CSE – IV Year – II Semester –

A5656 – Block Chain Technology

Module – I – Introduction to Crypto
Currencies
 Introduction to Cryptography and
Crypto Currencies
 All currencies need some way to control supply and enforce
various security properties to prevent cheating.
 In fiat currencies, organizations like central banks control
the money supply and add anti‐counterfeiting features to
physical currency.
 A fiat currency is a type of currency that is declared legal
tender by a government but has no intrinsic or fixed value and
is not backed by any tangible asset, such as gold or silver.
 These security features raise the bar for an attacker, but they
don’t make money impossible to fake. Ultimately, law
enforcement is necessary for stopping people from breaking
the rules of the system.
 Introduction to Cryptography and
Crypto Currencies
 Crypto Currencies make heavy use of Cryptography.
Cryptography provides a mechanism for securely
encoding the rules of a crypto currency system in the system
itself.
 We can use it to prevent tampering and equivocation, as well
as to encode the rules for creation of new units of the
currency into a mathematical protocol.
 Cryptography is a deep academic research field utilizing
many advanced mathematical techniques that are notoriously
clever and complicated to understand.
 Cryptographic Hash Functions
A hash function is a mathematical function with the
following three properties:
 Its input can be any string of any size.
 It produces a fixed size output (assume a 256‐bit output
size).
 It is efficiently computable. It means that for a given input
string, you can figure out what the output of the hash
function is in a reasonable amount of time. More technically,
computing the hash of an n‐bit string should have a running
time that is O(n).
Hash function to be cryptographically
secure
 For a hash function to be cryptographically secure, it has the
following three additional properties:
(1). Collision‐resistance
(2) . Hiding
(3) . Puzzle‐friendliness
 Property 1: Collision‐resistance
 A collision occurs when two distinct inputs produce the same
output. A hash function H(.) is collision‐resistant if nobody can
find a collision. Formally:
 Collision‐resistance: A hash function H is said to be collision
resistant if it is infeasible to find two values, x and y , such that x
≠ y , yet H(x) = H(y).
x
H(x)=H(y)
y
Figure 1.1 A hash collision. x and y are distinct values, yet
when input into hash function H , they produce the same output.
Notice that we said nobody can find a collision, but we did not
say that no collisions exist.
 Property 1: Collision‐resistance
 In fact, by the Pigeonhole Principle there will necessarily be
a very large number of possible inputs that map to any particular
output.

Possible
Possible Outputs
Inputs
Figure 1.2 Because the number of inputs exceeds the number of
outputs, we are guaranteed that there must be at least one output
to which the hash function maps more than one input
 Property 1: Collision‐resistance
 Now, to make things even worse, we said that it has to be
impossible to find a collision. Yet, there are methods that are
guaranteed to find a collision.
 Consider the following simple method for finding a collision
for a hash function with a 256‐bit output size: pick
2256+1 distinct values, compute the hashes of each of them,
and check if there are any two outputs are equal. Since we
picked more inputs than possible outputs, some pair of them
must collide when you apply the hash function.
 Property 1: Collision‐resistance
 In fact, if we randomly choose just 2130+1 inputs, it turns
out there’s a 99.8% chance that at least two of them are
going to collide. The fact that we can find a collision by only
examining roughly the square root of the number of possible
outputs results from a phenomenon in probability known as
the birthday paradox .
 For a hash function with a 256‐bit output, you would have
to compute the hash function 2256+1 times in the worst case,
and about 2128 times on average.
 if a computer calculates 10,000 hashes per second, it would
take more than one octillion (1027) years to calculate 2128
hashes!.
 Property 1: Collision‐resistance
 Consider, for example, the following hash function:
H(x) = x mod 2256
 This function meets our requirements of a hash function as it
accepts inputs of any length, returns a fixed sized output
(256 bits), and is efficiently computable. But this function
also has an efficient method for finding a collision. Notice
that this function just returns the last 256 bits of the input.
