Blockchains and other public ledger structures promise a new way to create globally consistent event logs and other records. We make use of this consistency property to detect and prevent man-in-the-middle attacks in a key exchange such as Diffie-Hellman or ECDH. Essentially, the MitM attack creates an inconsistency in the world views of the two honest parties, and they can detect it with the help of the ledger. Thus, there is no need for prior knowledge or trusted third parties apart from the distributed ledger. To prevent impersonation attacks, we require user interaction. It appears that, in some applications, the required user interaction is reduced in comparison to other user-assisted key-exchange protocols.
The XRP Ledger (XRPL) is a peer-to-peer cryptographic ledger. It features a decentralized exchange (DEX) where network participants can issue and trade user-defined digital assets and currencies. We present Jack the Rippler, a bot that identifies and exploits arbitrage opportunities on the XRPL DEX. We describe Jack's arbitrage process and discuss risks associated with using arbitrage bots.
Satoshi Nakamoto's Blockchain allows to build publicly verifiable and almost immutable ledgers, but sometimes privacy has to be factored in. In this work an original protocol is presented that allows sensitive data to be stored on a ledger where its integrity may be publicly verified, but its privacy is preserved and owners can tightly manage the sharing of their information with efficient revocation.
There has recently been a flood of interest in potential new applications of blockchains, as well as proposals for more generic designs called public ledgers. Most of the novel proposals have been in the financial sector. However, the public ledger is an abstraction that solves several of the fundamental problems in the design of secure distributed systems: global time in the form of a strict linear order of past events, globally consistent and immutable view of the history, and enforcement of some application-specific safety properties. This paper investigates the applications of public ledge…
Owing to Satoshi Nakamoto's brilliant idea, a P2P public ledger is shown to be implementable in anonymous network. Any Internet user can then join the anonymous network and contribute to the P2P public ledger by providing their computing power or proof-of-work. The proof-of-work is a clever implementation of one-CPU-one-vote by anonymous participants, and it protects the Bitcoin ledger from illegal modification. To compensate the nodes for their work, a cryptocurrency called Bitcoin is issued and given to nodes. However, the very nature of anonymity of the ledger and the cryptocurrency prevent…
Payment systems are a critical component of everyday life in our society. While in many situations payments are still slow, opaque, siloed, expensive or even fail, users expect them to be fast, transparent, cheap, reliable and global. Recent technologies such as distributed ledgers create opportunities for near-real-time, cheaper and more transparent payments. However, in order to achieve a global payment system, payments should be possible not only within one ledger, but also across different ledgers and geographies. In this paper we propose Secure Payments with Overlay Networks (SPON), a ser…
Bitcoin brings a new type of digital currency that does not rely on a central system to maintain transactions. By benefiting from the concept of decentralized ledger, users who do not know or trust each other can still conduct transactions in a peer-to-peer manner. Inspired by Bitcoin, other cryptocurrencies were invented in recent years such as Ethereum, Dash, Zcash, Monero, Grin, etc. Some of these focus on enhancing privacy for instance crypto note or systems that apply the similar concept of encrypted notes used for transactions to enhance privacy (e.g., Zcash, Monero). However, there are …
Public blockchains provide a decentralized method for storing transaction data and have many applications in different sectors. In order for users to track transactions, a simple method is to let them keep a local copy of the entire public ledger. Since the size of the ledger keeps growing, this method becomes increasingly less practical, especially for lightweight users such as IoT devices and smartphones. In order to cope with the problem, several solutions have been proposed to reduce the storage burden. However, existing solutions either achieve a limited storage reduction (e.g., simple pa…
A public ledger is a tamperproof sequence of data that can be read and augmented by everyone. Public ledgers have innumerable and compelling uses. They can secure, in plain sight, all kinds of transactions ---such as titles, sales, and payments--- in the exact order in which they occur. Public ledgers not only curb corruption, but also enable very sophisticated applications ---such as cryptocurrencies and smart contracts. They stand to revolutionize the way a democratic society operates. As currently implemented, however, they scale poorly and cannot achieve their potential. Algorand is a trul…
The decentralized exchange (DEX) leverages smart contracts to trade digital assets for users on the blockchain. Developers usually develop several smart contracts into one project, implementing complex logic functions and multiple transaction operations. However, the interaction among these contracts poses challenges for developers analyzing the state logic. Due to the complex state logic in DEX projects, many critical state derailment defects have emerged in recent years. In this paper, we conduct the first systematic study of state derailment defects in DEX. We define five categories of stat…
Model-based Systems Engineering (MBSE) has been widely utilized to formalize system artifacts and facilitate their development throughout the entire lifecycle. During complex system development, MBSE models need to be frequently exchanged across stakeholders. Concerns about data security and tampering using traditional data exchange approaches obstruct the construction of a reliable marketplace for digital assets. The emerging Distributed Ledger Technology (DLT), represented by blockchain, provides a novel solution for this purpose owing to its unique advantages such as tamper-resistant and de…
