Blockchain Security improvement or - RSA Conference · 2019-07-26 · Blockchain promises to change...

Blockchain Security improvement or security nightmare?

Dave Huseby, Security Maven, Hyperledger, The Linux Foundation

Marta Piekarska, Director of Ecosystem, Hyperledge r, The Linux Foundation

Marta PiekarskaDirectory of Ecosystem, Hyperledger, The Linux Foundation

PhD in User Informed Design of Privacy Tools

10 years of experience in technology companies, including Apple, Yahoo & Deutsche Telekom

4 years in Blockchain: Blockstream & Hyperledger

Dave HusebySecurity Maven, Hyperledger, The Linux Foundation

Security Maven

Open source developer for 25 years

Focused on software security and engineering best practices for the last decade

The first long-distance trade occurred between Mesopotamia and indusvalley in pakistan ~3000 b.C

We have been exchanging goods for years.

How Do You Agree on Assets Balance?

How to track the value of exchanged goods?

Traditional Ledgers

In the digital world there are many copies that may contain different versions. The challenge: which do you trust as a single source of truth?

Digital World

Internet Connected Reality

Now we can keep our ledgers in sync—provided we can agree

Potential of Peer to Peer Network

The roots of Bitcoin are located in the so called “Cypherpunks” movement a group of technical-skilled activists, who campaigned for protection of privacy and anonymity in the Cyberspace from the beginning of 1990s onwards.

Members of the Cypherpunks were activists like Hal Finney, Nick Szabo, David Chaum, Wei Dai, Phil Zimmermann, Julian Assange and Satoshi Nakamoto, who later developed the Bitcoin.

Blockchain is really old

Myth Debunked: Blockchain ≠ Cryptocurrency

Cryptocurrency is an application that sits on top of blockchain.

Not the other way around.

An append-only systemof record or log of transactions that is multiplied in a number of places

but kept in synch

What is a DLT?

• Everyone shares the ledger• No one participant owns it, but all agree• Leverages cryptography and consensus mechanism

technology• No single entity maintains it, the whole network

validates, maintains, and keeps a copy of the database

Properties of Distributed ledgers

Block Hash

Prev Hash

Merkel Root

Block Hash

Prev Hash

Merkel Root

Block Hash

Prev Hash

Merkel Root

Block Hash

Prev Hash

Merkel Root

Block Hash

Prev Hash

Merkel Root

It’s ”just” a Chain of Blocks

Network nodes both generate their own data and verify data

generated by others

Contain historic record of verified transactions and

easily auditable

Distributed Consensus eliminates costly and inefficient

reconciliation processes

No central repository –each node stores identical copies

of the ledger

Resilient due to network power and cryptographic

integrity

Large economicdisincentive for malicious actors

Facets of distributed, shared ledgers

The code or any complex program stored and executed on a blockchain.

There is more! What is a Smart Contract?

• Facilitate, verify, or enforce the negotiation or performance of a contract autonomously

• “If, then” statements or when “X happens, then automatically record or execute Y”

• Reinvent how business processes take place• Automate manual or bespoke processes

What is a Smart Contract?

All over the global market there are ledgers that organizations and

individuals alike must trust.

The Need for Trust The 2018 Edelman Trust Barometer, an annual survey of 33k people in 28 countries, reveals that the trust in key institutions continues to decline. For blockchain,

2018 needs to be the year of scale done well.

By 2025, 10% of global GDP will be assets tracked and traded using blockchain-based distributed ledgers

Report by WEF 2017

Everyone wants their own DLT

ConsensusPoW, PoS, POET, RaFT,

BFT, PBFT

Crypto/SecurityPKI, HASH, SHA-256,

zk-SNARK, HE, ECC, EXDSA, SGX

Ledger ConceptsMining, Blocks,

Forks, Parents, Uncles, Merkle Trees

Platform ConceptsNodes, Oracles,

Notaries, Wallet, Smart Contracts

Google These Words

No matter what technologySecurity should always be in the

center of your attention

• Pushing security to the edges makes wallets and the private keys they store into high value targets.

Moving from Old to New

• Graveyard contains analysis of 51 publicly available attacks

Have you heard about Bitcoin Graveyard?

API’s with minimal foot-guns.

“ Conversational” wallet interfaces.

Curated crypto library

Documentation, training, and support.

Misuse Resistant Design is Key

Hyperledger Crypto Libraryhttps://github.com/hyperledger-labs/crypto-lib

Curated by the community.Minimizes foot-guns.

Supports regulated configurations.Can also use experimental algorithms.

Lots of Moving pieces…

Clients

Consensus Network

Distributed Ledger Organization

Clients

Consensus Network

Front End Middleware Back End

Distributed Ledger Organization

Lots of moving pieces...but no more complicated than the modern web.

What do we know?Basic security matters.

