A group is a set G combined with a binary operation * that satisfies the following four properties:

1. Identity Law

There is an e ∈ G such that e \ a = a * e = a for every a ∈ G*.

2. Inverse Law

For every a ∈ G there is a (unique) a^−1 ∈ G satisfying;

a \ a^−1 = a^−1 * a = e.*

3. Associative Law

a \ (b * c) = (a * b) * c for all a, b, c ∈ G.*

4. Commutative Law

a \ b = b * a for all a, b ∈ G*

Addition

• Set: All integers {... -2, -1, 0, 1, 2, ...}

• Operation: +

• Identity Element: 0

• Inverse Element: for every a ∈ G, its inverse is -a

Modular Arithmetic Addition

• Set: Integers modulo n: {0, 1, 2, 3..., n-1}

• Operation: + (mod n)

• Identity Element: 0

• Inverse Element: For each a, an integer b such that; a + b = 0 (mod n)

Matrix Group Multiplication

• Set: All invertible 2 X 2 matrices over R or C

• Operation: Matrix multiplication

• Identity Element: Identity matrix = I

• Inverse Element: For a matrix A, its matrix inverse such that; A x A^-1 = I

If the operation is commutative, the group is called an Abelian or Commutative group.

Groups can be finite or infinite. The order of a group is the number of its elements.

What is Subgroup ?

Let H ⊂ G a subset. We'll say that "H is a subgroup of G" if;

1. e ∈ H

2. H is closed under * operation;

h1, h2 ∈ H ⇾ h1 \ h2 ∈ H*

3. H is closed under taking inverses;

h ∈ H ⇾ h^-1 ∈ H

As an example, let's take:

g ∈ G, g != e

|G| < ∞ (G is a finite group)

H = {g^k : k ∈ N} = {g, g^2, g^3, g^4, ...}

If H is a subgroup of G, it should validate 3 rules above.

Proof of 1st condition

G is a finite, so H is also a finite set, since H is a subset of G.

H = {g, g^2, g^3, g^4, ...}

The powers of the g's can not be all different because of g^{n+1} = g^n \ g^1 = e * g^1 = g^1. There *must be elements like:

R = { m ∈ N: g^m = g^j for some 1 ≤ j < m }

So we can define H like:

H = {g, g^2, g^3, g^4, g^j, ... g^(m-1)}

( Next element of this set is g^m = g^j )

g^m \ (g^j)^-1 = e g^(m- j) = e*

since j < m, (m - j) ∈ N

e ∈ H

Proof of 2nd condition

g^l \ g^m = g^(l + m)*

Proof of 3rd condition

For g^(m- j) = e, we multiply both sides by g;

g^(m- j) \ g = g*

g^(m- j + 1) = g

m - j + 1 ∈ R

According to this equation, m must be the smallest element of R. So;

m ≤ (m - j + 1) ⇾ j ≤ 1 && 1 ≤ j < m

j = 1

H = {g, g^2, g^3, ... g^(m-1)}

Last element's power and also element number of H is (m-1)

g^(m- j) = e ∈ H

References

An Introduction to Mathematical Cryptography

Cyclic Subgroups

Simple substitution ciphers are a foundational cryptographic method where each letter in the plaintext is replaced by a letter from a shuffled alphabet. This method is straightforward yet introduces the basic concept of encrypting a message to make it unreadable to unintended recipients.

How It Works

• The cipher operates by creating a one-to-one mapping between the standard alphabet and a mixed alphabet. Each letter from the plaintext is substituted according to this mapping to produce the ciphertext.

• For instance, if the letter 'A' maps to 'L', 'B' to 'M', and so on, the word "HELLO" might be encrypted as "XYZZY" given a specific mapping.

Historical Context: The Caesar Cipher

• Caesar cipher is an early form of simple substitution cipher. In a Caesar cipher, the alphabet is shifted a fixed number of places. For example, with a shift of three, 'A' becomes 'D', 'B' becomes 'E', and so forth.

• This cipher is named after Julius Caesar, who is historically noted to have used it for confidential communications.

