Blockchain Certification: Bitcoin & OpenTimestamps

* Bitcoin is scarcity in the digital domain, i.e. the digital equivalent of gold
* There is no blockchain without an intrinsic native digital asset
* Blockchain timestamping is the decentralized digital alternative to traditional certification authorities.
* The OpenTimestamps standard is trust-minimizing, scalable, and convenient
* Timestamping provides only proof of existence at a given date; it does not convey authorship, non-repudiation, veracity, guaranteed origin, etc.
* Most of the time, timestamping only makes sense if coupled with digital signature or alternative authorship proofs
* Centralized timestamping on private permissioned blockchain is no different from traditional Certification Authority
* For a decentralized timestamp to be reliable, it must use bitcoin
* Timestamping, notarization, and anchoring are digital gold jewelry

Transcript

1. Blockchain Certification: Bitcoin & OpenTimestamps Milano-Bicocca University, 25th January 2019 Ferdinando Maria Ametrano © 2019 Digital Gold Institute
2. Bitcoin: A Protocol and a Currency ▪ Bitcoin: protocol, software, and community ▪ bitcoins: units of the currency bitcoins are sent using the Bitcoin protocol ▪ bitcoins are the native digital asset intrinsic to the Bitcoin protocol © 2019 Digital Gold Institute 2/55
3. Bitcoin: The Protocol ▪ Distributed public ledger of transactions ▪ Shared with peer-to-peer technology ▪ Massively duplicated across network nodes ▪ Allowing the ownership transfer of a native digital scriptural asset ▪ Whose native “digital token” can be exchanged, but not duplicated ▪ Keeps records of every transaction forever © 2019 Digital Gold Institute 3/55
4. Bitcoins: The Currency ▪ Only exist as public ledger documented transactions ▪ Are associated to public address(es) like 1FEz167JCVgBvhJBahpzmrsTNewhiwgWVG ▪ the bitcoin distributed public ledger certifies for everybody how many bitcoins are associated to any address https://blockstream.info/address/1FEz167JCVgBvhJBahpzmrsTNewhiwgWVG It is mine; you are REALLY encouraged to tip © 2019 Digital Gold Institute 4/55
5. Asymmetric Cryptography: Public/Private Key Pair Two mathematically linked keys perform opposite digital signature functions: ▪ The private (secret) key used to generate the signature ▪ The public key used by anyone to verify the signature ▪ The public key derives from the private key, but the private key cannot be derived from the public one ▪ A bitcoin address is derived from a public key, but the public key cannot be derived from the address ▪ Private key -> public key -> bitcoin address © 2019 Digital Gold Institute 5/55
6. Asymmetric Cryptography: Public/Private Key Pair ▪ Private key -> public key -> bitcoin address ▪ The corresponding private key allows spending from that address https://www.bitaddress.org © 2019 Digital Gold Institute 6/55
7. A Bitcoin Transaction: From Alice’s Address to Bob’s Address ▪ Transaction: amount + Bob’s address (+ Alice’s public key) ▪ Alice’s private key digitally signs the transaction ▪ The transaction is broadcasted to the network ▪ With Alice’s public key any network node can verify that: − Amount is at Alice’s address disposal − Digital signature is valid, the transaction has not been tampered or modified: the private key associated to Alice’s address has signed the transaction ▪ The transaction is then published to the public ledger ▪ Everybody knows that the Bob’s address has received the transacted amount © 2019 Digital Gold Institute 7/55
8. Double Spending Problem ▪ To securely transfer value using digital means has been possible for decades ▪ In digital cash schemes, a single digital token, being just a file that can be duplicated, can be spent twice ▪ A centralized trusted party has always been required to prevent double spending © 2019 Digital Gold Institute 8/55
9. Bitcoin Network: A Distributed Back-office ▪ All network nodes validate and clear all transactions ▪ Mining nodes provide the additional computational power required for transaction settlement ▪ Without a central trusted party, how do they reach distributed consensus on the transaction history? ▪ Consensus in a distributed asynchronous network with faulty (or malicious) nodes is a very hard problem: Computer Science even provides impossibility results © 2019 Digital Gold Institute 9/55