One collision then would be the values 3 and 3+2256.
 In some cases, such as the old MD5 hash function, collisions
were eventually found after years of work, leading the
function to be deprecated and phased out of practical use.
And so we choose to believe that those are collision
resistant.
 Application: Message digests
 If we know that two inputs x and y to a collision‐resistant
hash function H are different, then it’s safe to assume that
their hashes H(x) and H(y) are different — if someone
knew an x and y that were different but had the same hash,
that would violate our assumption that H is collision
resistant.
 This argument allows us to use hash outputs as a
message digest.
 Consider SecureBox, an authenticated online file storage
system that allows users to upload files and ensure their
integrity when they download them.
 Application: Message digests
 Collision‐free hashes provide an elegant and efficient
solution to this problem. Alice just needs to remember the
hash of the original file.
 When she later downloads the file from SecureBox, she
computes the hash of the downloaded file and compares it to
the one she stored.
 If the hashes are the same, then she can conclude that the file
is indeed the one she uploaded, but if they are different, then
Alice can conclude that the file has been tampered with.
 The hash serves as a fixed length digest, or
unambiguous summary, of a message.
 Property 2: Hiding
 The hiding property asserts that if we’re given the output of
the hash function y = H(x), there’s no feasible way to figure
out what the input, x , was.
 Consider the following simple example: we’re going to do
an experiment where we flip a coin. If the result of the coin
flip was heads, we’re going to announce the hash of the
string “heads”. If the result was tails, we’re going to
announce the hash of the string “tails”.
 Hiding. A hash function H is hiding if: when a secret value r
is chosen from a probability distribution that has high
min‐entropy , then given H(r ‖ x) it is infeasible to find x .
 Property 2: Hiding
 In information‐theory, min‐entropy is a measure of
how predictable an outcome is, and high
min‐entropy captures the intuitive idea that the distribution
(i.e., random variable) is very spread out.
 For a concrete example, if r is chosen uniformly from among
all of the strings that are 256 bits long, then any particular
string was chosen with probability 1/2256, which is an
infinitesimally small value.
 Application: Commitments
 A Commitment is the digital analog of taking a value,
sealing it in an envelope, and putting that envelope out on
the table where everyone can see it.
 When you do that, you’ve committed yourself to what’s
inside the envelope. But you haven’t opened it, so even
though you’ve committed to a value, the value remains a
secret from everyone else.
 Later, you can open the envelope and reveal the value that
you committed to earlier.
 Commitment scheme
 A commitment scheme consists of two algorithms:
 com := commit(msg, nonce) The commit function takes
a message and secret random value, called a nonce, as input
and returns a commitment.
 verify(com, msg, nonce) The verify function takes a
commitment, nonce, and message as input. It returns true if
com == commit(msg , nonce) and false otherwise.
We require that the following two security properties
hold:
 Hiding: Given com , it is infeasible to find msg.
 Binding: It is infeasible to find two pairs (msg, nonce)
and (msg’, nonce’) such that msg ≠msg’ and
commit(msg, nonce) == commit(msg’, nonce’ ).
 Commitment scheme
 Every time you commit to a value, it is important that you
choose a new random value nonce . In cryptography, the
term nonce is used to refer to a value that can only be used
once.
Consider the following commitment scheme:
 commit( msg, nonce) := H(nonce ‖ msg) where nonce
is a random 256‐bit value
 To commit to a message, we generate a random 256‐bit
nonce. Then we concatenate the nonce and the message and
return the hash of this concatenated value as the
commitment. To verify, someone will compute this same
hash of the nonce they were given concatenated with the
message. And they will check whether that’s equal to the
 Commitment scheme
 If we substitute the instantiation of commit and verify as
well as H(nonce ‖ msg) for com , then these properties
become:
 Hiding: Given H( nonce ‖ msg), it is infeasible to find
msg.
