Covering Your Assets: Blockchain and Security 

(Apoint via Shutterstock)

The combined market value of blockchain-based technologies, such as cryptocurrencies, is measured in the billions of US dollars. With cryptocurrency gaining legitimacy, it’s worth knowing what security measures are used to “cover your assets” — as well as what the issues are — before you join in the gold rush.

Mining & Proof

In order to prevent fraud, including unlawful currency creation and double spending, an advanced process of creating currency and validating transactions is required. Some work is needed, using either of two types of mechanisms: proof-of-work and proof-of-stake.

Most virtual currencies in use today, such as Bitcoin or Ethereum, rely on a proof-of-work (PoW), or evidence that some compute-intensive task was performed. Bitcoin’s PoW relies on the twofold evaluation of the SHA-256 cryptographic hash function on a newly formed block's header, and checking if the hash has a certain number of leading zeroes. If it doesn’t, a counter included in the block is increased and the above procedure is repeated. However, if the hash matches this criterion, then the combination of hash and block forms a valid PoW and the transaction can be validated.

In Ethereum, the PoW requires not only time but space, since it can require miners to allocate around the order of a gigabyte of memory to compute a hash value.

An alternative to PoW is proof-of-stake (PoS), also called virtual mining. PoS is a generalization of PoW; instead of trading compute resources (the mining effort) for coins (the mining reward), PoS trades assets other than computation or accepts taking some risks in exchange for some rewards. For example, “proof-of-deposit” requires miners to prove that they moved some of their coins into a bond deposit locked for a certain period of time, while “proof-of-burn” requires miners to pay a certain amount of cryptocurrency by burning it, i.e., transferring it to an unspendable wallet.

Public and Private Blockchains

PoW and PoS are useless if miners don’t work together to update the blockchain and run the cryptocurrency system. The core mechanism to collaboration between many mutually untrusting parties is called a consensus protocol – the rules followed by peers that belong to a consensus group. Members of this group run the blockchain-based system and are allowed to make decisions on its functioning.

Depending on who can gain access to this group, there are two main approaches:

• Permissionless blockchain systems: This open consensus mechanism allows anyone to participate. Bitcoin, Ethereum and Zcash are included in this category.
• Permissioned or federated blockchain systems: These have a closed consensus group, requiring new candidates to meet certain criteria. Hyperledger, Ripple and Stellar are included in this category.

Permissionless (public) and permissioned (private) blockchain mechanisms are well documented but relate more to the security of the system itself, rather than the security of the currency and user privacy. If you’re thinking about investing in Bitcoin, it’s worth reminding yourself about some of the risks relating to operations and privacy.

Keeping Your Wallet Safe

The greatest risk with cryptocurrencies — aside from financial — is the loss or theft of an account. Lose your 256-bit key and you lose your coins forever, as a British man discovered after he threw out his hard disk drive with the key to unlock $7.5 million worth of bitcoins.

Keep in mind, wallet management services that store your private keys are not risk-free. Hacking a remote computer and stealing a 256-bit value is easier than robbing a bank in a mask and escaping with bags of cash. In July 2011, the MyBitcoin wallet platform lost 51 percent of funds it held on behalf of its members. In February 2014, $350M worth of member assets were stolen from the Bitcoin exchange platform Mt Gox. In June 2016, an unknown attacker exploited a flaw in the design of Ethereum and stole the equivalent of $60M.

The simple lesson: just because you have “a wallet” doesn’t mean you’re safe.

Anonymity and Pseudonymity

While Bitcoin wallets are anonymous, transactions are open to public view with the aim of preventing fraud. Your name may not appear, but your wallet ID is tied to all related transactions—Bitcoin isn’t anonymous, it’s pseudonymous.

This opens up the possibility of spying on who’s doing business with another party, a problem that researchers have recently addressed with creation of Zcash, a privacy-preserving version of Bitcoin. Zcash makes Bitcoin transactions anonymous, and therefore untraceable, by hiding the identifier of the payer. Zcash does so using complex cryptographic mechanisms called zero-knowledge proofs.

Jean-Philippe Aumasson is principal research engineer at Kudelski Security, and Philipp Jovanovic is a postdoctoral researcher at the Decentralized and Distributed Systems Lab, École Polytechnique Fédérale de Lausanne.