Unit 2 - BC

Dr Prasanna B T
Tutor: Dr Prasanna B T
Associate Professor
Dept. of CS&E
Sri Jayachamarajendra College of
Engineering
JSS Science and Technology
University
Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

ru
BLOCKCHAIN-UNIT 2

ru
UNIT 2:
Blockchain Components: Public key infrastructure,
cryptographic hash functions, cryptographic nonce,
transactions, key storage and exchange techniques,
ledgers, creation of blocks, adding transactions into
the blocks, address creation, chaining the blocks.
Advantage and disadvantage of BC

ru
INTRODUCTION PKI
Ø Key management is related to the generation, storage,
distribution, and backup of keys.
Ø The focus is on the management of public key—
private key pairs.
Ø The public key—private key pairs are used for
encryption/decryption, signature generation/
verification, and for authentication.
Ø To encrypt a session key for use in communication
between A and B, A needs to know B's public key.

ru
The key issue hereis "How does A know B's public key?"
Ø Possibility 1:
•A may frequently communicate with B in a secure manner,
so she may already have B's public key.
•First, B must have securely communicated his public key
to A at some point in the past. A actually receives B's public
key and not a public key from someone posing as B.
•If at any time B's private key is compromised, the
confidentiality of messages from A to B using the
corresponding public key can no longer be guaranteed.
•An individual, with the compromised private key, can
decrypt messages encrypted with the old public key.

ru
Ø Possibility 2:
•Every entity's public key is securely maintained in a centralized
directory.
•Suppose A wishes to securely communicate with an e-commerce
website, B-Mart.
•All she has to do to obtain B-Mart's public key is to query the
directory for it.
•The question here is "Who would take the responsibility for
maintaining such a directory?"
•There are huge scalability problems associated with such a
directory,spoofing and denial of service attacks, the non-uniqueness of
names.
Ø Possibility 3:
•A receives a document signed by a trusted source, C, containing B's
public key.

ru
DIGITAL CERTIFICATES
Certificate Types
Ø A digital certificate is a signed document used to bind a
public key to the identity of a person.
Ø Example such as An individual's identity could be his/her
name, national identification number, e-mail .or postal
address, employer, etc. or some combination of these.
Ø CA:The entity that issues certificates is a trusted entity
called a certification Authority (CA)certificate authority.
Ø Certificates may be issued to individuals, to organizations,
or even to servers.
Ø The most basic type of certificate may be applied for
through regular e-mail with the applicant stating his/her
public key, name, e-mail address, etc.
ru
Ø In this case, the CA requires no credentials from the
applicant.
Ø It simply assumes that the applicant is in possession of the
(uncompromised) private key corresponding to the Public
key contained in the application received via e-mail.
Ø The verifier of such a certificate should realize that the
above certificates are "Trust at your own risk certificates."
Ø To carry more weight, certificate issuance would require
the CA to perform identity verification of the applicant.
Ø The CA may have to obtain and verify several details of
the applicant this task would be delegated by the CA to the
registration Authority (RA)

ru
X.509 Digital Certificate Format
Ø X.509 is an ITU standard specifying the format for public key
certificates.
Ø The fields of an X.509 certificate together with their meaning are as
follows:
1. Certificate Serial Number and Version :Each certificate issued by
a given CA will have a unique number.
2. Issuer information: The distinguished name of an entity includes
his/her/its "common name," e-mail address, organization, country, etc.
3. Certificate signature and associated signing algorithm
information: It is necessary to verify the authenticity of the certificate.
For this purpose, it is signed by the issuer. So, the certificate should
include the issuer's digital signature and also the algorithm used for
signing the certificate.
4. Validity period: There are two date fields that specify the start date
and end date between which the certificate is valid.

