What makes Blockchain secure?

1. Introduction

Blockchain is a shared digital ledger, or financial database, that securely stores the immutable records of financial transactions and the location of assets across a decentralised computer network. Most recognised for being the backbone of all cryptocurrency systems, especially after the launch of Bitcoin in 2009, its pseudonymous inventor Satoshi Nakamoto introduces it as ‘a new electronic cash system that’s fully peer-to-peer, with no trusted third party’1. In classical software, data security relies on the use of perimeter defence, where relational databases protect data using firewalls, Virtual Private Networks (VPNs) and Intrusion Detection/Prevention Systems (IDS, IPS). These systems create single points of possible failure, so by compromising the root credentials of the system, intruders are able to read or rewrite permissions to the entire system. Conversely, blockchain technology establishes a zero-trust system, operating as a decentralised, append-only Distributed State Machine, which is a conceptual rules-based model consisting of multiple nodes connecting in a network to maintain an identical copies of a system’s data to resist single points of system vulnerability. Through mathematical, algorithmic and cryptographic frameworks, blockchain is made secure against tampering, subversion and unauthorised access.

2. Cryptographic Primitives

Cryptographic Hash Functions

At the bit level, the immutability of blockchain ledgers is ensured through the use of cryptographic hashing algorithms and hierarchical data structures; through these primitives, any retroactive changes to the ledger are detectable across all replicating nodes. Every state transition within in the ledger is processed through a deterministic cryptographic hash function, H(x), a mathematical algorithm that maps a message of arbitrary size to a fixed-size hexadecimal string commonly referred to as a hash or digest:

H : {0,1}* → {0,1}k

Here, {0,1} represents a binary alphabet as all data consists of bits 0 and 1, the * known as a Kleene Star represents arbitrary length from zero to infinity, the exponent k in the codomain denotes a fixed length of k bits. The industrial standard is the SHA-256 algorithm, employed heavily in blockchain security, where k = 256. This states that the function takes an input of any size, compressing it into a digital fingerprint of length 256 bits, or a 64-character hexadecimal string. To guarantee data integrity, H(x) must satisfy three formal mathematical criteria established in cryptography2:

1. Pre-image resistance, or one-wayness: Given any hash output y, it is infeasible to determine an input x such that H(x) = y. The sole method of attack is a brute-force inversion sear viable attack vector is a brute-force search across the input, requiring 2k operations.

2. Second pre-image resistance: Given a specific input x1, it is impossible to find a distinct input x2 ≠ x1 such that H(x1) = H(x2).

3. Collision resistance: It is infeasible to functionally find any two distinct inputs (x1, x2) such that H(x1) = H(x2), producing the same output hash. While the number of possible inputs is infinite while the outputs finite, collisions technically exist, however good algorithms make it mathematically difficult so that even the best supercomputers would take billions of years to guess one by chance. Due to the Birthday Paradox, an arbitrary collision search requires approximately 2k/2 structural evaluations, which still remains impossible for a 256-bit space.

The avalanche effect is another core property required of all cryptographic algorithms, which dictates that a miniscule change in input data must result in a computationally unpredictable change in output data; there is no visible relationship connecting the original output to the modified output. Blockchains employ hashes as unique identifiers for transactions and blocks. The algorithm embeds the hash of a previous block into the current one, thus creating an immutable mathematical chain where tampering breaks all following hashes.  

The Merkle (Binary Hash) Tree

Figure 1. Merkle Tree Diagram

In blockchain, the organisation and verification of transactions is done through a hierarchical binary hash tree known as a Merkle Tree. The data blocks are arranged as pairs of adjacent leaf nodes, or terminal points in the hierarchical structure, and are hashed sequentially, where the resulting outputs are concatenated, joined together recursively up the tree until a single fingerprint remains at the apex, called the Merkle Root. Tx0 and Tx1 represent two raw pieces of data, e.g. Alice sends Bob 1.2 BTC, Charlie sends David 3.5 BTC, // is the operator for concatenation and H(…) is the parent hash. The total of Tx… represent the total amount of transactions chosen for a block.

Hash01 = H(H(Tx0 ) ∥ H(Tx1 ))

This structural design combines individual pieces of transaction data into a cohesive structure, and ensures that any data mutation at the base generates a compounding discrepancy appearing at all corresponding parent hashes, enabling rapid verification of ledger states without necessitating an exhaustive check of individual transactions. When users broadcast new translations, miners collect them from memory pools, verifying the digital signature and calculating each intermediate hash to find the final Merkle Root, which is stamped into the block header. Once the header is finalised, miners brute-force the nonce (number used once) to solve the block hash below a predefined target difficulty, to securely verify and record the transaction on the blockchain.

