bitcoin final

Recommendations

Info

Bitcoin: risk factors for insurance 10Blockchain.info, for example, is an online servicethat helps users secure their bitcoins. However,Blockchain.info never actually learns or holds thekeys that its customers utilise to prove their controlover Bitcoin holdings 29 .Blockchain.info builds and continually updatesa software wallet program that can be used by acustomer to store keys. They help the user configurethis software and allow the user to generate Bitcoinaddresses (for receiving funds) matched to privatekeys. The generation of these keys occurs on theuser’s local computer and, afterwards, the walletprogram along with its new keys is encrypted sothat it is unreadable. This encrypted file is storedon Blockchain.info’s servers as a back-up in casethe user’s computer is lost or damaged. Becauseof encryption, at no point can Blockchain.infoemployees or any unauthorised parties lurking ontheir servers see the keys unencrypted. By neverhandling unencrypted customer keys, the risk of keyloss is mitigated. As we will see in the next section,however, other risks may remain.Global threatsThese attacks may be called global because they targetnot the particular servers of the exchange or anythingonsite, but, instead, the protocol and ledger with whichany exchange must interact. This analysis focuses onsix key modes of global attack: flawed key generation;transaction malleability; 51% attacks; “Sybil” attacks;distributed denial of service attacks; and “consensus” or“fork” risk.Capability1. Flawed key generationAll Bitcoin holdings are associated with publicaddresses on the blockchain, each with acorresponding private key. Think of the private keyas a password required to spend the funds in theaddress. Both the key and the public address appearas highly random, uncorrelated and unique stringsof characters. For example, here are two linked keysgenerated using an Elliptic Curve Digital SignatureAlgorithm (ECDSA) 30 :Private Key:e6edcf30220499bd034a7f4ebbadd4d62c8995c01157067983b4f1f26b58111Public Key:0488ff723a55ae8f46d9decf66c10a249adb59ac91195adee879ecb5944ea7f5098dd9e193c2172047e6eacb6ddd524c77ee5669b2f69bbfb27fc03d717d657195The two strings are, in fact, provably linked by themathematical formula used to generate them. It isprobabilistically impossible to guess a private key bysimply knowing the corresponding public key, butit is trivially easy for a computer to check that twokeys are, in fact, linked. This is known in computerscience as a one-way function, a broad class oftechnical tools that form the basis for all securecommunications technology.These mathematical properties allow for digitalsignatures and verifiable messaging online. Tosend such a message, a person would first publiclyannounce her public key. Then she would take theprivate key and run it through a mathematicaloperation called a hash function along with themessage she wishes to sign. The output of that hashis called a digital signature. Anyone who sees theoutput can know with certainty that only the personwith both the public and private keys could havesigned the message. The observer, however, doesnot learn the private key throughout this process ofvalidation; therefore she can verify but not forge theidentity of the sender.A Bitcoin public address is an ECDSA public keythat has been mathematically transformed withhash functions in order to provide a shorter stringof characters to which network participants cansend funds 31 . The particular operation of equationsinvolved in this set-up is beyond the scope of thisreport. Suffice it to say, however, that ECDSA andthe associated hash functions are industry stateof-the-arttools for key generation and messageencryption across the internet 32 .One can, however, fail to implement these toolscorrectly when generating keys and addresses.If there is a faulty implementation, the keysgenerated may not be sufficiently random and, giventhe public address, a malicious party could be ableto guess the private key, at which point they wouldbe able to sign transactions and transfer funds out ofthe public address.This happened in December 2014 to hybrid walletprovider Blockchain.info 33 . A mistake was madeduring a software update, and when an affecteduser generated a new key pair on her local machineusing Blockchain’s software (recall that as a hybridwallet provider Blockchain.info does not know itscustomers’ keys, but rather gives them software togenerate those keys locally and stores encryptedversions in the cloud), inputs to the ECDSAalgorithm were not sufficiently random so as togenerate an effective one-way function. As a result,Lloyd’s Emerging Risk Report – 2015