Vulnerabilities: Frequency Analysis

• A significant part of the discussion on simple substitution ciphers involves their vulnerability to frequency analysis. This method of cryptanalysis leverages the fact that certain letters and combinations of letters appear more frequently than others in a given language.

• For example, in English, 'E' is the most common letter, and pairs like 'TH' are common bigram. By analyzing the frequency of letters and letter pairs in the ciphertext, a cryptanalyst can begin to deduce the original mappings and decrypt the message.

Despite their vulnerability, simple substitution ciphers played a crucial role in the early development of cryptographic methods. They introduced the principle of altering plaintext to secure its contents, laying the groundwork for more complex and secure ciphers. The ease with which these ciphers can be broken underscores the need for advancements in cryptographic techniques, leading to the development of more sophisticated encryption algorithms.

Divisibility

At its core, the concept of divisibility is straightforward yet powerful. An integer b is said to divide another integeraif there exists an integer c such that a = bc.

Ex: We have 847 | 485331, since 485331 = 847 · 573. On the other hand, 355 !/ 259943, since when we try to divide 259943 by 355, we get a remainder of 83. More precisely, 259943 = 355 · 732 + 83, so 259943 is not an exact multiple of 355.

This simple relationship forms the backbone of much more complex mathematical structures encountered in cryptography.

Greatest Common Divisor (GCD)

The greatest common divisor of a and b is, as its name suggests, the largest positive integerdsuch thatd | aandd | b. The greatest common divisor of a and b is denoted gcd(a, b). If there is no possibility of confusion, it is also sometimes denoted by (a, b). If a and b are both 0, then gcd(a, b) is NOT DEFINED.

Ex: Calculation of gcd (748, 2024)

Not Efficient Approach: Making lists of all the positive divisors of 748 and of 2024.

Divisors of 748 = {1, 2, 4, 11, 17, 22, 34, 44*, 68, 187, 374, 748},*

Divisors of 2024 = {1, 2, 4, 8, 11, 22, 23, 44*, 46, 88, 92, 184, 253, 506, 1012, 2024}.*

Efficient Approach: Division with remainder, which is simply the method of “long division”. Thus, if a and b are positive integers and if you attempt to divide a by b, you will get a quotient q and a remainder r, where the remainder r is smaller than b.

Finding GCD with Division

1. According to the definition, we can say a = bq + r and 0 ≤ r < b. The values q and r are unique for given a and b.

2. Start by dividing a by b to get the remainder r. Any common divisor of a and b is also a divisor of r, and any common divisor of b and r is a divisor of a. This means the GCD of a and b can be equated to the GCD of b and r. So;

   gcd(a, b) = gcd(b, r)

3. Repeat the process, dividing b by r to get another quotient and remainder, reducing the remainder each time until r = 0. The final value gcd(s, 0) = s is equal to the gcd(a, b).

We illustrate with an example and then describe the general method, which goes by the name Euclidean algorithm.

2024 = 748 · 2 + 528

748 = 528 · 1 + 220

528 = 220 · 2 + 88

220 = 88 · 2 + 44 ⇾ gcd(2024, 748) = 44

88 = 44 · 2 + 0

The Euclidean Algorithm

Let a and b be positive integers with a ≥ b. The following algorithm computes gcd(a, b) in a finite number of steps.

The Discrete Logarithm Problem

The DLP arises in the context of finite fields, particularly Fp​, which is a field with a prime number of elements p. For a given prime p and a primitive element g in Fp​, the DLP involves finding an exponent x such that:

g ^ x ≡ h ( mod p )

Here, g is a primitive root for Fp​, and h is a nonzero element of Fp​. The exponent x that satisfies this equation is known as the discrete logarithm of h the base g, denoted by;

Mathematical Representation

• Primitive Element g: A primitive element g of Fp​ is such that every nonzero element of Fp​ can be expressed as a power of g. By Fermat's little theorem;

and no smaller power of g equals 1.

• Discrete Logarithm x: The discrete logarithm problem seeks the integer x satisfying;

• If such an x exists, there are actually infinitely many solutions, since;

for any integer k, due to the periodic nature implied by Fermat’s little theorem.

The discrete logarithm x is thus defined modulo p−1, acknowledging the cyclic nature of the powers of g in Fp​.

