A blockchain is redactable if a private key holder (e.g. a central authority)
can change any single block without violating integrity of the whole
blockchain, but no other party can do that. In this paper, we offer a simple
method of constructing redactable blockchains inspired by the ideas underlying
the well-known RSA encryption scheme. Notably, our method can be used in
conjunction with any reasonable hash function that is used to build a
blockchain. Public immutability of a blockchain in our construction is based on
the computational hardness of the RSA problem and not on properties of the
underlying hash function. Corruption resistance is based on the computational
hardness of the discrete logarithm problem.Comment: 5 page

Grigoriev, Dima

Shpilrain, Vladimir

English

arXiv

A blockchain is redactable if a private key holder (e.g. a central authority) can change any single block without violating integrity of the whole blockchain, but no other party can do that. In this paper, we offer a simple method of constructing redactable blockchains inspired by the ideas underlying the well-known RSA encryption scheme. Notably, our method can be used in conjunction with any reasonable hash function that is used to build a blockchain. Public immutability of a blockchain in our construction is based on the computational hardness of the RSA problem and not on properties of the underlying hash function. Corruption resistance is based on the computational hardness of the discrete logarithm problem

Dima Grigoriev

Vladimir Shpilrain

Cryptology ePrint Archive

RSA AND REDACTABLE BLOCKCHAINSDIMA GRIGORIEV AND VLADIMIR SHPILRAINABSTRACT. A blockchain is redactable if a private key holder (e.g. a central authority) can change anysingle block without violating integrity of the whole blockchain, but no other party can do that. In thispaper, we offer a simple method of constructing redactable blockchains inspired by the ideas underlying thewell-known RSA encryption scheme. Notably, our method can be used in conjunction with any reasonablehash function that is used to build a blockchain. Public immutability of a blockchain in our constructionis based on the computational hardness of the RSA problem and not on properties of the underlying hashfunction. Corruption resistance is based on the computational hardness of the discrete logarithm problem.1. INTRODUCTIONA blockchain is a distributed database that is used to maintain a continuously growing list of records,called blocks. Each block contains a link to the previous (or the next) block. A blockchain is typicallymanaged by a peer-to-peer network collectively adhering to a protocol for validating new blocks. Bydesign, blockchains are inherently resistant to modification of the data. Once recorded, the data in anygiven block cannot be altered retroactively without the alteration of all preceding (or subsequent) blocksand a collusion of the network majority.A blockchain can be either public or private. Usually, when people talk about public blockchains,they mean that anyone can write data. A typical example of a public blockchain is bitcoin. In contrast,a private blockchain network is where the participants are known and trusted: for example, an industrygroup, or a military unit, or in fact any private network, big or small. In particular, what is now calledby a popular name The Internet of things is a good example of a private network where the blockchaintechnology could be very useful. The Internet of things (IoT) is the inter-networking of physical devices(also referred to as “smart devices”), e.g. vehicles, or buildings, or other items embedded with elec-tronics, software, sensors, and network connectivity which enable these objects to collect and exchangedata. The world of IoT is quickly evolving and growing at an exponential rate. Experts estimate that theIoT will consist of about 30 billion objects by 2020.Concerns have been raised that the Internet of things is being developed rapidly without appropriateconsideration of the profound security challenges involved. Most of the technical security issues aresimilar to those of conventional servers, workstations and smartphones, but the firewall, security updateand anti-malware systems used for those are generally unsuitable for the much smaller, less capable,IoT devices. In particular, computer-controlled devices in vehicles such as brakes, engine, locks, etc.,have been shown to be vulnerable to attackers who have access to the on-board network. In some cases,vehicle computer systems are Internet-connected, allowing them to be exploited remotely.Blockchain technology would provide at least a partial solution to these security problems.1.1. Immutable and redactable blockchains. The role of hash functions in a blockchain is similar tothat of page numbering in a book. There is, however, an important difference. With books, predictablepage numbers make it easy to know the order of the pages. If you ripped out all the pages and shuffledthem, it would be easy to put them back into the correct order where the story makes sense. Withblockchains, each block references the previous (or the next) block, not by the block number, but by the12 RSA AND REDACTABLE BLOCKCHAINSblock’s hash function (the “fingerprint”), which is