10. Bitcoin's Public Ledger: A Chain of Blocks ▪ Transactions are bundled in blocks (about one block every 10 minutes) and sequentially chained ▪ The cryptographic link between blocks requires computing power to be created ▪ A block is valid only if it includes valid transactions © 2019 Digital Gold Institute 10/55
11. Mining ▪ Miners compete to finalize (settle) a new block of transactions ▪ The winner providing proof-of-work for the finalization of a new block is rewarded with the issuance of new bitcoins in a special coinbase transaction included in that same block ▪ Miners solve the double spending problem: − A double spending transaction would invalidate the block − an invalid block would be rejected from the network − the bitcoin reward would be removed from transaction history − the winning miner would have wasted his work © 2019 Digital Gold Institute 11/55
12. Ledger Immutability ▪ Because of the proof-of-work, the chances of a block being altered decrease exponentially with the number of blocks chained after it ▪ The chain of blocks is a history of transactions resilient to network attackers because it cannot be altered without huge resources ▪ Computing power is measured in hash/s, hash being the basic operation needed for validation © 2019 Digital Gold Institute 12/55
13. Nakamoto Distributed Consensus ▪ Practical Byzantine Fault Tolerant (PBFT) distributed consensus is achieved using (game theory) economic incentive for the mining nodes to be honest ▪ Double spending is solved without a central trusted party ▪ Bitcoin can resist attacks of malicious agents, as long as they do not control network majority ▪ Miners are compensated for their proof-of-work using seigniorage revenues, i.e. issuance of new bitcoins ▪ Seigniorage revenues subsidize the network © 2019 Digital Gold Institute 13/55
14. Virtuous Cycle hash power Bitcoin security bitcoin price mining reward © 2019 Digital Gold Institute 14/55
15. Validation Process: Block Generation The proof-of-work difficulty is adapted about every 2 weeks (2016 blocks) to the overall available computing power ensuring about one block every 10 minutes © 2019 Digital Gold Institute 15/55
16. Bitcoin Monetary Rule ▪ 2009: 50BTC per block, every 10 minutes − halving every 4Y ▪ This is the only way new bitcoins are released ▪ It is called mining because of its similarity with the progressive scarcity of gold extraction ▪ Supply is free of discretionary intervention © 2019 Digital Gold Institute 16/55
17. Bitcoin Inelastic Supply: Deterministic Decreasing Rate 2029: 96.88% of all BTC issued 2141: last satoshi (0.00000001 BTC) will be issued © 2019 Digital Gold Institute 17/55
18. What Makes Bitcoin Special? ▪ Digital and scriptural: it only exists as validated transaction ▪ Asset, not liability ▪ Bearer instrument ▪ It can be transferred but not duplicated (i.e. it can be spent, but not double-spent) ▪ Scarce in digital realm, as nothing else before ▪ It mimics gold monetary policy © 2019 Digital Gold Institute 18/55
19. What Makes Bitcoin Special? Bitcoin is digital gold with a secure uncensorable embedded settlement network ▪ More a crypto-commodity then a crypto-currency ▪ This is the groundbreaking achievement by Satoshi Nakamoto, not blockchain “technology” © 2019 Digital Gold Institute 19/55
20. Bitcoin as (Digital) Gold in the History of (Crypto)Money gold ▪ Its adoption was not centrally planned ▪ For centuries it has been the most successful form of money ▪ It has bootstrapped all monetary systems we know of ▪ It has been surpassed by other kind of money without becoming obsolete bitcoin ▪ Its adoption has not been centrally planned ▪ It is the most successful form of cryptocurrency ▪ It is bootstrapping new monetary systems ▪ It might be surpassed by more advanced type of cryptocurrencies without becoming obsolete © 2019 Digital Gold Institute 20/55
21. “Bitcoin in 2014 Is Like Internet in 1994: Weird and Scary” (Marc Andreessen) American entrepreneur, investor, and software engineer; coauthor of Mosaic, cofounder of Netscape https://twitter.com/pmarca/status/677658844504436737 © 2019 Digital Gold Institute 21/55
22. The Wallet Garden Model ▪ Controlled access to web content and services ▪ Offered in the late ‘90s and early ‘00s by Compuserve, AOL (and to some extent MSN) ▪ Corporates wanted to go online, but not in the wild unregulated internet, populated by anonymous agents ▪ They eventually realized that perceived risks, which are real, are outweighed by benefits © 2019 Digital Gold Institute 22/55