Diffie-Hellman Key Exchange

Alice and Bob need to securely share a secret key over an insecure channel monitored by Eve. Diffie and Hellman proposed using the discrete logarithm problem's complexity as a possible solution to this challenge.

Mathematical Representation of the Algorithm

1. Public Parameter Creation

Alice and Bob start by choosing a large prime numberp and a nonzero integergmodulop and share them in public.

2. Private Computations

Next, Alice selects a secret integer a, and Bob chooses a secret integer b. They use their secret integers to compute:

3. Public Exchange of Values

Alice sends to Bob ⇾ A,

Bob sends to Alice ⇾ B

4. Further Private Computations

Bob and Alice again use their secret integers to compute:

The values that they compute are the same. (A′ = B′)

Current guidelines suggest that Alice and Bob choose a prime p having approximately 1000 bits (i.e., p ≈ 21000) and an element g whose order is prime and approximately p/2. Then Eve will face a truly difficult task. However, Eve can solve the DLP (Discrete Logarithm Problem), then she can compute Alice and Bob’s secret exponents a and b from the intercepted values A and B, and then it is easy for her to compute their shared key gab. (Needs to compute only one of a and b.) But the converse is less clear. Suppose that Eve has an algorithm that efficiently solves the DHP (Diffie-Hellman Problem). Can she use it to also efficiently solve the DLP?

The ElGamal Public Key Cryptosystem

Although Diffie-Hellman algorithm provides a method of publicly sharing a secret random key, it does not enough to being a public key cryptosystem. The most natural development of a public key cryptosystem following the Diffie–Hellman is a system described by Taher ElGamal in 1985. The ElGamal public key encryption algorithm is based on the DLP and is closely related to Diffie–Hellman key exchange.

Mathematical Representation

1. Public Parameter Creation

A trusted party chooses and publishes a large prime p and an element g (instead of Alice and Bob) modulo p of large (prime) order.

2. Key Creation

2.1 Alice chose private key 1 =< a =< p-1.

2.2 Computes A = g ^ a (mod p).

2.3 Alice publishes the public key A.

3. Encryption

3.1 Bob chooses plaintext m.

3.2 Bob chooses random temporary key k.

3.3 Uses Alice's public key A to compute c1 = g ^ k (mod p)

and c2 = m A^k (mod p).

3.4 Bob sends ciphertext (c1, c2) to Alice.

4. Decryption

Alice compute m with:

How hard is the DLP ?

The discrete logarithm problem is a bit like solving a puzzle, where you need to figure out a special number, called an exponent. Imagine you have a specific operation you can do with numbers, and you want to find out how many times you need to repeat this operation on a base number g to get another number h. This is tough because you have to guess and check a lot of possibilities, especially when the numbers involved are massive.

1. Guess and Check - Not Practical

   If you tried to solve this by simply trying every single possibility one by one, you might end up trying an enormous number of times, especially if the range of possible numbers is huge.

2. Fast Exponentiation - Still Not Practical

   This method starts to feel slow when the numbers get really large, because you still have to do a lot of guesses.

Shanks's BabyStep-GiantStep Algorithm

This method is designed to solve the DLP more efficiently than simply trying brute force.

How it works ?

1. Divide and Conquer

Create a 2 smaller list of possibilities.

Find the exponent x solves the DLP equation.

2. Setting Up Lists

Baby Steps: Store the powers of g in a list. (g, g^2, g^3, ...)

Giant Steps: Calculate powers of h multiplied by inverse powers of g raised to large increments and store them in another list. (h.g^-n, h.g^-2n, ...)

3. Finding a match

Looks for a common element between two lists.

• "Finding a common element" means two calculation methods agree, revealing the solution x. (collision)

4. Efficiency

This method significantly reduces the number of operations compared to brute force.

In a group of size 10,000, Shanks's Algorithm needs only around 200 steps to find the answer (200^2 = 10.000) but a brute force would require all 10,000 options.

The Chinese Remainder Theorem (CRT)

Imagine you're trying to figure out a number that, when divided by 3, leaves a remainder of 2, and when divided by 5, leaves a remainder of 1. Doing this by checking each number one by one is so boring and requires a lot of time. The CRT exists to solve this kind of problem quickly and efficiently by finding a number that works for all conditions(aka puzzles) without having to test every single possibility.

