BLOCKCHAIN The foundation behind Bitcoin

Transcription

1 BLOCKCHAIN The foundation behind Bitcoin Sourav Sen Gupta Indian Statistical Institute, Kolkata

2 CRYPTOGRAPHY Backbone of Blockchain Technology

3 Component 1 : Cryptographic Hash Functions

4 HASH FUNCTIONS Map variable-length input to constant-length output. x h y

5 HASH FUNCTIONS Finding the pre-image of a given output is not easy.? h y

6 HASH FUNCTIONS Finding a colliding twin of a given input is not easy x1 x2 h y

7 HASH FUNCTIONS Finding any colliding pair of inputs is not easy x1 x2 h y It is of course possible, but not easy.

8 HASH FUNCTIONS Minor input-mismatch to major output-mismatch x1 y h x2 y

9 CONSTRUCTIONS m1 m2 mn IV f f f h Merkle-Damgard Construction Example : SHA 256 used in Bitcoin

10 CONSTRUCTIONS m1 m2 mn h1 r c f f f f Sponge Construction Example : SHA 3 used in Ethereum

11 APPLICATION x h y record(x) : c = h(x) verify(c,x) : h(x) == c Provably secure scheme for tamper-detection

12 DATA STRUCTURES data h addr(data) hash(data) Hash Pointer Tamper-evident data pointer = Hash Pointer

13 DATA STRUCTURES data data HP(block) timestamp Block h HP(block) timestamp Block Tamper-evident linked data structure = Block

14 DATA STRUCTURES data data data data data HP(block) HP(block) HP(block) HP(block) HP(block) timestamp timestamp timestamp timestamp timestamp Block Block Block Block Block Tamper-evident linked-list = Blockchain

15 DATA STRUCTURES data data data data data HP(block) HP(block) HP(block) HP(block) HP(block) timestamp timestamp timestamp timestamp timestamp Block Block Block Block Block data data data data data HP(block) HP(block) HP(block) HP(block) HP(block) timestamp timestamp timestamp timestamp timestamp Block Block Block Block Block Tamper-evident linked-list = Blockchain

16 DATA STRUCTURES Properties Blockchain Merkle Tree Merkle Trie Size of Commitment O(1) O(1) O(1) Append a Block/Node O(1) O(log n) O(k) Update a Block/Node O(n) O(log n) O(k) Proof of Membership O(n) O(log n) O(k) Structural Abstraction List of Objects Set of Objects Set of (key, value) Used for Construction Bitcoin Bitcoin Ethereum

17 Component 2 : Digital Signature Schemes

18 DIGITAL SIGNATURE? s = sign(sk,m) sk keygen(n) pk verify(pk,m,s) (sk, pk) = keygen(n) verify(pk,m,sign(sk,m)) = True

19 DIGITAL SIGNATURE? s = sign(sk,m) sk keygen(n) pk verify(pk,m,s) Given pk and access to sign(mi) as an oracle, an adversary should not be able to create a valid fresh message-signature pair (m,s)

20 CONSTRUCTION Q Fp Elliptic Curve Digital Signature Algorithm (ECDSA) ECDSA on curve E(Fp) : { (x,y) in Fp x Fp y 2 = x } with base prime p =

21 CONSTRUCTION Elliptic Curve group of size E(Fp) = q ~ p ~ Parameters Format Range Bit-size sk random Zq 256 pk sk x G E(Fp) 512 m hash(m) Zq 256 Signature (r, s) Zq x Zq 512 ECDSA on curve E(Fp) : { (x,y) in Fp x Fp y 2 = x } with base prime p =

22 APPLICATION pk sk sk? sk verify(pk,m,sign(sk,m)) Publish the public key pk as your Identity Use the secret key sk to prove your identity

23 BITCOIN Blockchain in Practice

24 ANONYMOUS E-CASH Zero-Knowledge Proof and Blind Signature

25 BLIND SIGNATURE David Chaum, 1984 First Concept of Untraceable e-payments and e-cash

26 CYPHERPUNKS?! Anonymity is not Enough! De-Centralize e-cash

27 CYPHERPUNKS DigiCash PGP HashCash B-Money BitGold RPOW David Chaum Phil Zimmermann Adam Back Wei Dai Nick Szabo Hal Finney

28 BITCOIN Satoshi Nakamoto 31 October 2008

29 BITCOIN Ledger of Transactions between Pseudonymous Identities Semi-Decentralised Publicly-Verifiable Tamper-Resistant Eventually-Consistent

30 NOT BITCOIN Economic Transaction that we are familiar with

31 NOT BITCOIN Centralised Account-based Ledger

32 NOT BITCOIN Decentralised Account-based Ledger

33 NOT BITCOIN YET Decentralised Transaction-based Ledger

34 TRANSACTION Signed by Network verifies the Signature

35 TRANSACTION pk pk Signed by sk Network verifies the Signature

36 TRANSACTION Input : Array of previous Transactions Output : Array of recipient Addresses pk1 R1 pk Sender(s) pk2 pk3 sk1 sk2 sk3 R2 R3 pk pk Recipient(s) Network verifies the Signature(s)

37 TRANSACTION Input : Array of previous Transactions Output : Array of recipient Addresses Input Transactions pk1 pk2 pk3 R1 pk sk1 pk R2 sk2 sk3 R3 pk Recipients Signatures Network verifies the Signature(s)

38 Metadata TRANSACTION Input(s) Output(s) Data obtained from blockchain.info

39 LEDGER Decentralised Transaction-based Ledger

40 BLOCK Data obtained from blockchain.info

41 BITCOIN Transaction Mining

42 MINING Transaction Computational Lottery (Puzzle) Find r such that hash(r m) < C Existing blocks at a given time Winner writes the next block

43 BITCOIN Transaction Mining

44 BITCOIN Framework Decentralised peer-to-peer collaborative network Goal : All peers should agree on a sequence of transactions

45 BITCOIN Publicly-Verifiable as the complete ledger and the hash function is public

46 BITCOIN Tamper-Evident / Tamper-Resistant as the ledger is connected through a chain of hash pointers X X X X X X X

47 BITCOIN Eventually-Consistent as the longest chain eventually sustains as the main chain

48 BITCOIN Semi-Decentralised as the mining is dominated by computational power

49 BITCOIN Semi-Decentralised Tamper-Resistant Publicly-Verifiable Eventually-Consistent

50 BEYOND BITCOIN Exploiting the power of Blockchain Ecosystem

51 MINING Proof-of-Work Computation-hard challenge Proof-of-Space Memory-hard challenge PermaCoin, SpaceMint Proof-of-Stake Depends on holdings Proof-of-Importance Depends on involvement OmiseGo, EOS

52 NETWORK De-Centralized Without any Authority Semi-Centralized With Trusted Authority Almost all active Currency RSCoin (Bank of England)

53 ANONYMITY Pseudonymity Not easily Traceable Pure Anonymity Provably not Traceable Mixing Services provide some guarantee of anonymity otherwise.

54 Abstraction of Bitcoin to the backbone protocol of blockchain

55 APPLICATION