination of TEEs with blockchains. Since TEEs are, in principle, stateless they are susceptible to rollback attacks, which should be prevented to maintain privacy for the application. However, in blockchains with non-final consensus protocols, such as the proof-of-work in Ethereum and others, the contract execution must handle rollbacks by design. This implies that TEEs for securing blockchain execution cannot be directly used for such blockchains; this approach works only when the consensus decisions are final. Second, this work introduces an architecture and a prototype for smart-contract execution within Intel SGX technology for Hyperledger Fabric, a prominent platform for enterprise blockchain applications. Our system resolves difficulties posed by the execute-order-validate architecture of Fabric and prevents rollback attacks on TEE-based execution as far as possible. For increasing security, our design encapsulates each application on the blockchain within its own enclave that shields it from the host system. An evaluation shows that the overhead moving execution into SGX is within 10%-20% for a sealed-bid auction application.
Yackolley Amoussou-Guenou, Antonella Del Pozzo, Maria Potop-Butucaru, Sara Tucci-Piergiovanni
Tendermint-core blockchains (e.g. Cosmos) are considered today one of the most viable alternatives for the highly energy consuming proof-of-work blockchains such as Bitcoin and Ethereum. Their particularity is that they aim at offering strong consistency (no forks) in an open system combining two ingredients (i) a set of validators that generate blocks via a variant of Practical Byzantine Fault Tolerant (PBFT) consensus protocol and (ii) a selection strategy that dynamically selects nodes to be validators for the next block via a proof-of-stake mechanism. However,the exact assumptions on the system model under which Tendermint underlying algorithms are correct and the exact properties Tendermint verifies have never been formally analyzed. The contribution of this paper is two-fold. First, while formalizing Tendermint algorithms we precisely characterize the system model and the exact problem solved by Tendermint. We prove that in eventual synchronous systems a modified version of Tendermint solves (i) under additional assumptions, a variant of one-shot consensus for the validation of one single block and (ii) a variant of the repeated consensus problem for multiple blocks. These results hold even if the set of validators is hit by Byzantine failures, provided that for each one-shot consensus instance less than one third of the validators is Byzantine. Our second contribution relates to the fairness of the rewarding mechanism. It is common knowledge that in permisionless blockchain systems the main threat is the tragedy of commons that may yield the system to collapse if the rewarding mechanism is not adequate. Ad minimum the rewarding mechanism must be fair, i.e.distributing the rewards in proportion to the merit of participants. We prove, for the first time in blockchain systems, that in repeated-consensus based blockchains there exists an (eventual) fair rewarding mechanism if and only if the system is (eventual) synchronous. We also show that the original Tendermint rewarding is not fair, however, a modification of the original protocol makes it eventually fair.
Blockchain-based consensus protocols present the opportunity to develop new protocols, due to their novel requirements of open participation and explicit incentivization of participants. To address the first requirement, it is necessary to consider the leader election inherent in consensus protocols, which can be difficult to scale to a large and untrusted set of participants. To address the second, it is important to consider ways to provide incentivization without relying on the resource-intensive proofs-of-work used in Bitcoin. In this paper, we propose a secure leader election protocol, Caucus; we next fit this protocol into a broader blockchain-based consensus protocol, Fantomette, that provides game-theoretic guarantees in addition to traditional blockchain security properties. Fantomette is the first proof-of-stake protocol to give formal game-theoretic proofs of security in the presence of non-rational players.
In this paper we discuss a design philosophy for interoperable blockchain systems, using the design philosophy of the Internet architecture as the basis to identify key design principles. Several interoperability challenges are discussed in the context of cross-domain transactions. We illustrate how these principles are informing the interoperability architecture of the MIT Tradecoin system.
Blockchain-based cryptocurrencies secure a decentralized consensus protocol by incentives. The protocol participants, called miners, generate (mine) a series of blocks, each containing monetary transactions created by system users. As incentive for participation, miners receive newly minted currency and transaction fees paid by transaction creators. Blockchain bandwidth limits lead users to pay increasing fees in order to prioritize their transactions. However, most prior work focused on models where fees are negligible. In a notable exception, Carlsten et al. postulated in CCS'16 that if incentives come only from fees then a mining gap would form~--- miners would avoid mining when the available fees are insufficient. In this work, we analyze cryptocurrency security in realistic settings, taking into account all elements of expenses and rewards. To study when gaps form, we analyze the system as a game we call \emph{the gap game}. We analyze the game with a combination of symbolic and numeric analysis tools in a wide range of scenarios. Our analysis confirms Carlsten et al.'s postulate; indeed, we show that gaps form well before fees are the only incentive, and analyze the implications on security. Perhaps surprisingly, we show that different miners choose different gap sizes to optimize their utility, even when their operating costs are identical. Alarmingly, we see that the system incentivizes large miner coalitions, reducing system decentralization. We describe the required conditions to avoid the incentive misalignment, providing guidelines for future cryptocurrency design.