Simple Example:

Puzzle 1: Event that occurs every 7 days (weekly on a Monday), and today is Monday. Today could be represented as:

x = 0 (mod 7)

Puzzle 2: A second event that happens every 5 days, and today it's happening too. Today could be represented as:

x = 0 (mod 5)

What are the days that both events will happen again on the same day?

CRT comes to play

The CRT tells that both events will align every 7×5=35 days. So, the next time both events happen on the same day will be 35 days from today.

Mathematical Representation

Looking for an integer x that simultaneously solves both of the puzzles

below:

• x = 1 (mod 5)

• x = 9 (mod 11)

For the first puzzle, we can say:

x = 1 + 5y (y ∈ Z)

For the second one;

x = 1 + 5y = 9 (mod 11) then, 5y = 8 (mod 11)

Finding modulo inverse:

(a x b = 1 (mod m))

To solve 5y = 8 (mod 11), we need the inverse of 5 modulo 11. This inverse exists because gcd(5, 11) = 1.

5 x b = 1 (mod 11).

Because the modulus is so small that we can find it by trial and error.

5x9 = 45 = 1 (mod 11)

9 is the modular inverse of 5 modulo 11.

Using the Inverse to Solve for y:

Given the equation above:

5y = 8 (mod 11)

Multiply Both Sides by the Inverse of 5 Modulo 11:

Multiply both sides of the equation by 9:

9×5y = 9×8 (mod 11)

Simplify the Equation & Solving y:

Because 9 x 5 = 1 (mod 11), the equation simplifies

y = 72 (mod 11) ⇾ y

Finding x with y:

Since;

x = 1 + 5y

1 + 5x6 = 31

Solving puzzles with composite moduli

Let's find x such that: x^2 = 197 (mod 437)

(437 is a composite number because 437 = 19 × 23. Both 19 and 23 are prime numbers.)

Step 1.

Factor the modulus

437 = 19 × 23

Step 2.

Apply CRT

Since 437 can be factored into two relatively prime numbers, we can split the original congruence into two separate congruences based on these prime factors:

1. x^2 = 197 = 7 (mod19)

2. x^2 = 197 = 13 (mod 23)

Step 3.

Simplify the Congruences

1. x^2 = 7 (mod 19) and x^2 = 197 = 13 (mod 23)

Because 19 (mod4) = 3, 23 (mod  4)=3;

x^2 = 64 ⇾ x = 8 | -8

x^2 = 36 ⇾ x = 6 | -6

Step 4 with choosing positive solutions 8 and 6.

Apply the CRT Again

x = 8 (mod 19) and x = 6 (mod 23);

Inverse modulo of 6 and 23:

x = 23k + 6 = 8 (mod 19)

23k = 2 (mod 19)

k = 5

Multiply both sides of equation with 5:

5 x 23k = 2 x 5 (mod 19) ⇾ k = 10

Finally:

x = 23 x 10 + 6 = 236 | - 236 for x^2 = 197 (mod 437) equation.

If the modulus were prime, there would be only these "two" square roots. However, since 437 = 19 · 23 is composite, there are two others. In order to find them, we replace one of 8 and 6 with its negative. This leads to the values x = 144 and x = 293.

This means that 197 has 4 square roots modulo 437.

References

An Introduction to Mathematical Cryptography

The Discrete Logarithm Problem

The Euclidean Algorithm

What ?

A proxy contract is a contract which delegates call to another contract.

Why ?

Smart contracts are typically immutable, but some degree of mutability is necessary for bug fixes and product improvements in blockchain-based software.

Proxy Patterns

In a proxy architecture pattern, a Proxy contract serves as an intermediary for all message calls, directing them to the most recent deployed contract logic. Upgrades involve deploying a new contract version and updating the Proxy to point to the new contract address.

Open Zeppelin’s Proxy Patterns

• Inherited Storage

• Eternal Storage

• Unstructured Storage

All three patterns use low-level delegatecalls. In Solidity, the delegatecall function is available, but it only provides a success or failure status and doesn't enable management of the returned data.