 Binding: It is infeasible to find two pairs (msg, nonce)
and (msg’, nonce’) such that msg ≠ msg’ and H(nonce ‖
msg) == H( nonce’ ‖ msg’).
 The hiding property of commitments is exactly the
hiding property that we required for our hash functions. If
key was chosen as a random 256‐bit value then the hiding
property says that if we hash the concatenation of key and
the message, then it’s infeasible to recover the message from
the hash output.
 Property 3: Puzzle friendliness
 Puzzle friendliness. A hash function H is said to be
puzzle‐friendly if for every possible n‐bit output value y , if
k is chosen from a distribution with high min‐entropy, then
it is infeasible to find x such that H(k ‖ x) = y in time
significantly less than 2n.
 Intuitively, what this means is that if someone wants to target
the hash function to come out to some particular output
value y , that if there’s part of the input that is chosen in a
suitably randomized way, it’s very difficult to find another
value that hits exactly that target.
 Application: Search puzzle
 We’re going to build a search puzzle , a mathematical
problem which requires searching a very large space in
order to find the solution. In particular, a search puzzle has
no shortcuts. That is, there’s no way to find a valid solution
other than searching that large space.
Search puzzle. A search puzzle consists of
 a hash function, H,
 a value, id (which we call the puzzle‐ID), chosen from a
high min‐entropy distribution and a target set Y.
A solution to this puzzle is a value, x , such that
 H( id ‖ x ) ∈ Y.
 Application: Search puzzle
 If a search puzzle is puzzle‐friendly, this implies that there’s
no solving strategy for this puzzle which is much better than
just trying random values of x . And so, if we want to pose a
puzzle that’s difficult to solve, we can do it this way as long
as we can generate puzzle‐IDs in a suitably random way.
SHA‐256:
 We can build a hash function that works on fixed‐length
inputs, there’s a generic method to convert it into a hash
function that works on arbitrary‐length inputs. It’s called the
Merkle‐Damgard transform .
 SHA‐256 is one of a number of commonly used hash
functions that make use of this method. In common
terminology, the underlying fixed‐length collision‐resistant
hash function is called the compression function .
 Application: Search puzzle

Figure 1.3: SHA‐256 Hash Function (simplified)

SHA‐256 uses the Merkle‐Damgard transform to turn a
fixed‐length collision‐resistant compression function into a hash function
that accepts arbitrary‐length inputs. The input is “padded” so that its
length is a multiple of 512 bits.
SHA‐256 uses a compression function that takes 768‐bit input and
produces 256‐bit outputs. The block size is 512 bits. See Figure 1.3 for
a graphical depiction of how SHA‐256 works.
Hash Pointers and Data Structures
• A hash pointer is a data structure that turns out to be
useful in many of the systems that we will talk about.
• A hash pointer is simply a pointer to where some
information is stored together with a cryptographic hash of
the information. Whereas a regular pointer gives you a
way to retrieve the information, a hash pointer also gives
you a way to verify that the information hasn’t changed.
Figure 1.4 Hash pointer
A hash pointer is a pointer to
where data is stored together with a
Cryptographic hash of the value of
that data at some fixed point in time.
 Hash Pointers and Data Structures
Block chain: In a block chain the previous block pointer will be
replaced with a hash pointer. So each block not only tells us where
the value of the previous block was, but it also contains a digest of
that value that allows us to verify that the value hasn’t changed. We
store the head of the list, which is just a regular hash‐pointer that
points to the most recent data block.
Figure 1.5 Block chain. A block chain is a linked list
that is built with hash pointers instead of pointers.
 Hash Pointers and Data Structures
• A use case for a block chain is a tamper‐evident log . That is,
we want to build a log data structure that stores a bunch of data,
and allows us to append data onto the end of the log. But if
somebody alters data that is earlier in the log, we’re going to
detect it(Fig. 1.6)
• So we can build a block chain like this containing as many blocks
as we want, going back to some special block at the beginning of
the list, which we will call the genesis block.