23. What is The Blockchain? [A hash pointer linked list of blocks] ▪ An append-only sequential data structure ▪ New blocks can only be appended at the end of the chain ▪ To change a block in the middle of the chain, all subsequent blocks need to be changed ▪ Very inefficient compared to a relational database © 2019 Digital Gold Institute 23/55
24. Blockchain Without Bitcoin Blockchain without an intrinsic native digital asset Does it make sense? ▪ No bitcoin ▪ No asset available to reward miners ▪ Appointed validator officials required Central governance is required! Why should validators use a blockchain, i.e. a subpar data structure, instead of a database? © 2019 Digital Gold Institute 24/55
25. “Blockchain – not bitcoin – will prove revolutionary in banking” “When a wise man points at the moon the fool examines the finger.” (Confucius) “When a wise man points at the bitcoin the fool examines the blockchain.” (Ametrano) http://www.economist.com/news/leaders/21677198-technology-behind-bitcoin-could-transform-how-economy-works-trust-machine © 2019 Digital Gold Institute 25/55
26. Blockchain Beyond Bitcoin There is no blockchain without bitcoin There is blockchain beyond bitcoin Andreas Antonopoulos © 2019 Digital Gold Institute 26/55
27. Write Data On the Blockchain © 2019 Digital Gold Institute Bitcoin Script operator OP_RETURN can be used to store 80 bytes of arbitrary data in the blockchain 27/55
28. ▪ A timestamp proves that some data existed prior to some point in time, providing a relevant document with a certain sure date, e.g. postmark ▪ Law requires dates to be certified by public officials and notary services ▪ For digital documents, timestamping is based on digital signature by certification authority Timestamp © 2019 Digital Gold Institute 28/55
29. Hash Function ▪ A function that maps input data of arbitrary length to a hash value, i.e. an output data of a fixed length − Non-invertible (one-way: input data can not be regenerated from the output hash value) − Collision-resistant: computationally unfeasible to find 2 inputs that produce the same output ▪ The resulting hash value is a reliably unique identifier for any input data: it can be considered its unique digital fingerprint ▪ The hash value does not reveal the input data ▪ Bitcoin uses the (Secure Hash Algorithm) SHA256 that generates a fixed size 256-bit (32-byte) output © 2019 Digital Gold Institute 29/55
30. Blockchain as Timestamping Certification Authority ▪ A generic data file can be hashed to produce a short unique identifier, equivalent to its digital fingerprint ▪ Such a fingerprint can be associated to a bitcoin transaction (irrelevant amount) and hence attested on the blockchain ▪ Blockchain immutability provides time-stamping, proving the data file existence at that moment in time in that specific status BTC Transaction t3 t4 Genesis block t0 t1 t2 Hash function Hash value 610b0a4b2769898674a2624e9330fbd60bbee200db2b57514be49d9a8b63dc25 Timestamped at t2 © 2019 Digital Gold Institute data file 30/55
31. Blockchain Timestamping Pro: ▪ Digital public proof, easily auditable by everyone ▪ The proof cannot be faked, manipulated, or removed ▪ Certification authority cannot be bribed ▪ Can be used along with regulatory timestamping prescription Cons: ▪ Not efficient (one transaction per document) ▪ Lack of standardization To solve the above limits, Peter Todd and Riccardo Casatta have proposed an open standard consisting in a set of operations for creating provable blockchain timestamps and later independently verifying them © 2019 Digital Gold Institute 31/55
32. ▪ Third party auditability (suitable for regulatory prescriptions) ▪ Scalable: timestamp an unlimited number of documents with a single transaction ▪ Convenient: public server provides the service for free An Open Timestamping Standard © 2019 Digital Gold Institute 32/55
33. OpenTimestamps: Distributed , Trust- minimizing, Scalable, Convenient ▪ Trust: OpenTimestamps uses decentralized, publicly auditable, blockchains, removing the need for trusted authorities; OpenTimestamps’s architecture is designed to support multiple, cross-checked, notarization methods ▪ Scalability: OpenTimestamps scales indefinitely, allowing timestamps to be created for free by combining an unlimited number of timestamps into one blockchain transaction by leveraging Merkle-tree ▪ Convenience: OpenTimestamps can create a third-party- verifiable timestamp in about a second; you don’t need to wait for a blockchain confirmation https://petertodd.org/2016/opentimestamps-announcement © 2019 Digital Gold Institute 33/55