• When one contract delegates a call to another, the code of the second contract runs within the first contract's context. This ensures that msg.value and msg.sender values are retained, and any storage changes affect the first contract's storage.

• Zeppelin's shared Proxy contract has its own delegatecall function, which returns the value produced by calling the logic contract.

• How to manage storage allocation ? With separate contracts for storage and logic, there's a risk of overwriting storage slots. For instance, if the Proxy contract stores the latest logic contract address in a slot, and the logic contract isn't aware of it, it could unintentionally overwrite critical Proxy data.

• How to ensure that the logic contract does not overwrite state variables that are used in the proxy for upgradeability ?

INHERITED STORAGE PATTERN

This approach requires the logic contract to adopt the same storage structure as the proxy contract. This ensures both contracts store the necessary proxy state variables.

During exploration, the idea of a Registry contract emerged to manage different logic contract versions. To upgrade, you register a new logic contract version in the Registry and instruct the proxy to switch to it. Importantly, the Registry doesn't impact the storage mechanism and can be implemented alongside any of the storage patterns.

Registry contract: Recording information about a contract in a special record-keeping contract called the "Registry." This helps the system keep track of different versions of contracts and enables upgrades.

How to Initialize

1. Deploy a Registry contract

2. Deploy an initial version of your contract (v1). Make sure it inherits the Upgradeable contract

3. Register the address of your initial version to the Registry

4. Ask the Registry contract to create an UpgradeabilityProxy instance

5. Call your UpgradeabilityProxy to upgrade to the initial version of the contract

How to Upgrade

1. Deploy a new version of your contract (v2) that inherits from your initial version to make sure it keeps the storage structure of the proxy and the one in the initial version of your contract.

2. Register the new version of your contract to the Registry

3. Call your UpgradeabilityProxy instance to upgrade to the new registered version.

ETERNAL STORAGE PATTERN

In this pattern, there are three important parts:

1. Storage Contract: This contract defines where data is stored. Both the proxy and logic contract use this storage structure to store their data.

2. Logic Contract: This is where the main code and functionality of your smart contract reside. It interacts with the data stored in the Storage Contract.

3. Proxy: The Proxy is like a gateway that directs calls to the Logic Contract. It can also introduce its own data without worrying about conflicts.

All versions of the Logic Contract should use the same structure defined in the Storage Contract for storing data.

“Proxy Owner” is just an address that has special privileges.

Only the Proxy Owner can do two things:

• Upgrade: They can change which Logic Contract the Proxy points to, effectively upgrading the contract's functionality.

• Transfer Ownership: They can transfer ownership of the Proxy to another address, which means giving control over the contract to someone else.

This ensures that only trusted entities have the power to make important changes to the contract, like upgrades or handing over control.

How to Initialize

1. Deploy an EternalStorageProxy instance

2. Deploy an initial version of your contract (v1)

3. Call your EternalStorageProxy instance to upgrade to the address of your initial version

4. If your logic contract relies on its constructor to set up some initial state, that would have to be redone after its linked to the proxy since the proxy’s storage doesn’t know about those values. EternalStorageProxy has a function upgradeToAndCall specifically to call some function on your Logic Contract to redo the setup after the proxy upgrades to it.

How to Upgrade

1. Deploy a new version of your contract (v2) making sure it holds the eternal storage structure.

2. Call your EternalStorageProxy instance to upgrade to the new version.

UNSTRUCTURED STORAGE PATTERN

Similar to Inherited Storage, however, you don't need the logic contract to inherit specific state variables for this purpose.

In the proxy contract, you define a constant variable. When this variable is hashed, it generates a random storage position. This storage position is where you'll store the address of the logic contract that the proxy should use for its operations.

The proxy contract essentially uses this hashed variable to determine where in storage it should find the address of the logic contract.

bytes32 private constant implementationPosition = keccak256("org.zeppelinos.proxy.implementation");

Because constant state variables don't use storage slots, there is extremely little chance of collision of this storage slot being used by something else defined in the logic contract.

This pattern allows for upgrades without each new version having to be aware of the proxy's storage structure. It simplifies the process and makes it more flexible. However, it does require that each new version inherits the storage variables from the previous one to ensure they know where the data is stored.