Figure 1.6Tamper‐evident log
 Hash Pointers and Data Structures
Merkle tree
• A binary tree with hash pointers is known as a Merkle tree,
after its inventor Ralph Merkle.
• Suppose we have a number of blocks containing data. These
blocks comprise the leaves of our tree. We group these data
blocks into pairs of two, and then for each pair, we build a
data structure that has two hash pointers, one to each of these
blocks.
• These data structures make the next level up of the tree. We
in turn group these into groups of two, and for each pair,
create a new data structure that contains the hash of each. We
continue doing this until we reach a single block, the root of
the tree.
 Hash Pointers and Data Structures
Figure 1.7 Merkle tree. Here, data blocks are grouped in pairs and the
hash of each of these blocks is stored in a parent node. The parent nodes
are in turn grouped in pairs and their hashes stored one level up the tree.
This continues all the way up the tree until we reach the root node.
A sorted Merkle tree is just a Merkle tree where we take the blocks at
the bottom, and we sort them using some ordering function. This can be
alphabetical, lexicographical order, numerical order, or some other agreed
upon ordering.
 Hash Pointers and Data Structures
Proof of membership: Another nice feature of Merkle trees is
that, unlike the block chain that we built before, it allows a concise
proof of membership.
If there are n nodes in the tree, only about log(n) items need to be
shown. And since each step just requires computing the hash of the
child block, it takes about log(n) time
for us to verify it. Verification thus runs
in time and space that’s logarithmic in
the number of nodes in the tree.
Figure 1.8 Proof of Membership
To prove that a data block is included
in the tree, one only needs to show
the blocks in the path from that data
block to the root.
 Hash Pointers and Data Structures
Proof of membership:
• With a sorted Merkle tree, it becomes possible to verify
non‐membership in a logarithmic time and space. That is, we can
prove that a particular block is not in the Merkle tree.
• And the way we do that is simply by showing a path to the item
that’s just before where the item in question would be and showing
the path to the item that is just after where it would be.
• If these two items are consecutive in the tree, then this serves as a
proof that the item in question is not included. For if it was
included, it would need to be between the two items shown, but
there is no space between them as they are consecutive.
• So, to consider another example, we can build a directed
acyclic graph out of hash pointers.
 Digital Signatures
A digital signature is supposed to be the digital analog to a
handwritten signature on paper. We desire two properties
from digital signatures that correspond well to the handwritten
signature analogy.
Firstly, only you can make your signature, but anyone who sees
it can verify that it’s valid.
Secondly, we want the signature to be tied to a particular
document so that the signature cannot be used to indicate your
agreement or endorsement of a different document.
For handwritten signatures, this latter property is
analogous to assuring that somebody can’t take your signature
and snip it off one document and glue it onto the bottom of
another one.
 Digital Signatures
This scheme consists of the following three algorithms:
● (sk, pk) := generateKeys( keysize ) The generateKeys method
takes a key size and generates a key pair. The secret key sk is kept privately
and used to sign messages. pk is the public verification key that you give to
everybody.Anyone with this key can verify your signature.
● sig := sign( sk , message ) The sign method takes a message and a
secret key, sk , as input and outputs a signature for message under sk.
● isValid := verify( pk , message , sig ) The verify method takes a
message, a signature, and a public key as input. It returns a boolean value,
isValid , that will be true if sig is a valid signature for message under public
key pk , and false otherwise.
We require that the following two properties hold:
● Valid signatures must verify verify( pk , message , sign ( sk ,
message )) == true
● Signatures are existentially unforgeable.
 Digital Signatures
Unforgeability. The second requirement is that it’s
computationally infeasible to forge signatures. That is, an adversary
who knows your public key and gets to see your signatures on some
other messages can’t forge your signature on some message for
which he has not seen your signature. This unforgeability property is
generally formalized in terms of a game that we play with an
adversary. The use of games is quite common in cryptographic
security proofs.