34. OpenTimestamps: Trust ▪ Decentralized, independent, uncensorable, cross-jurisdictional ▪ Third party auditable ▪ Blockchain agnostic Please note that a timestamp is as reliable as the used blockchain: ▪ very reliable when using Bitcoin because that blockchain is secured by huge computational power (proof-of-work); ▪ much less reliable with other public permissionless blockchain; ▪ when used with private permissioned blockchain its reliability depends on the reliability of the chain governance: in that case traditional certification authorities are probably better. © 2019 Digital Gold Institute 34/55
35. OpenTimestamps: Scalability An OpenTimestamps calendar server provides “aggregation before attestation”: 1. aggregation of multiple documents in a Merkle tree data structure 2. attestation of all documents at the same time using just a single blockchain transaction ▪ Moreover, a calendar server can offer its services to multiple remote OpenTimestamps clients © 2019 Digital Gold Institute 35/55
36. Merkle Tree: Hash Pointer Binary Tree ▪ Merkle tree can efficiently summarize large sets of data into one single hash 1. Hash all documents 2. Calculate the hash of the HA ||HB concatenation to obtain HAB , the next level of the tree 3. Iterate the process ▪ The membership proof is O(log N): to prove that DOCB is in the tree only 2 data are needed: HA and HCD ▪ Timestamp the tree root only © 2019 Digital Gold Institute Root H = hash(HAB ||HCD ) Merkle root DOC A DOC B DOC C DOC D HA = hash(A) HB = hash(B) HC = hash(C) HD = hash(D) HAB = hash(HA ||HB ) HCD = hash(HC ||HD ) HA = hash(A) HCD = hash(HC ||HD ) 36/55
37. OpenTimestamps: Convenience ▪ While anyone can timestamp with permissionless blockchain(s) by paying the transaction fees, OpenTimestamps provides public servers free to use without any registration or API key ▪ Verifiable timestamp are created in about a second ▪ Public format: no vendor lock-in ▪ Independently verifiable: no need for calendar server after timestamping © 2019 Digital Gold Institute 37/55
38. © 2019 Digital Gold Institute https://www.dgi.io/ots/ 38/55
39. © 2019 Digital Gold Institute https://www.dgi.io/ots/ 39/55
40. © 2019 Digital Gold Institute https://www.dgi.io/ots/ 40/55
41. © 2019 Digital Gold Institute https://www.dgi.io/ots/ 41/55
42. What Timestamping is Not It should be obvious, but it is worth mentioning that timestamping: ▪ can be selectively revealed to show convenient evidence and hiding inconvenient evidence (e.g. timestamping a bet outcome and its opposite, later revealing only the right one) ▪ does not prove authorship (that should be proved using a digital signature); ▪ can be repudiated (“it was not me…”) if not digitally signed; ▪ does not ensure veracity, validity, correctness, or accuracy of the timestamped document. © 2019 Digital Gold Institute 42/55
43. The Foolish Blockchain Certification ▪ IBM Food Trust ▪ EY Wine Blockchain ▪ Carrefour chicken ▪ Etc. just dishonest marketing gimmick, i.e. misleading advertising. © 2019 Digital Gold Institute https://www.ametrano.net/2018/10/11/Not-a-blockchain/ 43/55
44. Use Case 1: Digital Signature without Timestamping ▪ What if a signing private key is stolen? ▪ The key revocation certificate is issued to signal that signatures after the theft should be considered invalid WRONG!! ▪ Every signature performed with that key should be considered invalid because the thief can backdate documents © 2019 Digital Gold Institute Time X ✓ T0 T1 X 44/55
45. Use Case 1: Digital Signature with Timestamping ▪ Traditional timestamping relies on a third-party central authority signing with its private key ▪ What if the timestamper’s private key is stolen? ▪ Every timestamp created by that key must be considered invalid because the thief can backdate timestamps © 2019 Digital Gold Institute X Time X T0 T1 45/55
46. Use Case 1: Digital Signature with Blockchain Timestamping ▪ Blockchain notarization is an effective hardening approach ▪ What if the traditional timestamper’s private key is stolen? Blockchain timestamps cannot be backdated! © 2019 Digital Gold Institute ✓ Time X T0 T1 46/55
47. Use Case 1: Hardened Digital Signature Hardened digital signature Timestamping that cannot be backdated © 2019 Digital Gold Institute https://gist.github.com/RCasatta/6824c80e3de137f0d8d230f622e4bbaa 47/55
48. Use Case 2: Timestamp Internet ▪ OpenTimestamps is used to timestamp the whole Internet Archive https://archive.org/ ▪ This has been possible thanks to the high scalability of the OpenTimestamps protocol ▪ For the first time historical archived data cannot be altered without being noticed http://nova.ilsole24ore.com/progetti/la-blockchain-da-il-tempo-al-web/ © 2019 Digital Gold Institute 48/55