smarter than a page number because the fingerprintitself is determined by the contents of the block.By using a fingerprint instead of a timestamp or a numerical sequence reflecting the block number,one also gets a nice way of validating the data. In any blockchain, you can generate the block fingerprintsyourself by using the corresponding hashing algorithm. If the fingerprints are consistent with the data,and the fingerprints join up in a chain, then you can be sure that the blockchain is internally consistent.There are several ways to securely join blocks in a chain. One of the ways is, informally, as follows.Every block Bi has a prefix, which is the hash (or, more generally, a one-way function) of the fingerprintH(Bi−1) of the previous block Bi−1. If anyone wants to meddle with any of the data, they would have toregenerate all the fingerprints from that point forwards and the blockchain will look different.A blockchain is immutable if, once data has been written to a blockchain no one, not even a centralauthority (e.g. a system administrator), can change it. This provides benefits for audit. As a provider ofdata you can prove that your data has not been altered, and as a recipient of data you can be sure that thedata has not been altered. These benefits are useful for databases of financial transactions, for example.On the other hand, with a private blockchain, someone with higher privileged access, like a systemsadministrator, may be able to change the data. So how do we manage the risk of an intruder chang-ing data to his advantage if changing is made easy? The answer to that is provided by redactableblockchains; these should involve hash functions with a trapdoor or, more generally, one-way functionswith a trapdoor. Trapdoor hash functions are a highly useful cryptographic primitive; in particular, itallows an authorized party to compute a collision with a given hash value, even though the hash func-tion is second pre-image resistant to those who do not know a trapdoor. This property is therefore veryuseful in application to private blockchains since it makes it possible for an authorized party but not foran intruder to make changes in a blockchain if needed. We give more details in Section 2.The need for a blockchain (even a public one!) to be redactable is well explained in [5]: “Thatpermanence has been vital in building trust in the decentralized currencies, which are used by millionsof people. But it could severely limit blockchain’s usefulness in other areas of financial services relied onby billions of people. By clashing with new privacy laws like the “right to be forgotten” and by makingit nearly impossible to resolve human error and mischief efficiently, the blockchain’s immutability couldend up being its own worst enemy.”2. REDACTABLE BLOCKCHAIN STRUCTURERecall that a blockchain is immutable if, once data has been written to a blockchain no one, noteven a central authority, can change it. This is achieved by using a hash function H to “seal” eachindividual block, i.e., each block Bi has a fingerprint H(Bi), and then connecting blocks in a chain byusing another hash function (or just a one-way function) G, as described in our Section 1.1. That way,the blocks Bi become connected in an immutable blockchain because if somebody tampers with oneof the blocks and changes it, he will have to change all blocks going forward (or backward), togetherwith their fingerprints, to preserve consistency of the whole blockchain. This is considered logisticallyinfeasible in most real-life scenarios.Originally, blockchains were created to support the bitcoin network, which is public. Immutabilityfor such a network is crucial. More recently, as we have pointed out in the Introduction, with the idea ofthe Internet of Things gaining momentum, private networks (small or large) have taken the center stage,and this creates new challenges. In particular, it is desirable, while preserving the tampering detectionproperty, to allow someone with higher privileged access like a systems administrator or another author-ity to be able to change the data or erase (“forget”) it [12]. A blockchain that can be changed like that iscalled redactable.RSA AND REDACTABLE BLOCKCHAINS 3To make a blockchain redactable, trapdoor hash functions are useful. Trapdoor hash functions havebeen considered before (see e.g. [15]), but having just any trapdoor hash function is not enough to makea blockchain redactable since the authority who wants to change a block B usually wants to change it toa particular block B′. A way to make a blockchain redactable was first suggested in [1]. Recently, [4]claimed the first efficient redactable public blockchain construction. We also mention chameleon hashfunctions [9] that were recently used [3], [10] in redactable blockchain constructions.Our approach is focused on private blockchains. It is quite different from [1], [4] and other methodsand is simple and easily implementable. Notably, our method can be used in conjunction with anyreasonable hash function that is used to build a blockchain. Public immutability of a blockchain (seeSection 3.3) in our construction is based on the computational hardness of the RSA problem and noton properties of the underlying hash function. Corruption resistance (see