To verify that a specific transaction is valid and within the block, the client requests a Merkle path in Simple Payment Verification (SPV) where the user is given the sibling hashes along the last branch leading to the root. The client then computes the hashes up to the path locally, checking the result against the header root. This eliminates the client’s need to process irrelevant branches, dropping the complexity from a linear scan O(n) to O(log2n). In a block containing 4,096 transactions, a Merkle path requires only

log2 (4096) = 12 sequential hashing operations

in order to cryptographically prove inclusion3.

Figure 2. Diagram of a Block in Blockchain

3. Consensus mechanics – attacks become economically ruinous

Sybil Attacks

Blockchain is attacked through four main points of entry: the consensus mechanism, smart contract code (the self-executing program that runs when predetermined conditions are met), the Network (P2P) Layer (how nodes discover each other, broadcast transactions etc.) and individual user credentials. A Sybil attack is a threat where an intruder floods the system with many fabricated identities to gain a disproportionately large portion of control over decentralised voting or routing. This exploits the Network Layer (P2P routing), as permissionless systems lacking a manager presiding over identities inherently trust any node complying with standard connection protocols. Sybil attacks are rarely the end goal, rather they are used to set up large-scale thefts downstream. An attacker can manipulate the network via two methods:

1. Direct Sybil Attack – The generated entities connect to honest nodes and broadcast false transactions or blocks to real participants. One way of connecting to honest nodes is through the exploitation of DNS Seeds: when a new node joins the network, it requests a list of active peers to connect to, called DNS Seeds – the Sybil attacker generates hundreds of malicious nodes with fake IP addresses advertised, some of which are handed to honest nodes so they can then establish connections.

2. Indirect Sybil Attack – An attacker routes malicious traffic via compromised intermediary nodes, isolating singular honest nodes behind a wall of fake entities by which the attacker can manipulate all information that the victim receives.

Figure 3. Diagram in comparison of indirect and direct Sybil Attack

Proof-of-Work (PoW) and Nakamoto Consensus

Proof-of-Work refers to the requirement of miners to utilise significant computational power to solve mathematical puzzles that validate a transaction and enable the creation of new blocks. Nakamoto Consensus resolves the vulnerabilities found by Sybil attacks by requiring nodes to expend a significant amount of energy in order to propose state transitions. This is organised as the Partial Pre-image Problem, where miners have to undergo a brute-force search to find the nonce, a variable scalar string, that forces the SHA-256 hash in the block header to be below an adjusted target level T:

H (Nonce∥Previous Header Hash∥Merkle Root∥Timestamp) < T Hash functions are collision-resistant, meaning that the discovery of a valid nonce can be modelled as a memoryless Poisson stochastic (random over time) process; past attempts have no use in future discoveries as the generation of each hash is an independent event. If an attacker wishes to alter a transaction within a block mined in the past, they must recalculate the Proof-of-Work for the tampered block and all blocks added subsequently. As a result, geographically distanced miners solving valid blocks at almost simultaneous times leads the network to temporarily diverging into forks. Nakamoto Consensus resolves all states by deploying the Longest Chain Rule, which states that all nodes must track, validate and append only to the branch that has the greatest amount of thermodynamic work (chain using the largest volume of burned energy and power in hashing). For an attacker, the thermodynamic cost turns the intrusion into a continuous brute-force against the collective computational weight of the global honest network. Moreover, the probability of a minority attacker successfully doing this exponentially decays with each new block added (z denotes confirmation depth, or number of blocks secured on top of target transaction, p is honest network consensus and q is the hash rate of the attacker):

If an attacker controls less than half the network, q < 0.5, the fraction is less than 1, so raising it to the exponent z exponentially causes the attacker’s success probability P to plummet towards 0. In this case, Nakamoto modelled that it would almost be mathematically guaranteed for a hacker to fail, so the blockchain is secure.

Proof-of-Stake (PoS) and Byzantine Fault Tolerant (BFT) engines

Proof-of-Stake (PoS) replaces energy expenditure with a virtualised capital resource as voting and block allocation powers are given proportionally to the volume of native tokens in an escrow contract, called staking. In order to successfully manipulate a PoS blockchain, an attacker needs to control 51% of all globally staked coins, which would be a massive economic deficit for the attacker. Buying such a large stake on the open market would cause a loss of public faith in the blockchain, causing the token price to crash and a complete loss of asset value. In PoW, an attacker owning 51% of the world’s mining chips would cause them to own the blockchain forever, however in PoS, the community has the option of User-Activated Hard Fork (UAHF), where the community can vote to copy the blockchain to a new version to stop the monopoly, leaving the attacker’s stake worthless on a dead network.