49. Use Case 3: Regulatory Compliance ▪ Broker-dealers have started using notarization to satisfy the regulatory prescriptions for storing required records exclusively in non-rewriteable and non-erasable electronic storage media. ▪ WORM (write once read many) optical media has been used so far, but it is quite impractical, especially for large data set ▪ Compliance can be achieved anchoring rewritable data sources to the blockchain, providing accurate and secure time-stamping resilient to manipulation http://www.coindesk.com/intesa-sanpaolo-trade-data-bitcoin-blockchain/ https://www2.deloitte.com/it/it/pages/financial-services/articles/l_integrita-dei-dati-di-trading---deloitte-italy---financial-ser.html https://drive.google.com/drive/folders/0B8tGDTaBY4-Nb3ZuRmgzRXJXOUk © 2019 Digital Gold Institute 49/55
50. Use Case 4: Publicly Verifiable Certificates It is easy to verify documents: ▪ signed by the issuer ▪ timestamped on blockchain It would be easy to provide public web-portals for drag-and-drop verification © 2019 Digital Gold Institute 50/55
51. Blockchain Certification: the Italian Law ▪ AGID will have to provide technical specification ▪ Let’s hope for the best… ▪ Blockchain cannot be used to track provenance of Italian tomatoes as Di Maio wishes… https://www.ilsole24ore.com/art/tecnologie/2019-01-23/valore-legale- blockchain-e-smart-contract-primo-via-libera-senato- 173759.shtml?uuid=AEkVaiKH © 2019 Digital Gold Institute 51/55
52. Anchoring: A New Security Paradigm ▪ Bitcoin blockchain network security is preserved by a computation power unparalleled in human history ▪ Other networks can tap into this security via anchoring (i.e. periodic time-stamping of their network status) ▪ Any “stateful system with global memory” can outsource its security to the bitcoin network, piggybacking its resilience ▪ Bitcoin seigniorage revenues might provide security for all transactional networks ▪ Bitcoin mining as global outsourced decentralized security © 2019 Digital Gold Institute 52/55
53. Digital Gold Jewelry What jewelry is for gold, notarization could be for bitcoin: not essential but effective at leveraging its beauty © 2019 Digital Gold Institute 53/55
54. Bibliography ▪ Satoshi Nakamoto, Bitcoin: A Peer-to-Peer Electronic Cash System (2008) https://bitcoin.org/bitcoin.pdf ▪ OpenTimestamps protocol https://opentimestamps.org/ ▪ Bitcoin & Blockchain Technology, Milano-Bicocca University, Spring 2019 https://www.ametrano.net/bbt/ ▪ Ferdinando Ametrano, Bitcoin, Blockchain and Distributed Ledger Technology: Hype or Reality? (2017) https://ssrn.com/abstract=2832249 ▪ Ferdinando Ametrano, “Bitcoin: oro digitale, finanza e tulipani” (2018), https://goo.gl/eyjDJ2 ▪ Intervista (“Le Iene”, Mediaset), http://bit.ly/2H2qwqf ▪ Bitcoin, YouTube videos, https://goo.gl/byVNqP ▪ Ferdinando Ametrano, Bitcoin as Digital Gold (2018), United Nations Department of Economic and Social Affairs, https://goo.gl/NkEC9w ▪ Ferdinando Ametrano, Blockchain Needs A Native Digital Asset, https://www.finextra.com/videoarticle/1241/blockchain-needs-a-native- digital-asset © 2019 Digital Gold Institute 54/55
55. Takeaways ▪ Bitcoin is scarcity in the digital domain, i.e. the digital equivalent of gold ▪ There is no blockchain without an intrinsic native digital asset ▪ Blockchain timestamping is the decentralized digital alternative to traditional certification authorities. ▪ The OpenTimestamps standard is trust-minimizing, scalable, and convenient ▪ Timestamping provides only proof of existence at a given date; it does not convey authorship, non-repudiation, veracity, guaranteed origin, etc. ▪ Most of the time, timestamping only makes sense if coupled with digital signature or alternative authorship proofs ▪ Centralized timestamping on private permissioned blockchain is no different from traditional Certification Authority ▪ For a decentralized timestamp to be reliable, it must use bitcoin ▪ Timestamping, notarization, and anchoring are digital gold jewelry © 2019 Digital Gold Institute 55/55
56. Ferdinando M. Ametrano Executive Director ferdinando@dgi.io To Be Announced Soon Chief Operating Officer info@dgi.io www.github.com/dginst www.facebook.com/DigitalGoldInstitute www.twitter.com/DigitalGoldInst www.dgi.org/feed.xml info@dgi.io www.dgi.io www.linkedin.com/company/digital-gold-institute "Scarcity in the Digital Domain"