Bitcoin: risk factors for insurance 11a thief could use software to determine the user’sprivate key merely by looking at the public address.Only a very small fraction (0.0002%) of users wereaffected, and the issue was detected and resolvedwithin two-and-a-half hours 34 . Even given thisshort time frame, individuals outside of Blockchain.info observed the vulnerability. As a result, somebitcoins were stolen. Again, the public character ofthe Bitcoin ledger is the reason for this quickness.Individuals can, and do, watch addresses as theyappear on the public ledger in real time. They canbuild computer programs that sit and wait forobservable weaknesses in address generation, andeven steal funds as soon as those weaknesses aredetected. In Blockchain.info’s case, the “thief ”turned out to be a German computer scienceresearcher, and frequent contributor to Bitcoincommunity online discussion forums, where heis known as Johoe. Johoe returned the funds andhelped point out the implementation weaknessesthat caused the hack 35 .2. Transaction malleabilityIn a transaction malleability attack the thief tricksher target into believing that a transaction hasfailed. The thief then asks for the transaction to berepeated. In this manner a thief who was alreadyowed X bitcoins could fraudulently obtain twice theamount 36 .The deception is created by altering a transactionrequest as it is sent through the peer-to-peer Bitcoinnetwork. Some malformed transaction messages canbe corrected by intermediary parties in the chain ofpeer-to-peer message exchange. That change maymake the transaction difficult to recognise, evento the original sender, and she may, instead, thinkthat the message failed to go through. If a targetedinstitution is careless about how it verifies that atransaction has either succeeded or failed to berecorded in the blockchain, it may unwittingly senda second transaction when the thief claims that thefirst transaction did not go through. The thief willhave doubled her money.To be clear, this particular attack relies on socialengineering, not mere technological manipulation.An individual at the institution must be contactedand persuaded to re-send funds that allegedly failedto be transferred in an initial request.Mt. Gox blamed its insolvency on this particularattack, but this has been challenged by many in theBitcoin community as the scale of theft would haverequired hackers to repeatedly convince customerservice personnel at Mt. Gox that their transactionshad failed and needed to be reinitiated. Moreover,by careful monitoring of the transaction messagesand tracing the outputs of a transaction, all withpublicly available information on the blockchain,the attack is avoidable 37 .Blockchain technologies can also be employedto improve internal accounting and auditing.Accounting software can be run by the business asan integrated part of the business’s consumer-facingapplications. It can be programmed to interactwith the Bitcoin protocol, placing limits on anysuspicious requests that could indicate a transactionmalleability hack or some other wrong-doing. Thesoftware can also be programmed to automaticallygenerate human-readable double-entry accountingrecords or other visualisation tools in real time, sothat the institution can always have a good senseof which transactions have succeeded, which havefailed, and what is the general state of the business.3. Fifty-one per cent attackA 51% attack involves manipulation of theblockchain itself rather than the protocol thatfacilitates communication between users andminers. Each block added to the blockchaindescribes the transactions verified in roughly theprevious 10 minutes. Miners compete for theprivilege to write the next block and receive amining reward of new bitcoins. To fraudulentlymanipulate the blockchain, an attacker would needto consistently out-compete all other miners bywielding a majority of the global computing powerspent mining bitcoins.The prospect of a single individual or small group ofindividuals obtaining such mining power is highlyremote because the cost would grossly exceed thelikely benefits of such an attack. The recent adventof large mining pools increases the likelihoodthat an organised group of miners could maintaina majority of computing power long enough tomanipulate the blockchain 38 . However, it is notconsidered likely that a 51% attack would pose amajor risk of loss or theft.A successful 51% attack could prevent a targetedactor from engaging in new transactions, mightallow the dishonest miners to demand exorbitanttransaction fees, or allow them to shut down thenetwork entirely by processing no new transactions.Attackers, however, would never be able to rewritethe blockchain’s history in order to steal fundsalready listed in a target actor’s public addresses.If a 51% attack were to be successfully carried out, itwould be a significant blow to consumer confidencein the stability and trustworthiness of Bitcoin.Lloyd’s Emerging Risk Report – 2015
Page 1 and 2: Emerging Risk Report - 2015Innovati
Page 3 and 4: Contents1 Executive summary 022 Int
Page 5 and 6: Lloyd’s Emerging Risk Report - 20
Page 9 and 10: Bitcoin: risk factors for insurance
Page 11: Bitcoin: risk factors for insurance

bitcoin final

Create successful ePaper yourself

Delete template?

Save as template?