How to Initialize

1. Deploy an OwnedUpgradeabilityProxy instance

2. Deploy an initial version of your contract (v1)

3. Call your OwnedUpgradeabilityProxy instance to upgrade to the address of your initial version

4. If your logic contract relies on its constructor to set up some initial state, that would have to be redone after it's linked to the proxy, since the proxy’s storage doesn’t know about those values. OwnedUpgradeabilityProxy has a function upgradeToAndCall specifically to call some function on your logic contract to redo the setup after the proxy upgrades to it.

How to Upgrade

1. Deploy a new version of your contract (v2) making sure it inherits the state variable structures used in previous versions.

2. Call your OwnedUpgradeabilityProxy instance to upgrade to the address of your new contract version.

IMPORTANT NOTES

Reinitialize Logic Contracts After Proxy Upgrade

If your logic contract relies on its constructor to set up initial values, you need to redo this setup after the proxy upgrades to your logic contract. After upgrading the proxy, you run an initialize function on the logic contract to set up any necessary initial states.

Compatibility Issue

It isn’t safe to simply add a state variable because it "shifts down" all the state variables below in the inheritance chain. This makes the storage layouts incompatible.

Contract Interaction

When you're working with upgradeable smart contracts, you always interact with the contract instances created from the proxy, not with the underlying logic contract. This separation is crucial for upgradeability.

Direct Logic Contract Interaction

While you primarily use contract instances, it's possible for a malicious actor to send transactions directly to the logic contract. However, this doesn't pose a threat because any changes made to the state of the logic contract won't affect your contract instances. Your project doesn't rely on the storage of the logic contracts.

Exception - Selfdestruct

There's an exception to this rule. If a direct call to the logic contract triggers a selfdestruct operation, it will destroy the logic contract. This action would cause all your contract instances to delegate all calls to an address with no code, effectively breaking them.

Similar Effect with Delegatecall

The same negative effect can occur if the logic contract contains a delegatecall operation. If the contract can be manipulated to delegatecall into a malicious contract that contains a selfdestruct, it will lead to the destruction of the calling contract.

Prohibition

To avoid these issues, it's crucial not to use either the selfdestruct operation or delegatecall in your contracts. These operations can inadvertently lead to the destruction of contracts and break your project's functionality.

Avoid Initial Values in Field Declarations

Make sure that all initial values are set in an initializer function; otherwise, any upgradeable instances will not have these fields set.

contract MyContract is Initializable {

uint256 public hasInitialValue;

function initialize() public initializer {

hasInitialValue = 42;

}

}

You Can Define Constant Variables

Because the compiler does not reserve a storage slot for these variables.

contract MyContract {

uint256 public constant hasInitialValue = 42;

}

Don’t Forget to Lock

Do not leave an implementation contract uninitialized. An uninitialized implementation contract can be taken over by an attacker, which may impact the proxy. To prevent the implementation contract from being used, you should invoke the _disableInitializers function in the constructor to automatically lock it when it is deployed.

YOU CAN NOT

• Change the order in which the contract STATE VARIABLES declared, nor their type.

• Introduce a new variable before existing ones

• Remove an existing variable

• Add new variables to base contracts.

If you rename a variable, then it will keep the same value as before after upgrading.

If you remove a variable from the end of the contract, note that the storage will not be cleared.

REFERENCES

Writing upgradeable contracts

Layout of state variables in storage

The transparent proxy pattern

Proxy patterns

Smart contract upgradeability using eternal storage

UUPS Upgradeable

EIP-1967

Malicious backdoors in Ethereum proxies

Upgradeability ownership

A hash function is a keyless algorithm that transforms an input, which can be of varying lengths and representations, into a fixed-size binary string of a specific length, known as the hash message digest.

Given a hash function, suppose its output is always a binary string of length k. Then the size of the output space is 2^k.

A good hash function has two properties:

• It should be very fast to compute.

• It must reduce the chance of ‘collisions’ over the expected input space.