Practical Concerns. There are a number of practical things that
we need to do to turn the algorithmic idea into a digital signature
mechanism that can be implemented in practice. For example, many
signature algorithms are randomized (in particular the one used in
Bitcoin) and we therefore need a good source of randomness. The
importance of this really can’t be underestimated as bad randomness
will make your otherwise‐secure algorithm insecure.
 Digital Signatures
Figure 1.9 Unforgeability game. The adversary and the challenger
play the unforgeability game. If the attacker is able to successfully output a
signature on a message that he has not previously seen, he wins. If he is
unable, the challenger wins and the digital signature scheme is
unforgeable.
 Digital Signatures
ECDSA (Elliptic Curve Digital Signature Algorithm):
• ECDSA is a U.S. government standard, an update of the
earlier DSA algorithm adapted to use elliptic curves. These
algorithms have received considerable cryptographic analysis
over the years and are generally believed to be secure.
• Bitcoin uses ECDSA over the standard elliptic curve
“secp256k1” which is estimated to provide 128 bits of
security.
• This is just a quirk of Bitcoin, as this was chosen by Satoshi in
the early specification of the system and is now difficult to
change.
 Digital Signatures
It might be useful to have an idea of the sizes of various quantities,
however:
Private key : 256 bits
Public key, uncompressed: 512 bits
Public key, compressed : 257 bits
Message to be signed : 256 bits
Signature : 512 bits
With ECDSA, a good source of randomness is essential because a
bad source of randomness will likely leak your key.
 Public Keys as Identities
• The idea is to take a public key, one of those public
verification keys from a digital signature scheme, and equate
that to an identity of a person or an actor in a system. If you
see a message with a signature that verifies correctly under a
public key, pk, then you can think of this as pk is saying the
message.
• In order for someone to speak for the identity pk, they must
know the corresponding secret key, sk.
• In practice, you may use the hash of pk as your identity since
public keys are large. If you do that, then in order to verify
that a message comes from your identity, one will have to
check
1) that pk indeed hashes to your identity, and
2) the message verifies under public key pk.
 Public Keys as Identities
Decentralized identity management
This brings us to the idea of decentralized identity management.
Rather than having a central authority that you have to go to in order
to register as a user in a system, you can register as a user all by
yourself.
This is the way Bitcoin, in fact, does identity. These identities are
called addresses, in Bitcoin jargon.
You’ll frequently hear the term address used in the context of
Bitcoin and cryptocurrencies, and that’s really just a hash of a public
key. It’s an identity that someone made up out of thin air, as part of
this decentralized identity management scheme.
 Public Keys as Identities
Decentralized identity management
In other words, in Bitcoin you don’t need to explicitly register or
reveal your real‐world identity, but the pattern of your behavior
might itself be identifying. This is the fundamental privacy question
in a cryptocurrency like Bitcoin.
 A Simple Cryptocurrency
GoofyCoin
The first of the two is GoofyCoin, which is about the simplest
cryptocurrency. There are just two rules of GoofyCoin. The first
rule is that a designated entity, Goofy, can create new coins
whenever he wants and these newly created coins belong to
him.
To create a coin, Goofy generates a unique coin ID,
uniqueCoinID that he’s never generated before and constructs
the string “CreateCoin [uniqueCoinID]”. He then computes the
digital signature of this string with his secret signing key. The
string, together with Goofy’s signature, is a coin. Anyone can
verify that the coin contains Goofy’s valid signature of a
CreateCoin statement, and is therefore a valid coin.
 A Simple Cryptocurrency
GoofyCoin
The second rule of GoofyCoin is that whoever owns a coin can
transfer it on to someone else. Transferring a coin is not simply
a matter of sending the coin data structure to the recipient —
it’s done using cryptographic operations.
 A Simple Cryptocurrency
GoofyCoin
Figure 1.10 GoofyCoin coin. Shown here is a coin that’s been
created (bottom) and spent twice (middle and top).