As Byzantine Agreement (BA) protocols find application in large-scale decentralized cryptocurrencies, an increasingly important problem is to design BA protocols with improved communication complexity. A few existing works have shown how to achieve subquadratic BA under an {\it adaptive} adversary. Intriguingly, they all make a common relaxation about the adaptivity of the attacker, that is, if an honest node sends a message and then gets corrupted in some round, the adversary {\it cannot erase the message that was already sent} --- henceforth we say that such an adversary cannot perform "after-the-fact removal". By contrast, many (super-)quadratic BA protocols in the literature can tolerate after-the-fact removal. In this paper, we first prove that disallowing after-the-fact removal is necessary for achieving subquadratic-communication BA. Next, we show new subquadratic binary BA constructions (of course, assuming no after-the-fact removal) that achieves near-optimal resilience and expected constant rounds under standard cryptographic assumptions and a public-key infrastructure (PKI) in both synchronous and partially synchronous settings. In comparison, all known subquadratic protocols make additional strong assumptions such as random oracles or the ability of honest nodes to erase secrets from memory, and even with these strong assumptions, no prior work can achieve the above properties. Lastly, we show that some setup assumption is necessary for achieving subquadratic multicast-based BA.
Blockchain is a novel technology that is rising a lot of interest in the industrial and re- search sectors because its properties of decentralisation, immutability and data integrity. Initially, the underlying consensus mechanism has been designed for permissionless block- chain on trustless network model through the proof-of-work, i.e. a mathematical challenge which requires high computational power. This solution suffers of poor performances, hence alternative consensus algorithms as the proof-of-stake have been proposed. Conversely, for permissioned blockchain, where participants are known and authenti- cated, variants of distributed consensus algorithms have been employed. However, most of them comes out without formal expression of security analysis and trust assumptions because the absence of an established knowledge. Therefore the lack of adequate analysis on these algorithms hinders any cautious evaluation of their effectiveness in a real-world setting where systems are deployed over trustless networks, i.e. Internet ...
Eric Zhang, C Hendrik, Yang Liu, Archit Sharma · 5 authors
In this paper we present the initial design of Minerva consensus protocol for Truechain and other technical details. Currently, it is widely believed in the blockchain community that a public chain cannot simultaneously achieve high performance, decentralization and security. This is true in the case of a Nakamoto chain (low performance) or a delegated proof of stake chain (partially centralized), which are the most popular block chain solutions at time of writing. Our consensus design enjoys the same consistency, liveness, transaction finality and security guarantee, a de-facto with the Hybrid Consensus. We go on to propose the idea of a new virtual machine on top of Ethereum which adds permissioned-chain based transaction processing capabilities in a permissionless setting. We also use the idea of data sharding and speculative transactions, and evaluation of smart contracts in a sharding friendly virtual machine. Finally, we will briefly discuss our fundamentally ASIC resistant mining algorithm, Truehash.
Hao Xu, Long Yu, Liu Zhiqiang, Zhen Liu · 5 authors
This paper describes a novel Byzantine fault tolerant protocol that allows replicas to join and exit dynamically. With the astonishing success of cryptocurrencies, people attach great importance in “blockchain” and robust Byzantine fault tolerant (BFT) protocols for consensus. Among the conventional wisdom, the Practical Byzantine Fault Tolerance (PBFT), proposed by Miguel and Liskov in 1999, occupies an important position. Although PBFT has many advantages, it has fatal disadvantages. Firstly, it works in a completely enclosed environment, where users who want to add or take out any node must stop the whole system. Secondly, although PBFT guarantees liveness and safety if at most [n-1/ 3] c out of a total n replicas are faulty, it takes no measure to deal with these ineffective or malicious replicas, which is harmful to the system and will cause system crash finally. These drawbacks are unbearable in practice. In order to solve them, we present an alternative, Dynamic PBFT.
Blockchain technology has the potential to decentralise many traditionally centralised systems. However, scalability remains a key challenge. A horizontally scalable solution, where performance increases by adding more nodes, would move blockchain systems one step closer to ubiquitous use. We design a novel blockchain system called CHECO. Each node in our system maintains a personal hash chain, which only stores transactions that the node is involved in. A consensus is reached on special blocks called checkpoint blocks rather than on all transactions. Checkpoint blocks are effectively a hash pointer to the personal hash chains; thus a single checkpoint block may represent an arbitrarily large set of transactions. We introduce a validation protocol so that any node can check the validity of any transaction. Since transaction and validation protocols are point-to-point, we achieve horizontal scalability. We analytically evaluate our system and show a number of highly desirable correctness properties such as consensus on the validity of transactions. Further, we give a free and open-source implementation of CHECO and evaluate it experimentally. Our results show a strong indication of horizontal scalability.
Nicholas Stifter, Aljosha Judmayer, Philipp Schindler, Alexei Zamyatin · 5 authors
The term Nakamoto consensus is generally used to refer to Bitcoin’s novel consensus mechanism, by which agreement on its underlying transaction ledger is reached. It is argued that this agreement protocol represents the core innovation behind Bitcoin, because it promises to facilitate the decentralization of trusted third parties. Specifically, Nakamoto consensus seeks to enable mutually distrusting entities with weak pseudonymous identities to reach eventual agreement while the set of participants may change over time. When the Bitcoin white paper was published in late 2008, it lacked a formal analysis of the protocol and the guarantees it claimed to provide. It would take the scientific community several years before first steps towards such a formalization of the Bitcoin protocol and Nakamoto consensus were presented. However, since then the number of works addressing this topic has grown substantially, providing many new and valuable insights. Herein, we present a coherent picture of advancements towards the formalization of Nakamoto consensus, as well as a contextualization in respect to previous research on the agreement problem and fault tolerant distributed computing. Thereby, we outline how Bitcoin’s consensus mechanism sets itself apart from previous approaches and where it can provide new impulses and directions to the scientific community. Understanding the core properties and characteristics of Nakamoto consensus is of key importance, not only for assessing the security and reliability of various blockchain systems that are based on the fundamentals of this scheme, but also for designing future systems that aim to fulfill comparable goals.