Distributed ledger and blockchain systems are expected to make financial systems easier to audit, reduce counter-party risk and transfer assets seamlessly. The key concept is a token controlled by a cryptographic private key for spending, and represented by a public key for receiving and audit purposes. Ownership transfers are authorized with digital signatures and recorded on a ledger visible to numerous participants. Several ways to enhance the privacy of such ledgers have been proposed. In this paper we study two major techniques to enhance privacy of token transfers with the help of improv…
Authentication with username and password is becoming an inconvenient process for the user. End users typically have little control over their personal privacy, and data breaches effecting millions of users have already happened several times. We have implemented a proof of concept decentralized OpenID Connect Provider by marrying it with Self-Sovereign Identity, which gives users the freedom to choose from a very large pool of identity providers instead of just a select few corporations, thus enabling the democratization of the highly centralized digital identity landscape. Furthermore, we pr…
A core enabler for blockchain or DLT interoperability is the ability to atomically exchange assets held by mutually untrusting owners on different ledgers. This atomic swap problem has been well-studied, with the Hash Time Locked Contract (HTLC) emerging as a canonical solution. HTLC ensures atomicity of exchange, albeit with caveats for node failure and timeliness of claims. But a bigger limitation of HTLC is that it only applies to a model consisting of two adversarial parties having sole ownership of a single asset in each ledger. Realistic extensions of the model in which assets may be joi…
We present Airtnt, a novel scheme that enables users with CPUs that support Trusted Execution Environments (TEEs) and remote attestation to rent out computing time on secure enclaves to untrusted users. Airtnt makes use of the attestation capabilities of TEEs and smart contracts on distributed ledgers to guarantee the fair exchange of the payment and the result of an execution. Airtnt makes use of off-chain payment channels to allow requesters to pay executing nodes for intermediate "snapshots" of the state of an execution. Effectively, this step-by-step "compute-payment" cycle realises untrus…
Exchange of secret keys over public channels based on neural synchronization using a variety of learning rules offer an appealing alternative to number theory based cryptography algorithms. Though several forms of attacks are possible on this neural protocol e.g. geometric, genetic and majority attacks, our survey finds that deterministic algorithms that synchronize with the end-point networks have high time complexity, while probabilistic and population-based algorithms have demonstrated ability to decode the key during its exchange over the public channels. Our survey also discusses queries,…
A Post-Quantum Key Exchange is needed since the availability of quantum computers that allegedly allow breaking classical algorithms like Diffie-Hellman, El Gamal, RSA and others within a practical amount of time is broadly assumed in literature. Although our survey suggests that practical quantum computers appear to be by far less advanced as actually required to break state-of-the-art key negotiation algorithms, it is of high scientific interest to develop fundamentally immune key negotiation methods. A novel polymorphic algorithm based on permutable functions and defined over the field of r…
Cryptocurrency exchanges are frequently targeted and compromised by cyber-attacks, which may lead to significant losses for the depositors and closure of the affected exchanges. These risks threaten the viability of the entire public blockchain ecosystem since exchanges serve as major gateways for participation in public blockchain technologies. In this paper, we develop an economic model to capture the short-term incentives of cryptocurrency exchanges with respect to making security investments and establishing transaction fees. Using the model, we derive conclusions regarding an exchange's o…
This paper presents a new fast public key cryptosystem namel : a key exchange algorithm, a public key encryption algorithm and a digital signature algorithm, based on the difficulty to invert the following function: $$F(x) =(a\times x)Mod(2^p)Div(2^q).$$ Mod is modulo operation , Div is integer division operation , a , p and q are integers where $( p > q )$. We define p and q values for which ModDiv2Inv can be the hardest. We then present ModDiv2Kex, a new fast key exchange algorithm based on ModDiv2Inv. In this paper we also evaluate the hardness of this problem by reducing it to SAT .
We show that a linear decomposition attack based on the decomposition method introduced by the author works by finding the exchanged secret keys in all main protocols using semidirect products of (semi)grops proposed by Kahrobaei, Shpilrain, Habeeb, Koupparis and Lam.
Astroturfing, i.e., the fabrication of public discourse by private or state-controlled sponsors via the creation of fake online accounts, has become incredibly widespread in recent years. It gives a disproportionally strong voice to wealthy and technology-savvy actors, permits targeted attacks on public forums and could in the long run harm the trust users have in the internet as a communication platform. Countering these efforts without deanonymising the participants has not yet proven effective; however, we can raise the cost of astroturfing. Following the principle `one person, one voice', …
We use matrices over bit strings as platforms for Diffie-Hellman-like public key exchange protocols. When multiplying matrices like that, we use Boolean OR operation on bit strings in place of addition and Boolean AND operation in place of multiplication. As a result, (1) computations with these matrices are very efficient; (2) standard methods of attacking Diffie-Hellman-like protocols are not applicable.
We offer a public key exchange protocol in the spirit of Diffie-Hellman, but we use (small) matrices over a group ring of a (small) symmetric group as the platform. This "nested structure" of the platform makes computation very efficient for legitimate parties. We discuss security of this scheme by addressing the Decision Diffie-Hellman (DDH) and Computational Diffie-Hellman (CDH) problems for our platform.