ru
5. Subject information :This includes the distinguished name
of the certificate's subject or owner.
Ø For example, if a customer intends to communicate with an
e-commerce web server at www.B-Mart.com, then the
customer's browser will request B-Mart's certificate.
Ø Client-side software will check whether the "Common
Name" in B-Mart's certificate tallies with B-Mart's domain
name.
Ø Other information, such as the subject's country, state, and
organization, may be included.
6. Subject's public key information: The public key, the
public key algorithm (e.g., RSA or DSA), and the public key
parameters (modulus in the case of RSA and modulus +
generator in case of Diffie-Hellman).
ru
Figure A digital certificate

ru
Digital Certificates in Action
Ø Assume that A needs to securely transmit a session key to B.
Ø So, she encrypts it with B's public key.
Ø A will need to retrieve the public key from B's certificate.
Ø A may already have B's certificate or she may send a message to B
requesting it.
Ø There are a number of checks that A will have to perform on B's
certificate prior to using B's public key.
•Is this indeed B's certificate?
•This can be determined by checking whether the certificate contains B's
name. But the "common name" field alone may be inadequate (since
there are probably many John Browns, for example).
•It may be necessary to check other fields in the certificate such as the
subject's web page URL or e-mail address.
•A should check if the certificate is still valid. Since the validity period is
contained in the certificate, this is easily done.

ru
•Finally, the certificate must be signed by a CA or RA.
•A should verify the signature contained in the
certificate.
•A requires the CA’s public key for signature
verification.
•The CA may be globally known or may be known to
the community that A and B belong.
•In this case A has access to the CA’s public key.

ru
PUBLIC KEY INFRASTRUCTURE
3.3.1 FUNCTIONS OF A PKI
Ø A public key infrastructure includes the CA’s , the physical
infrastructure(encryption technologies, hardware etc.), and the
formulation and enforcement of policies/procedure.
Ø It includes the following services:
•Certificate creation,issuance,storage and archival
•Key generation and key escrow
•Certificate/key updation
•Certificate revocation
Ø There are crucial differences in the support required for private keys
used for decryption versus those used for signing.
Ø In the case of encryption/decryption, it is often necessary to have a
back-up of the decryption key.
Ø If not, an employee who looses his decryption key will be unable to
decrypt the archives of sensitive data he may have accumulated.

ru
Ø For this reason, the PKI within an organization, for
example, might hold the private keys in escrow, i.e., they
may be securely backed up and made available to the
owner or to a trusted authority (such as a law enforcement
agency) under special circumstances.
Ø On the other hand, there is no need to back up a private
key used for digital signing.
Ø If such a key is lost, the owner could inform the CA or
PKI administrator (within an organization).
Ø He/she could then obtain a new signing key and receive a
new certificate carrying the corresponding public key.
Ø An important function of the PKI is to provide a safe
archival facility for all issued certificates.

ru
PKI Architectures

ru
ru
1. PKI with single CA:
Ø CA1 could issue certificates to multiple users Ul, U2, etc.,
enabling any pair of these users to communicate securely
using certificates exchanged between them.
Ø This is represented in above Fig.(a).
Ø Each arc in the figure is a trust relationship.
Ø For example, the arc from the CA1 to U2 expresses the fact
that CA1 vouches for U2's public key in the certificate issued
by the CA1 to U2. Such an architecture, however, is not
scalable.
Ø There are tens of millions of users who may need
certificates. It is not practical for CA1 to issue certificates to
all.

ru
2. Hierarchial (tree-based PKI architecture)
Ø A practical solution to the problem of scalability is to have
CA1 certify other CAs who in turn certify other CAs and so
on.
Ø This creates a tree of CAs known as a hierarchical PKI
architecture [see above Fig.(b)].
Ø Here, CA1 issues certificates to CA2, CA3, and CA4.
Ø CA2 in turn issues certificates to CA5 and end user Ul.
Ø CA5 issues certificates to users U2 and U3.
Ø The advantage of this approach is easy scalability — each
CA is responsible for certifying a limited number of users or
other CAs.
Ø CA1, the root CA, is sometimes referred to as the trust
anchor.
ru
Ø every node in the tree will know the root CA's public key.
Ø Suppose U1 in Fig.(b) needs U5's public key.
Ø U5 would have to provide an entire chain of certificates as
follows:
Ø (1) Certificate signed by CA1 vouching for CA3's public
key
Ø (2) Certificate signed by CA3 vouching for CA6's public
key
Ø (3) Certificate signed by CA6 vouching for U5's public
key
Ø It is assumed that each node has a copy of the root's public
key.
Ø So, upon receiving the above certificate chain, U1 can
verify the signature on the first certificate using CA1's (the
trust anchor'! public key.
ru
3. Mesh based PKI
Ø A more dense web of trust is shown in Fig. (c) and
is referred to as a mesh-based PKI. This could
include mutually trusting CAs — CA1 trusting CA2
and. CA2 trusting CA 1shown by a bidirectional arc
between CA1 and CA2.
Ø In tree based PKI , there may be multiple trust paths
between two users.
Ø Example there could be multiple trust paths
between user 1 and user 7
Path 1:CA1,CA3, and CA 4
Path 2: CA1,CA2, and CA 4.
ru
4. Bridge based PKI
Ø Another PKI architecture, referred to as bridge-based PKI,
is motivated by the need for secure communications between
organizations in a business partnership.
Ø Suppose that the partnering organizations already
have their own PKIs
A bridge CA is introduced that establishes a trust relationship with
a representative CA from each organization.
Ø This is accomplished by the bridge CA and the organizational
representatives issuing certificates to each other.
Ø The representative CA is one that has a trust path to all (or at least
most) of the users in that organization.
Ø Figure shows a bridge CA that extends the web of trust between two
existing organizational PKIs.