Section 3.4) is based on thecomputational hardness of the discrete logarithm problem.2.1. A particular blockchain structure we use. There are several possible structures of a redactableblockchain. Our general method should work with any known structure, but to make an exposition asclear as possible we choose a very simple structure as follows. Each block Bi will be in 3 parts: apermanent prefix Pi, the actual content Ci, and a redactable suffix Xi. There is also a hash hi = H(Pi,Ci),where H is a public hash function, and a public one-way function F such that F(hi,Xi) = Pi+1. Tomake such a blockchain redactable, a central authority should have a private key that would allow forreplacing Ci with an arbitrary C′i of his/her choice, so that upon a suitable selection of the new suffix X′i ,the equality F(h′i,X′i ) = Pi+1 would still hold.Instead of having the prefix of Bi+1 depend on the block Bi, one can have the prefix of Bi−1 dependon Bi, in which case the integrity check will have the form F(hi,Xi) = Pi−1. Our method, with minormodification, works with this structure just as well.We emphasize again that the hash function H and the one-way function F should be public sinceanyone should be able to create a new block in the chain as well as verify the integrity of the blockchain.3. AN RSA-BASED IMPLEMENTATIONA particular implementation of the general redactable blockchain structure described above is inspiredby the ideas underlying the well-known RSA encryption scheme [13] (see also [2], [7], [8] for laterdevelopments).Public information:– a large integer n, which is a product of two large primes– a hash function H, e. g. SHA-256. (We emphasize again that our method can be used with anyreasonable hash function, so the reader can replace SHA-256 here with his/her favorite hash function.)Private information:– prime factors of n = pq. These p and q should be safe primes (see e.g. [2]), as in modern imple-mentations of RSA. A safe prime is of the form 2r+1, where r is another prime.Block structure. In each block Bi, there will be a prefix Pi, the actual content Ci (e. g. a transactiondescription), and a suffix Xi, which is a nonzero integer modulo n. We also want Xi not to have order 2,i.e., X2i 6= 1 (mod n). Thus, whoever builds a block Bi, selects Xi at random on integers between 1 andn−1 and then checks if X2i 6= 1 (mod n). If X2i = 1 (mod n), random selection of Xi is repeated. Once aproper Xi is selected, a public hash function H (e. g. SHA-256) is applied to concatenation of Pi and Cito produce hi = H(Pi,Ci), and hi is then converted to an integer di modulo n. The prefix Pi+1 of the nextblock is then computed as Pi+1 = (Xi)di (mod n).4 RSA AND REDACTABLE BLOCKCHAINS3.1. Private redactability. Now suppose the central authority, Alice, who is in possession of the privatekey, wants to change the content of a block Bi from Ci to C′i but does not want to change any other block.Then Alice computes the hash h′i = H(Pi,C′i) and converts it to an integer d′i modulo n. The number d′ishould be relatively prime to φ(n), the Euler function of n. If it is not, then Alice should use a paddingto have d′i relatively prime to φ(n). Once it is, Alice finds the inverse e′i of d′i modulo φ(n). Then shecomputes X ′i = Pe′ii+1 (mod n). The integrity check now gives: (X′i )d′i = (Pe′ii+1)d′i = Pi+1 (mod n) becausee′id′i = 1 (mod φ(n)) and (Pi+1)φ(n) = 1 (mod n).3.2. Padding. Note that since n = pq, we have φ(n) = (p− 1)(q− 1). If d′i is not relatively prime toφ(n), this means that either (1) d′i is even, or (2) d′i is odd but is divisible by a large prime (recall that pand q are safe primes, i.e., p−12 andq−12 are primes). Thus, our padding is going to be as follows. Wewill add a random number of, say, 0 bits to the block C′i . Since the hash function H is assumed to passall standard statistical tests [14], with probability 12 the result of hashing will be a bit string that convertsto an odd integer d′i , and with very high probability this d′i is also going not to be divisible byp−12 orq−12 . Thus, after just a few attempts at padding as described above, we will get a d′i relatively prime toφ(n).3.3. Public immutability. As can be seen from the “Block structure” paragraph above, a party whowould like to change the content of a single block, would have to essentially solve the RSA problem:recover X from n, Xd (mod n), and d, where d is relatively prime to φ(n). This is considered computa-tionally infeasible for an appropriate choice of n and a random d, 0 < d < n.3.4. Corruption resistance. Another way of unauthorized modification of a block in a blockchain iscorruption, i.e., changing the content of the block to something meaningless. To do that, the intrudercan start with a random Xi and then look for a number di such that (Xi)di = Pi+1 (mod n), for a givenPi+1( (mod n)). The mathematical problem that the intruder would have to solve in this case is knownas the discrete logarithm problem and is considered computationally infeasible if n is sufficiently large.Two-step attack. If the hash function H used in our blockchain were not preimage-resistant enough,the following “two-step” corruption attack would be possible. Suppose the integrity condition is Pi+1 =(Xi)di (mod n), and suppose the attacker was able to find out that the block Bi was changed so that(Xi)di = (X ′i )d′i (mod n), and that the attacker got a hold of Xi,X ′i ,di, and d′i . We will now omit the indexi to make the following easier to read.The attacker can corrupt this block (i.e., change it to something meaningless) as follows. Generi-cally, g.c.d.