FLEDGE: Ledger-based Federated Learning Resilient to Inference and Backdoor Attacks
The University of Texas Rio Grande Valley（德克萨斯大学里奥格兰德谷分校）；Technical University of Darmstadt（达姆施塔特工业大学）；KOBIL GmbH（KOBIL有限公司）；The University of Texas at San Antonio（德克萨斯大学圣安东尼奥分校）
Bitcoins have recently become an increasingly popular cryptocurrency through which users trade electronically and more anonymously than via traditional electronic transfers. Bitcoin's design keeps all transactions in a public ledger. The sender and receiver for each transaction are identified only by cryptographic public-key ids. This leads to a common misconception that it inherently provides anonymous use. While Bitcoin's presumed anonymity offers new avenues for commerce, several recent studies raise user-privacy concerns. We explore the level of anonymity in the Bitcoin system. Our approac…
General cryptographic schemes are presented where keys can be one-time or ephemeral. Processes for key exchange are derived. Public key cryptographic schemes based on the new systems are easily established. Authentication and signature schemes are implemented. The schemes are an advance on group ring techniques and are easily implemented but highly secure. They may be integrated with error-correcting coding schemes so that encryption/coding and decryption/decoding may be done simultaneously.
Xinyu et al. proposed a public key exchange protocol, which is based on the NTRU-lattice based cryptography. In this paper, we show how Xinyu et al.'s NTRU-KE: A lattice based key exchange protocol can be broken, under the assumption that a man-in-the middle attack is used for extracting private keys of users who participate in the key exchange protocol.
In this paper, we describe a brand new key exchange protocol based on a semidirect product of (semi)groups (more specifically, on extension of a (semi)group by automorphisms), and then focus on practical instances of this general idea. Our protocol can be based on any group, in particular on any non-commutative group. One of its special cases is the standard Diffie-Hellman protocol, which is based on a cyclic group. However, when our protocol is used with a non-commutative (semi)group, it acquires several useful features that make it compare favorably to the Diffie-Hellman protocol. Here we al…
In this paper, we propose to use a twisted dihedral group algebra for public-key cryptography. For this, we introduce a new $2$-cocycle $α_λ$ to twist the dihedral group algebra. Using the ambient space $\mathbb{F}^{α_λ} D_{2n}$, we then introduce a key exchange protocol and present an analysis of its security. Moreover, we explore the properties of the resulting twisted algebra $\mathbb{F}^{α_λ}D_{2n}$, exploiting them to enhance our key exchange protocol. We also introduce a probabilistic public-key scheme derived from our key-exchange protocol and obtain a key encapsulation mechanism (KEM) …
In this paper, we propose to use a skew dihedral group ring given by the group $D_{2n}$ and the finite field $\mathbb{F}_{q^2}$ for public-key cryptography. Using the ambient space $\mathbb{F}_{q^{2}}^θ D_{2n}$ and a group homomorphism $θ: D_{2n} \rightarrow \mathrm{Aut}(\mathbb{F}_{q^2})$, we introduce a key exchange protocol and present an analysis of its security. Moreover, we explore the properties of the resulting skew group ring $\mathbb{F}_{q^{2}}^θ D_{2n}$, exploiting them to enhance our key exchange protocol. We also introduce a probabilistic public-key scheme derived from our key exc…
The number of embedded devices that connect to a wireless network has been growing for the past decade. This interaction creates a network of Internet of Things (IoT) devices where data travel continuously. With the increase of devices and the need for the network to extend via fog computing, we have fog-based IoT networks. However, with more endpoints introduced to it, the network becomes open to malicious attackers. This work attempts to protect fog-based IoT networks by creating a platform that secures the endpoints through public-key encryption. The servers are allowed to mask the data pac…
We consider a coded cooperative data exchange problem with the goal of generating a secret key. Specifically, we investigate the number of public transmissions required for a set of clients to agree on a secret key with probability one, subject to the constraint that it remains private from an eavesdropper. Although the problems are closely related, we prove that secret key generation with fewest number of linear transmissions is NP-hard, while it is known that the analogous problem in traditional cooperative data exchange can be solved in polynomial time. In doing this, we completely characte…
In the papers by Alvarez et al. and Pathak and Sanghi a non-commutative based public key exchange is described. A similiar version of it has also been patented (US7184551). In this paper we present a polynomial time attack that breaks the variants of the protocol presented in the two papers. Moreover we show that breaking the patented cryptosystem US7184551 can be easily reduced to factoring. We also give some examples to show how efficiently the attack works.
Constant function market makers (CFMMs) such as Uniswap, Balancer, Curve, and mStable, among many others, make up some of the largest decentralized exchanges on Ethereum and other blockchains. Because all transactions are public in current implementations, a natural next question is if there exist similar decentralized exchanges which are privacy-preserving; i.e., if a transaction's quantities are hidden from the public view, then an adversary cannot correctly reconstruct the traded quantities from other public information. In this note, we show that privacy is impossible with the usual implem…