Modern PoS implements the deterministic system of Byzantine Fault Tolerant (BFT) consensus, where validators are structured into voting quorums and a block achieves finality only if the cryptographic signatures representing it hold a supermajority stake where S is the total staked weight4:

In a BFT system, the network requires the total number of nodes R to be equal to R = 3f + 1, where f represents the total amount of malicious nodes a network can tolerate. The 2f + 1 quorum threshold to achieve state finality where a block can no longer be altered introduces the intersection paradox, where the limit is specifically targeted to prevent the network from split-braining, or forking. If the intruder attempts to form two different versions of the block history simultaneously to execute a double-spend, they are required to convince one part of the network to finalise one block, of size 2f + 1, and another to finalise the second, also of size 2f + 1. Mathematically, out of a total network of 3f + 1, this is impossible and there must be an overlap by minimum f + 1:

				(2f + 1) + (2f + 1) - (3f + 1) = f + 1

The attacker, however, can only control a maximum of f malicious nodes, so the overlapping intersection is guaranteed to contain minimum one honest node, who will see that it is being asked to sign two differing block histories and refuse validation, thus the threshold entirely blocks the attacker from completing such an action. Systems reliant on Castro-Liskov finality are even more secure than PoW against historical alteration, as reversing a finalised block requires the approval of more than 33.33% of the network; if the attacker does acquire > 33.33% of the validators to maliciously collude, they are able to freeze the network by refusing to vote as honest nodes are left with less than 66.66%, the quorum threshold. However, obtaining such an amount of the network is incredibly difficult.

Hacking has serious financial implications as the punishment for fraudulent blocks is Slashing. In voting on state transitions, all validators must sign blocks with their own unique cryptographic keys, however if they are found to sign two conflicting versions of history or validate an illegal transaction, honest nodes immediately identify this and the protocol ejects the malicious validator from the network and a massive portion, or even 100%, of their cryptocurrency stake is destroyed, so security is maintained through the liquidation penalty for malicious behaviour.

4. Summary and Closing Remarks

Modern decentralised blockchain networks rely on BFT and PoW primarily on the foundation of cryptographic hashing in Merkle trees to maintain the security of distributed ledgers. By establishing strict deterministic structural features, such as the quorum threshold, these systems ensure state finality and the security of transactions. Identity relies on trapdoor functions, or operations that are mathematically trivial but nearly intractable to reverse-engineer without the secret scalar. Blockchains use Elliptic Curve Cryptography (ECC), based on the Elliptic Curve Discrete Logarithm Problem (ECDLP), where it is easy to start on one point on an elliptic curve and multiply it some number of times to land on a new point, however if one is given the final and starting point only, it is impossible to determine backwards how many times multiplication has occurred. The most prominent protocol is the standardised Koblitz curve defined over a finite prime field Fp by the Weierstrass equation5 where p = 2256 - 232 - 977:

Key pairs can be generated through operations on this curve, where the private key d is a randomly generated 256-bit scalar while the public key Q is a coordinate point on the elliptic curve created by taking the product of d by a fixed base generated point G; computing Q from d is then trivial, however reversing the operation is computationally difficult. Ultimately, security in blockchain technology is a continuously ongoing race between newfound exploitation of entry points and the patching of such issues, and while consensus protocols make attempted attacks costly and with high probability of failure, the safeguarding of routing layers remains a key focus in order to achieve complete, trustworthy decentralisation.

References:

1 Nakamoto, Satoshi. ‘Bitcoin: A peer-to-peer electronic cash system.’ (2008)

2 Menezes, Alfred J., Paul C. Van Oorschot, and Scott A. Vanstone. Handbook of applied cryptography. CRC press, 2018.

3 Merkle, Ralph C. ‘A certified digital signature.’ Conference on the Theory and Application of Cryptology. New York, NY: Springer New York, 1989.

4 Castro, Miguel, and Barbara Liskov. "Practical byzantine fault tolerance." OsDI. Vol. 99. No. 1999. 1999.

5 Johnson, Don, Alfred Menezes, and Scott Vanstone. "The elliptic curve digital signature algorithm (ECDSA)." International journal of information security 1.1 (2001): 36-63.