Blockchain - The golden bullet to Identity part 2

Recap

I wrote previously about Blockchain, it’s use in financial services and asked the question if it was a tool used by companies to attract investment. There is no doubt that a few of the companies that tout blockchain are claiming that users can just sign in without having to bother with password; but that’s all they say.

Blockchain and IAM

Without explaining the mechanism, it seems like they’re using a long-term OAuth Access token to log into their identity provider (the blockchain company), and then using federation (SAML or OIDC) to log on to the the Service Provider (Relying Party in OAuth/OIDC). ShoCard, for instance, use Blockchain technology to ‘independently hashed, signed and certified on the blockchain by Creditinfo to verify the authenticity of the credit information passed to the user’. So how is that different to a plain old X.509-based digital signature by Creditinfo?

The secret sauce is not explained, so let’s go back to what we do know about blockchain, or at least what information is readily available. There’s a reasonable explanation on Wikipedia, but it does dive into the weeds quite quickly. At a bits and bytes level a blockchain is a set of blocks. The chaining element is that each new block has a hash of the previous block as part of it’s structure. “What’s so great about that?” I hear you ask. Well as new blocks are added, then old blocks cannot be changed, unless all of the new blocks get re-generated too.

This property is useful if you wish to have an immutable (read expensive to change) ledger of the past. One concrete application of this is crypto-currency where the ledger is distributed and public, and will include information about who transferred which coins to who else.

51% Attack

All of that relies on it being difficult/expensive to add new blocks. Strategies for this include a single source of authority – but that makes the blockchain just a storage mechanism like a filesystem or database – or if having a distributed source then two things can happen to make the record sound. One is “Proof of work”, and the other is some kind of voting system. In the latter, all the members of the network form a consensus of reality (what has happened). This sounds great, and democratic, but all you need to do to break this is to gain a majority, which people can do when launching a Sybil attack (a.k.a. 51%, as has happend to Etherium in summer 2020 )by registering a load of fake members that they control.

The proof of work mechanism is usually getting machines to come up with a string, part of which is predetermined, like their name or ID, and the second part of which is a given number of characters, which can be determined by the system that is ‘proving it is working’. That system has to keep trying combinations of the digits such that the whole string, when hashed, produces a hash that has a given number of leading zeros. The number of leading zeros required is the ‘difficulty’. So the system has to try coming up with a sequence and then hashing it until it gets the answer. For bitcoin, currently around 200 X 10^18 hashes have to be tried.

What’s in it for me?

This is what bitcoin miners do. When they have proved some work, they can add new blocks to the chain to record the transactions that have happened. The system allows the miners to claim bitcoin for doing the work and adding to the ledger. This gives the miners an incentive to perform the expensive work of updating the ledger. If there is no incentives for a multitude of record keepers for a distributed ledger, then there will not be enough keepers of the ledger that would prevent a 51% attack.

As at September 2017, there are over 1100 cryptocurrencies. If each one is reliant on a network of record keepers. However, for non-cryptocurrency applications, what incentive is there for the distributed record keepers to keep the chain up-to-date in an integral manner? A good few of those that are decentralised must be in danger of Sybil attacks. Even for the best-known currency, bitcoin, the collapse of mt.gox a Bitcoin exchange that was handling around 70% of global transactions until its collapsed in 2014, with BTC 650,000 worth around £2.2bn at current exchange rates being ‘stolen’. Originally it was BTC 850,000 but 200,000 were ‘found’. For a distributed ledger (currently around 134Gb of data) that all clients can read, it seems odd that, so much currency can be lost/stolen/found like that.

Anonymity vs. Concrete record

The big draw for using a distributed ledger in Bitcoin is its anonymity, which is why the proof of work, and consensus mechanisms are used, as they allow for integrity along with anonymity. As we see from above, the system is not perfect, and for identity assertions it may proved to be overcomplicated and irrelevant. In the UK, even worldwide, there are only a handfull of recognized credit reference agencies that large corporates would go to to accept assertiond about individuals and organisations. The consumers of this information don’t want the assertions to come from anonymous agencies that have managed to prove a lot of work. The consumers want to know which authority is asserting that “John Smith” is “John Smith”. A verification by Experian (say), will hold more weight than a verification by ‘1111AAA Ardvaark’ credit ref agency. In that case, why would you not just accept a digitally signed assertion from the agency, using X.509 certificates?

So why are there so many companies linking blockchain to identity? For one thing there is a healthy investment market in blockchain companies. It was approaching $2bn in 2015, according to blockchaintechnologies. So if you were looking for a new angle for your startup, trendy blockchain might well compensate for a lack of track-record in the boring old tech, especially if investing in blockchain is supposed to be “like investing in the internet in 1994”, according to blockchaintechnologies. From the above, you can see that I am struggling to find a technical justification for blockchain in identity, but I might be missing something. If you can point me in the right direction, I’d be interested.