ru
Blockchain Components:
1. Cryptographic Hash Function: Hashing is a method of
applying a cryptographic hash function to data, which
calculates a relatively unique output (called a message
digest, or just digest) for an input of nearly any size
important security properties are:
a.They are preimage resistant.[Thismeans that they are
one-way;it is computationally infeasible to compute the
correct input value given some output value]
b.They are second preimage resistant. [cryptographic hash
functions are designed so that given a specific input, it is
computationally infeasible to find a second input which
produces the same output]
c. They are collision resistant. [This means that one cannot
find two inputs that hash to the same output.]
ru
Hash Functions & Message
Authentication
Symmetric Key Hash
Symmetric Key
Unkeyed Hash
a) Message
encrypted
b) Message
unencrypted

ru
Hash Functions & Message
Authentication
Keyed Hash Symmetric Keyed Hash
Symmetric Key
a) Message
unencrypted
d) Message
encrypted

ru
Hash Functions & Digital
Signatures

ru
Hash Function Requirements

ru
2. Cryptographic Nonce
•A cryptographic nonce is an arbitrary number that
is only used once.
•A cryptographic nonce can be combined with
data to produce different hash digests per nonce:
hash (data + nonce) = digest
•Only changing the nonce value provides a
mechanism for obtaining different digest values
while keeping the same data.
•This technique is utilized in the (proof of work)
consensus model
ru
ru
3. Transactions
•Transaction represents an interaction between
parties.
•With cryptocurrencies,for example,a transaction
represents a transfer of the cryptocurrency between
blockchain network users.
•For business-to-business scenarios,a transaction
could be a way of recording activities occurring on
digital or physical assets

ru
Blockchain terminologies
● Transaction & blocks
o A transaction is a value transfer; a block is a
collection of transactions on the bitcoin
network, gathered into a block that are hashed
and added to the blockchain.
Image source: https://pplware.sapo.pt/informacao/monero-

xmr-uma-moeda-segura-privada-e-sem-rasto/
ru
ru
ru
ru
ru
2. Asymmetric Key Cryptography

ru
4.Addresses and Address Derivation:
•Some blockchain networks make use of an
address,which is a short,alphanumeric string of
characters derived from the blockchain network user’s
publickey using a cryptographic hash function,a long with
some additional data(e.g.,version number,checksums).
•Most blockchain implementations make use of addresses
as the “to” and “from” endpoints in a transaction.
•These Addresses are shorter than the public keys and are
not secret.
•One method to generate an address is to create a public
key, applying a cryptographic hash function to it, and
converting the hash to text:
•public key cryptographic hash function address
ru
•Each blockchain implementation may implement a different
method to derive an address.
•For permissionless blockchain networks,which allow anonymous
account creation,a blockchain network user can generate as many
asymmetric keypairs,and therefore addresses as desired, allowing
for a varying degree of pseudo-anonymity.
•Addresses may act as the public-facing identifier in a blockchain
network for a user, and often times an address will be converted in
to a Qrcode
5.PrivateKey Storage:
•Users must manage and securely store their own private keys
•Instead of recording them manually, they often use software to
securely store them.
•This software is often referred to as a wallet.