To minimize collisions, a hash function must distribute its output uniformly over the output space. (looks like random)

A potential drawback of such hashes is that there could be many collisions (md4, md5, SHA1)

Ex: Hash tables

Hash & Message Digests

Hash Functions

Cryptographic Hash Functions

It is wanted for a hash function to behave like a random function.

In order for a hash function to be called a cryptographic hash function, it has to satisfy the following properties for security:

Resistance

1. Preimage Resistance

• Given an output y, it should be hard to find any input x such that: H(x) = y (One-way)

• A generic attack would require around 2^n operations

1. Second Preimage Resistance

• Given an output y and input x such that H(x) = y, It should be hard to find another input x' such that H(x') = y

• Theoretically, finding x and x' for the same output is always possible. Because the output size of y is FIXED, but input can be ANYTHING.

• A generic attack would require around 2^n operations

1. Collision Resistance

• It should be hard to find two inputs x and x' such that H(x) = H(x')

• A generic attack would require around 2^(n/2) operations due to Birthday Paradox.

NOTE: Birthday Paradox

How many people need to be in a room before it is more likely than not at least two people share a birthday?

p >= 1/2 when t >= 23

We have a collision with p > 1/2

Understanding Birthday Paradox

NOTE: A hash function’s security is determined by how easy it is to find hash collisions.

Regular hash functions are effective at reducing collisions when inputs are random, but they can be weak against intentional collision attacks. Cryptographic hash functions, the choice for blockchains, excel in resisting collisions even against determined attackers.

Practical Break of SHA-1

SHA256 Playground

Every cryptographic hash function is a hash function. However, not every hash function is a cryptographic hash function.

Symmetric Encryption aka Secret Key Encryption

• Only one secret key for encoding and decoding

• Oldest and best-known way within cryptographic algorithms

• Fast

• Not scalable

• Easy to execute and manage (one secret key)

• Someone can steal/reach the key

• Blowfish, AES, RC5, DES (Data Encryption Standard)

• DES → broken because of the short key → Triple DES (multi-layered version of DES)

AES (Advance Encryption Standard)

• Uses block cipher

• Faster and safer according to DES

• Supports 128, 192, 256-bit keys

• Longer length and block size according to DES

• Resist -> brute force attacks

Key Distribution Problem

• The secret keys must be transported securely.

• Reason for the birth of asymmetric encryption.

One of the solutions: Key

Distribution Center

Asymmetric Encryption aka Public Key Encryption

• Founded in 1976

• Uses different keys for encryption and decryption

• Diffie-Hellman → First asymmetric encryption algorithm

• Elliptic Curve Systems, RSA, Code-based Cryptosystems

As a simple example

Postman, Cargo package, Receiver, Postbox

Receiver’s Address: Public key

Postbox’s Key owned by the receiver: Private key

RSA (Rivest–Shamir–Adleman)

A public-key algorithm that is used for key establishment and the generation and verification of digital signatures.

RSA

Comparison between AES, DES, RSA and Blowfish

Hash Puzzles

Hash puzzles are a game in which one tries to find a nonce (an integer) such that:

H (nonce, data) < T (target difficulty level).

Consensus Algorithms

• Algorithms that provide data to be negotiated across distributed systems or operations.

• Used to provide the “not to require trust structure” of the blockchain.

POW (Proof Of Work)

A nonce that solves the hash puzzle serves as a proof-of-work.

• Used by Bitcoin

• Hard to solve & easy to confirm

• Miners need to solve problems to add blocks

• The first miner to solve the problem

  the block to the chain.

• Almost 100% protection against DDoS

• Problem: The system consumes a lot of energy

Mining

Which party solves the puzzle the first?

• The process of searching for a nonce that solves the hash puzzle is called mining.

• The parties competing to solve the hash puzzle are called miners.

Forks

“Note that the mining rate is different from the rate at which the ledger grows. Ideally, each new block should lead to the growth of the ledger. However, this is not always the case. For example, it is possible that a miner mines a valid block but does not publish it; in this case, the ledger does not grow (this is dishonest behavior, but we must account for it nevertheless). It is also possible that two valid blocks are mined with the same parent block, in which case the ledger grows only by one block.

This can happen if the second hash puzzle is solved before the pertinent miner hears of the previous block. After all, it takes a non-zero amount of time for a block to be communicated across the network, especially if the block has a lot of data.

In general, the set of blocks mined at any given point in time form a directed tree, rather than a single chain. We say that the blockchain has forked when a single block has two or more children blocks. As such, there could be many forks over time.

What then should the users consider as “the ledger”?

The longest chain rule states that the longest chain among all published blocks should be treated as the ledger. Thus, users should build a new block and append it to the longest chain that they currently know of.”

The Longest Chain Rule

A chain selection rule is used to decide which chain is the "correct" chain. Bitcoin uses the "longest chain" rule, which means that whichever blockchain is the longest will be the one the rest of the nodes accept as valid and work with.

POS (Proof Of Stake)

• Instead of the computational power required to verify transactions, validators must stake their coins in 32 slots.

• PoS systems do not award block rewards, and only transaction costs are given as the minter validates a block.

There are two primary roles for a validator:

1. checking new blocks and “attesting” to them if they are valid,

2. proposing new blocks when selected at random from the total validator pool.

Attacking the system is too costly doesn't mean it can't be attacked.

%51 Attack

• Capturing 51% of the processing power in the system

• Costs too much (processing power, electricity)

• Hard to do on large networks like Bitcoin

Global Bitcoin Nodes 10.08.23

51% Attacks by MIT

Digital Signature Algorithm/Standard (DSA/DSS)

• Digital signatures are cryptographic equivalents of handwritten signatures, verifying the sender of a message.

• Due to the sizes of signatures, the hash of the message is signed instead of the message itself.

• Signatures must be verifiable.

• Provides data integrity, data origin authentication and non-repudiation.

• Each message's signature must be unique. Reusing signatures would compromise the system's integrity.

• Signatures need to be sufficiently long for unforgeability and security.

• Fingerprint, signing a document or file, email or e-state uses digital signatures.

“A short string of data a user produces for a document using a private key such that anyone with the corresponding public key, the signature, and the document can verify that (1) the document was "signed" by the owner of that particular private key, and (2) the document was not changed after it was signed.“

DSA By Ethereum

DSA by NIST

DSA/DSS

Digital signature algorithms are NOT encryption algorithms.

Elliptic Curve

• Used to generate the keys.

• The security of elliptic curve cryptosystems relies on mathematical problems.

• Elliptic curves are NOT ellipses but are named as such due to the similarity of their equations to those used in calculating ellipse circumferences.

• Shorter key sizes in elliptic curve cryptosystems provide similar security to larger keys in traditional systems, offering better memory usage and performance.

• Public keys and signatures are just points on an elliptic curve. If both of these points are created from the same private key, there will be a geometric connection between them that proves that the person who created the signatures also created the public key.

ECDSA (Elliptic Curve Digital Signature Algorithm)

• ECDSA uses an elliptic curve as the basis for a digital signature system.

Key Generation

dG = Q

• Private key (d): A large randomly generated number

• Public key (Q): The generator point G multiplied by this random number

• G is the generator point

Key Generation

Sign

• Random number (k): This introduces an element of randomness in to our signatures, which is important for security. It means that every signature we generate will be different, even if we sign the same message twice.

• Message hash (z): This is the hash of the message we want to sign. Hashing the message gives us a small and unique fingerprint for it, and it’s more efficient to sign this fingerprint than it is to sign a large blob of data.

• Private key (d): The source of a public key

• The random point on the curve (r): Take the random number k and multiply it by the generator point to get a random point

• A number to accompany the random point (s): This is a unique number created from a combination of the message hash z and d, which is also bound to the random point using r.

Sign

Digital Signature = [r, s]

Verify

• Public key (Q): This is the public key for the person claiming to have created the signature.

• Message: The data that was signed. We can hash it ourselves to get the message hash z.

• Signature [r, s]: This is the signature created for the above message, allegedly created by the person who has the private key for the public key.

Use these three pieces of data to calculate two points on the curve:

• Point 1. Start with the generator point G, and multiply it by inverse(s) * z.

• Point 2. Start with the public key point Q, and multiply it by inverse(s) * r.

Add these points together to give Point 3:

If this third point matches up with the random point given, the signature is valid.

Principles of Blockchains