Users may not be ready for this.

The same techniques apply as in the old world.

Don’t panic.

Blockchain promises to change the way business is conducted and transactions are executed across industries. Precisely how, and the pace at which,

each of these industries adopts blockchain will surely vary.

There will never be one global chain-of-all chains that all industries convert to.

Permissionless Public Permissionless Private Permissioned Public Permissioned Private

Public Polls Land tit les, University degrees

Medical recordsBitcoin, Ethereum

Spectrum of BlockchainsPermissioned vs. Permissionless: Who can write to a Blockchain (i.e., accessibility)Public vs. Private: Who can read from a Blockchain (i.e., visibility)

Logistics, Insurance,Governments

Healthcare , Supply Chain

Fintech

Blockchain Industries Curve

Diffusion of Innovations Curve, by Everett Rogers

Not all problems can be solved with Blockchain

This technology is young. It is still early days.

When Frenemies try to be FriendsEnterprises are not designed to collaborate

How do you protect IP?

Can Open Source help?

Why join Blockchain consortia?

Which technology to choose?

The importance of being EarnestResponsible disclosure in decentralized and anonymous environment?

It is still a Network! DDoS is a Dirty Drag.

Smart Contracts are only as smart as their authors.

We already know most of it, just need to be more cautious

Exemplary Deployment: Claims Transparency

Exemplary Deployment: Secure Supply Chain

Exemplary Deployment: Posture Validation

What’s Left to be done?

Report a Security Bug

security@hyperledger.org

We Have a Bug Bounty—

Use It!hackerone.com/hyperledger

Join a Working Group

wiki.hyperledger.org

Watch the Webinar Replay:

Get Involved!hyperledger.org/webinars/

get-involved

You too can help--the easy stuff.

Tineolahttps://github.com/tineola/tineola

A red-team tool for testing Hyperledger Fabric.

You too can help--the hard stuff.

Questions?

Marta PiekarskaDirector of Ecosystem, Hyperledgermarta@linuxfoundation.orgDave HusebySecurity Maven, Hyperledgerdhuseby@linuxfoundation.org

Massive online open-souce course

“ Blockchain for Business”

Publicationshyperledger.org/resources

Comparison of Hyperledger Frameworks

Collection of inte restinguse cases for Blockchain

technologies

On Bitcoinbitcoin.org/en/faq

Just subscribe MIT chainletter

Blockchain Security improvement or - RSA Conference · 2019-07-26 · Blockchain promises to change...

Documents

Transcript of Blockchain Security improvement or - RSA Conference · 2019-07-26 · Blockchain promises to change...

Promises, Promises [Score]

PROMISES KEP , T PROMISES BROKEN - Juvenile Law Centerjlc.org › sites › default › files › publication_pdfs › pkpb.pdf · 2019-12-18 · Promises Kept, Promises Broken –

Incubus Promises Promises Sheetmusic

Abyss of Freedom, Promises Promises _ Alan Keenan

Blockchain Technology Brochure - AIMS Institutes · such as banking and insurance, medicine, healthcare, education, agriculture, defense, music, energy, etc. It promises global business

Money, Cryptocurrency & Blockchain Technology · Trust is the key element of blockchain technology. When transactions are executed and settled on a distributed ledger, counterparties

Blockchain for Large Scale Scientific Computing€¦ · - Typically the same code gets executed by all nodes in the network (extension of Nakamoto consensus) • This can be used

Promises, Promises

Superconductivity and Electric Power: Promises, Promises...Past ...

Blockchains and consensus protocols · 6 Consensus Four elements characterize Blockchain Replicated ledger Cryptography Business logic Logic embedded in the ledger Executed together

Declarative - Java Forum Stuttgart · Declarative Smart Contracts. Context 1. An actual contract, executed automatically. Any Turing Complete Program ... Verifying Blockchain Infrastructure

The First Flexible Research Funds - Newcastle University · Blockchain technology and emerging local energy markets Blockchain promises secure, verifiable and transparent recording

Promises Promises - I'Ll Never Fall in Love Again

Promises and Perils of Mobile Voting€¦ · Table 3 shows that telling respondents that online voting will be secured by blockchain technology paradoxically reduces willingness to

Promises Promises - I'Ll Never Fall in Love Again (Promises, Promises)

A conference presented by the IBA Insolvency …...on insolvency law – Part I Blockchain promises to be the most important technological development in business practices since the

May 25, 2016 · •A Blockchain solution will transform how contracts are executed •Protocol is programmable to trigger transfer of value and information under certain conditions

The New Energy Consumer: What Promises Do Blockchain Technologies Offer Energy Providers?

POWERED BY BLOCKCHAIN...Blockchain-based digital identity promises to make the supply chain leaner, simpler, and more cost-effective. Digital identity for all actors, goods, and places

Promises Made, Promises Kept