(d,d′) = 1, so we may assume that there are a,b ∈ Zn such that da+ d′b = 1. Then X =((X ′)aXb)d′. Now if X ′′ = (X ′)aXb and d′′ = d′d, then (X ′′)d′′= ((X ′)aXb)d′d = (((X ′)aXb)d′)d = Xd .Thus, if the attacker can find another suffix, X ′′, and d′′ such that (X ′′)d′′= Xd , they can therefore corruptthe block Bi.The problem is, however, that d′′ should be the hash of something, i.e., the attacker will face anadditional problem of finding a preimage of d′′ under the hash function H.If preimage-resistance of the hash function H is a concern, the integrity condition is Pi+1 =(Xi)di (mod n)can be replaced by Pi+1 = (Xi)d2i +1 (mod n) for an extra layer of security.4. OTHER AUTHENTICATED DATA STRUCTURESA “chain”, or a path, is the simplest kind of a connected graph. This type is adequate and sufficientfor public data structures such as cryptocurrencies, except that in those, occasional “forks” may exist, inwhich case the underlying graph is a tree. Authenticated data structures built on trees were consideredRSA AND REDACTABLE BLOCKCHAINS 5before (see e.g. [11]), albeit not in the context of the present paper (i.e., not in terms of redactability).Here we explain how to make a data structure redactable if the underlying graph has a node of degreegreater than 2. The following procedure easily generalizes to an arbitrary underlying graph.Suppose three blocks B1, B2, and B3 are connected in a chain B1→ B2→ B3 as usual, but the block B2is also connected to another block B′, which means that in the underlying graph the node correspondingto the block B2 has degree 3. Suppose now a central authority wants to modify content of the block B2.If she follows our procedure from Section 3, she would have to find a suffix X ′2 for the block B2 such that(X ′2)d′22 +1 = P3 and at the same time (X ′2)d′22 +1 = P′, where P′ is the prefix of the block B′. This system ofequations will not have a solution if P3 6= P′. A way around this is introducing an “intermediate” blockBin between B2 and B′. The prefix of Bin will be the same as that of B3, i.e., equal to (X ′2)d′22 +1. Thecontent of Bin can just indicate that this block is intermediate, i.e., does not have any other function. Thesuffix Xin will be selected following the procedure in Section 3, i.e., so that Xd2in+1in = P3.Acknowledgement. Both authors are grateful to the Hausdorff Research Institute for Mathematics, Bonnfor its hospitality during the work on this project.REFERENCES1. G. Ateniese, B. Magri, D. Venturi, E. Andrade, Redactable blockchain – or – rewriting history in bitcoin and friends,in: 2017 IEEE European Symposium on Security and Privacy, INSPEC Accession Number: 17011479. (See also https://eprint.iacr.org/2016/757.pdf)2. J. Benaloh, Dense probabilistic encryption, First Ann. Workshop on Selected Areas in Cryptology, 1994, 120–128.3. D. Derler, K. Samelin, D. Slamanig, and C. Striecks, Fine-grained and controlled rewriting in blockchains: chameleon-hashing gone attribute-based, in: Network and Distributed Systems Security (NDSS 2019).4. D. Deuber, B. Magri, S. A. K. Thyagarajan, Redactable blockchain in the permissionless setting, in: 2019 IEEE Symposiumon Security and Privacy, 124–138. (See also https://arxiv.org/abs/1901.03206)5. Downside of bitcoin: A ledger that can’t be corrected, The New York Times, 2016. https://tinyurl.com/ydxjlf9e6. J. von zur Gathen, I. E. Shparlinski, Generating safe primes, J. Math. Cryptol. 7 (2013), 333–365.7. S. Goldwasser. S. Micali, Probabilistic encryption, J. Comput. Syst. Sci. 28 (1984), 270–299.8. D. Grigoriev, I. Ponomarenko, Homomorphic public-key cryptosystems and encrypting Boolean circuits, Appl. AlgebraEngrg. Comm. Comput. 17 (2006), 239–255.9. H. Krawczyk and T. Rabin, Chameleon signatures, in: Network and Distributed System Security Symposium (NDSS 2000).10. S. Krenn, H. C. Pöhls, K. Samelin, D. Slamanig, Chameleon-hashes with dual long-term trapdoors and their applications,in: Progress in Cryptology – AFRICACRYPT 2018, Lecture Notes Comp. Sci. 10831, 11–32.11. R. C. Merkle, A digital signature based on a conventional encryption function, in: Advances in Cryptology – CRYPTO’87. Lecture Notes Comp. Sci. 293 (1987), 369–378.12. I. Puddu, A. Dmitrienko, S. Capkun, µchain: How to forget without hard forks, preprint,https://eprint.iacr.org/2017/106.pdf13. R. Rivest, A. Shamir, L. Adleman, A method for obtaining digital signatures and public-key cryptosystems, Communica-tions of the ACM 21 (1978), 120–126.14. Secure Hash Standard (SHS), https://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.180-4.pdf15. F.-Y. Yang, Improvement on a trapdoor hash function, Int. J. Network Security 9 (2009), 17–21.CNRS, MATHÉMATIQUES, UNIVERSITÉ DE LILLE, 59655, VILLENEUVE D’ASCQ, FRANCEEmail address: Dmitry.Grigoryev@univ-lille.frDEPARTMENT OF MATHEMATICS, THE CITY COLLEGE OF NEW YORK, NEW YORK, NY 10031Email address: shpil@groups.sci.ccny.cuny.edu

RSA and redactable blockchains

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive