Blockchain Security improvement or - RSA Conference · 2019-07-26 · Blockchain promises to change...

© 2018 RSA Conference. All rights reserved.

Blockchain Security improvement or security nightmare?

Dave Huseby, Security Maven, Hyperledger, The Linux Foundation

Marta Piekarska, Director of Ecosystem, Hyperledge r, The Linux Foundation


Marta PiekarskaDirectory of Ecosystem, Hyperledger, The Linux Foundation

PhD in User Informed Design of Privacy Tools

10 years of experience in technology companies, including Apple, Yahoo & Deutsche Telekom

4 years in Blockchain: Blockstream & Hyperledger


Dave HusebySecurity Maven, Hyperledger, The Linux Foundation

Security Maven

Open source developer for 25 years

Focused on software security and engineering best practices for the last decade


The first long-distance trade occurred between Mesopotamia and indusvalley in pakistan ~3000 b.C

We have been exchanging goods for years.


How Do You Agree on Assets Balance?

How to track the value of exchanged goods?


Traditional Ledgers


In the digital world there are many copies that may contain different versions. The challenge: which do you trust as a single source of truth?

Digital World


Internet Connected Reality


Now we can keep our ledgers in sync—provided we can agree

Potential of Peer to Peer Network


The roots of Bitcoin are located in the so called “Cypherpunks” movement a group of technical-skilled activists, who campaigned for protection of privacy and anonymity in the Cyberspace from the beginning of 1990s onwards.

Members of the Cypherpunks were activists like Hal Finney, Nick Szabo, David Chaum, Wei Dai, Phil Zimmermann, Julian Assange and Satoshi Nakamoto, who later developed the Bitcoin.

Blockchain is really old


Myth Debunked: Blockchain ≠ Cryptocurrency


Cryptocurrency is an application that sits on top of blockchain.

Not the other way around.


An append-only systemof record or log of transactions that is multiplied in a number of places

but kept in synch

What is a DLT?


• Everyone shares the ledger• No one participant owns it, but all agree• Leverages cryptography and consensus mechanism

technology• No single entity maintains it, the whole network

validates, maintains, and keeps a copy of the database

Properties of Distributed ledgers


Block Hash

Prev Hash

Merkel Root

Tx

Tx

Tx

Tx

Block Hash

Prev Hash

Merkel Root

Tx

Tx

Tx

Tx

Block Hash

Prev Hash

Merkel Root

Tx

Tx

Tx

Tx

Block Hash

Prev Hash

Merkel Root

Tx

Tx

Tx

Tx

Block Hash

Prev Hash

Merkel Root

Tx

Tx

Tx

Tx

TIME

It’s ”just” a Chain of Blocks


Network nodes both generate their own data and verify data

generated by others

Contain historic record of verified transactions and

easily auditable

Distributed Consensus eliminates costly and inefficient

reconciliation processes

No central repository –each node stores identical copies

of the ledger

Resilient due to network power and cryptographic

integrity

Large economicdisincentive for malicious actors

Facets of distributed, shared ledgers

https://wiki.hyperledger.org/community/hyperledger-project-code-of-conduct



The code or any complex program stored and executed on a blockchain.

There is more! What is a Smart Contract?


• Facilitate, verify, or enforce the negotiation or performance of a contract autonomously

• “If, then” statements or when “X happens, then automatically record or execute Y”

• Reinvent how business processes take place• Automate manual or bespoke processes

What is a Smart Contract?


All over the global market there are ledgers that organizations and

individuals alike must trust.


The Need for Trust The 2018 Edelman Trust Barometer, an annual survey of 33k people in 28 countries, reveals that the trust in key institutions continues to decline. For blockchain,

2018 needs to be the year of scale done well.


By 2025, 10% of global GDP will be assets tracked and traded using blockchain-based distributed ledgers

Report by WEF 2017

Everyone wants their own DLT


ConsensusPoW, PoS, POET, RaFT,

BFT, PBFT

Crypto/SecurityPKI, HASH, SHA-256,

zk-SNARK, HE, ECC, EXDSA, SGX

Ledger ConceptsMining, Blocks,

Forks, Parents, Uncles, Merkle Trees

Platform ConceptsNodes, Oracles,

Notaries, Wallet, Smart Contracts

Google These Words




No matter what technologySecurity should always be in the

center of your attention


• Pushing security to the edges makes wallets and the private keys they store into high value targets.

Moving from Old to New


• Graveyard contains analysis of 51 publicly available attacks

Have you heard about Bitcoin Graveyard?


API’s with minimal foot-guns.

“ Conversational” wallet interfaces.

Curated crypto library

Documentation, training, and support.

Misuse Resistant Design is Key


Hyperledger Crypto Libraryhttps://github.com/hyperledger-labs/crypto-lib

Curated by the community.Minimizes foot-guns.

Supports regulated configurations.Can also use experimental algorithms.


Lots of Moving pieces…

Clients

Peers

Consensus Network

Distributed Ledger Organization


Clients

Peers

Consensus Network

Front End Middleware Back End

Distributed Ledger Organization

Lots of moving pieces...but no more complicated than the modern web.


What do we know?Basic security matters.

Users may not be ready for this.

The same techniques apply as in the old world.

Don’t panic.


Blockchain promises to change the way business is conducted and transactions are executed across industries. Precisely how, and the pace at which,

each of these industries adopts blockchain will surely vary.

There will never be one global chain-of-all chains that all industries convert to.


Permissionless Public Permissionless Private Permissioned Public Permissioned Private

Public Polls Land tit les, University degrees

Medical recordsBitcoin, Ethereum

Spectrum of BlockchainsPermissioned vs. Permissionless: Who can write to a Blockchain (i.e., accessibility)Public vs. Private: Who can read from a Blockchain (i.e., visibility)


Logistics, Insurance,Governments

Healthcare , Supply Chain

Fintech

Blockchain Industries Curve

Diffusion of Innovations Curve, by Everett Rogers


Not all problems can be solved with Blockchain


This technology is young. It is still early days.


When Frenemies try to be FriendsEnterprises are not designed to collaborate

How do you protect IP?

Can Open Source help?

Why join Blockchain consortia?

Which technology to choose?


The importance of being EarnestResponsible disclosure in decentralized and anonymous environment?

It is still a Network! DDoS is a Dirty Drag.

Smart Contracts are only as smart as their authors.

We already know most of it, just need to be more cautious


Exemplary Deployment: Claims Transparency


Exemplary Deployment: Secure Supply Chain


Exemplary Deployment: Posture Validation


What’s Left to be done?


Report a Security Bug

[email protected]

We Have a Bug Bounty—

Use It!hackerone.com/hyperledger

Join a Working Group

wiki.hyperledger.org

Watch the Webinar Replay:

Get Involved!hyperledger.org/webinars/

get-involved

You too can help--the easy stuff.

mailto:[email protected]

http://hackerone.com/hyperledger

http://wiki.hyperledger.org/

http://hyperledger.org/webinars/get-involved


Tineolahttps://github.com/tineola/tineola

A red-team tool for testing Hyperledger Fabric.

You too can help--the hard stuff.

https://github.com/tineola/tineola


Questions?

Marta PiekarskaDirector of Ecosystem, [email protected] HusebySecurity Maven, [email protected]


Massive online open-souce course

“ Blockchain for Business”

Publicationshyperledger.org/resources

Comparison of Hyperledger Frameworks

Collection of inte restinguse cases for Blockchain

technologies

On Bitcoinbitcoin.org/en/faq

Just subscribe MIT chainletter

Recommended Reading

https://www.edx.org/course/blockchain-business-introduction-linuxfoundationx-lfs171x

http://www.hyperledger.org/resources

https://www.hyperledger.org/wp-content/uploads/2017/08/Hyperledger_Arch_WG_Paper_1_Consensus.pdf

https://wiki.hyperledger.org/groups/requirements/use-case-inventory

https://bitcoin.org/en/faq

https://www.technologyreview.com/newsletters/chain-letter/

Blockchain Security improvement or - RSA Conference · 2019-07-26 · Blockchain promises to change...

Documents

Transcript of Blockchain Security improvement or - RSA Conference · 2019-07-26 · Blockchain promises to change...