ru
ru
ru
https://www.oreilly.com/library/view/
mastering-bitcoin/9781491902639/
ch04.html

ru
ru
•The wallet can store private keys, public keys, and associated
addresses.
•It may also perform other functions, such as calculating the total
number of digital assets a user may have.
•If a user loses a private key, then any digital asset associated with
that key is lost, because it is computationally infeasible to
regenerate the same private key.
•If a private key is stolen, the attacker will have full access to all
digital assets controlled by that private key
6. Ledgers
•It is a collection of transactions
•Throughout history, pen and paper ledgers have been used to
keep track of the exchange of goods and services.
•In modern times, ledgers have been stored digitally, often in large
databases owned and operated by a centralized trusted third party
ru
Difference between Centrally Owned Ledger and Block Chain
Network
•Centrally owned ledgers may be lost or destroyed; a user must trust
that the owner is properly backing up the system
•A blockchain network is distributed by design, creating many
backup copies all updating and syncing to the same ledger data
between peers
•Centrally owned ledgers maybe on a homogeneous network,where
all software, hardware and network infrastructure may be the
same.Because of this characteristic,the overall system resiliency may
be reduced
•Blockchain network is a heterogeneous network,where the
software,hardware and network infrastructure are all
different.Because of the many differences between nodes on the
blockchain network,an attack on one node is not guaranteed to work
on other nodes Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu
ru
•Centrally owned ledgers may be located entirely in specific
geographic locations(e.g.,allinonecountry). If network outages were
to occur in that location,the ledger and services which depend on it
may not be available.
•A blockchain network can be comprised of geographically diverse
nodes which maybe found around the world.Because of this,and
the blockchain network working in a peer-to-peer fashion,it is
resilient to the loss of any node,or even an entire region of nodes.
•The transactions on a centrally owned ledger are not made
transparently and may not be valid; a user must trust that the
owner is validating each received transaction.
•A blockchain network must check that all transactions are valid;if a
malicious node was transmitting invalid transactions,others would
detect and ignore them,preventing the invalid transactions from
propagating through out the blockchain network
ru
•The transaction list on a centrally owned ledger may not be
complete; a user must trust that the owner is including all valid
transactions that have been received.
A blockchain network holds all accepted transactions within its
distributed ledger. To build a new block, a reference must be made
to a previous block –therefore building on top of it. If a publishing
node did not include a reference to the latest block, other nodes
would reject it.
•The transaction data on a centrally owned ledger may have been
altered; a user must trust that the owner is not altering past
transactions
•A blockchain network utilizes cryptographic mechanisms such as
digital signatures and cryptographic hash functions to provide
tamper evident and tamper resistant ledgers

ru
7. Blocks
8. Chaining of Blocks Blocks are chained together through each
block containing the hash digest of the previous block’s header,thus
forming the blockchain.
If a previously published block were changed, it would have a
different hash.
This inturn would cause all subsequent blocks to also have different
hashes since they include the hash of the previous block.
This makes it possible to easily detect and reject altered blocks

ru
ru
ru
ru
Blockchain terminologies
Source: https://ccl.yale.edu/sites/default/files/files/A%20Brief
%20Introduction%20to%20Blockchain%20(Final%20without
%20Notes).pdf
● Distributed ledger – How it works?
Users Nodes
One or
initiate Users aggrega
more
transac Broadc te
Nodes
tions ast validat
begin
using their ed
validati
their transac transac
ng each
Digital tions to tions
transac
Signatu Nodes into
tion
res Blocks
Block
reflecti
Nodes ng
Broadc Consen “true
ast sus state”
Blocks protoco is
to each l used chaine
other d to
prior
Block
To determine whether your use case is a good fit for
blockchain, ask yourself these questions:
Is a business network involved?

Is consensus used to validate transactions?
Is an audit trail, or provenance, required?
Must the record of transactions be immutable, or tamper
proof?
Should dispute resolution be final?
If you answered yes to the first question and to at least one

other, then your use case would benefit from blockchain
technology.
https://developer.ibm.com/series/code-
pattern-series-build-your-first-blockchain-
application/

Unit 2 - BC

Uploaded by

Copyright:

Available Formats

You might also like

Unit 2 - BC

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Unit 2 - BC

Uploaded by

Copyright:

Available Formats

Dr Prasanna B T

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Image source: https://pplware.sapo.pt/informacao/monero-

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Dr Prasanna B T, Assoc Prof, CSE,SJCE, Mysu

Is a business network involved?

If you answered yes to the first question and to at least one

You might also like