Skip to main content
SpringerLink
Log in
Book cover

International Workshop on Data Privacy Management

International Workshop on Cryptocurrencies and Blockchain Technology

DPM 2018, CBT 2018: Data Privacy Management, Cryptocurrencies and Blockchain Technology pp 94–110Cite as

Contour: A Practical System for Binary Transparency

Part of the Lecture Notes in Computer Science book series (LNSC,volume 11025)

Abstract

Transparency is crucial in security-critical applications that rely on authoritative information, as it provides a robust mechanism for holding these authorities accountable for their actions. A number of solutions have emerged in recent years that provide transparency in the setting of certificate issuance, and Bitcoin provides an example of how to enforce transparency in a financial setting. In this work we shift to a new setting, the distribution of software package binaries, and present a system for so-called “binary transparency.” Our solution, Contour, uses proactive methods for providing transparency, privacy, and availability, even in the face of persistent man-in-the-middle attacks. We also demonstrate, via benchmarks and a test deployment for the Debian software repository, that Contour is the only system for binary transparency that satisfies the efficiency and coordination requirements that would make it possible to deploy today.

This is a preview of subscription content, access via your institution.

Chapter
USD   29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD   59.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD   79.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Learn about institutional subscriptions

Notes

  1. 1.

    https://en.bitcoin.it/wiki/Generation_Calculator.

  2. 2.

    blockchain.info/charts/hash-rate.

  3. 3.

    www.amazon.com/Antminer-S9-0-10W-Bitcoin-Miner/dp/B01GFEOV0O.

  4. 4.

    https://blockchain.info/charts/n-transactions-per-block.

  5. 5.

    www.debian.org/mirror/list.

  6. 6.

    snapshot.debian.org/.

References

  1. Security/binary transparency - mozillawiki (2017). https://wiki.mozilla.org/Security/Binary_Transparency

  2. Apostolaki, M., Zohar, A., Vanbever, L.: Hijacking Bitcoin: Large-scale Network Attacks on Cryptocurrencies (2016). arXiv:abs/1605.07524

  3. Basin, D., Cremers, C., Kim, T.H.-J., Perrig, A., Sasse, R., Szalachowski, P.: ARPKI: attack resilient public-key infrastructure. In: ACM CCS 2014, pp. 382–393 (2014)

    Google Scholar 

  4. Bonneau, J.: EthIKS: using ethereum to audit a CONIKS key transparency log. In: Clark, J., Meiklejohn, S., Ryan, P.Y.A., Wallach, D., Brenner, M., Rohloff, K. (eds.) FC 2016. LNCS, vol. 9604, pp. 95–105. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53357-4_7

    CrossRef  Google Scholar 

  5. Chase, M., Meiklejohn, S.: Transparency overlays and applications. In: ACM SIGSAC Conference on Computer and Communications Security (2016)

    Google Scholar 

  6. Chuat, L., Szalachowski, P., Perrig, A., Laurie, B., Messeri, E.: Efficient gossip protocols for verifying the consistency of certificate logs. In: IEEE Conference on Communications and Network Security (2015)

    Google Scholar 

  7. Dowling, B., Günther, F., Herath, U., Stebila, D.: Secure logging schemes and certificate transparency. In: Askoxylakis, I., Ioannidis, S., Katsikas, S., Meadows, C. (eds.) ESORICS 2016. LNCS, vol. 9879, pp. 140–158. Springer, Cham (2016). https://doi.org/10.1007/978-3-319-45741-3_8

    CrossRef  Google Scholar 

  8. Eijdenberg, A., Laurie, B., Cutter, A.: Verifiable Data Structures (2015). github.com/google/trillian/blob/master/docs/VerifiableDataStructures.pdf

  9. Eskandarian, S., Messeri, E., Bonneau, J., Boneh, D.: Certificate transparency with privacy. CoRR, abs/1703.02209 (2017)

    Google Scholar 

  10. Eyal, I., Sirer, E.G.: Majority is not enough: bitcoin mining is vulnerable. In: Financial Cryptography and Data Security (2014)

    Google Scholar 

  11. Farivar, C.: Judge: Apple must help FBI unlock San Bernardino shooter’s iPhone (2016). arstechnica.com/tech-policy/2016/02/judge-apple-must-help-fbi-unlock-san-bernardino-shooters-iphone/

  12. Fromknecht, C., Velicanu, D., Yakoubov, S.: A decentralized public key infrastructure with identity retention. IACR Cryptology ePrint Archive, Report 2014/803 (2014). eprint.iacr.org/2014/803.pdf

  13. Gervais, A., Ritzdorf, H., Karame, G., Capkun, S.: Tampering with the delivery of blocks and transactions in bitcoin. In: ACM CCS 2015 (2015)

    Google Scholar 

  14. Goodin, D.: “Flame” malware was signed by rogue Microsoft certificate (2012). arstechnica.com/security/2012/06/flame-malware-was-signed-by-rogue-microsoft-certificate/

  15. Heilman, E., Kendler, A., Zohar, A., Goldberg, S.: Eclipse attacks on bitcoin’s peer-to-peer network. In: USENIX Security 2015 (2015)

    Google Scholar 

  16. Kim, T.H.-J., Huang, L.-S., Perrig, A., Jackson, C., Gligor, V.: Accountable key infrastructure (AKI): a proposal for a public-key validation infrastructure. In: WWW 2013, pp. 679–690 (2013)

    Google Scholar 

  17. Kogias, E.K., Jovanovic, P., Gailly, N., Khoffi, I., Gasser, L., Ford, B.: Enhancing bitcoin security and performance with strong consistency via collective signing. In: USENIX Security 2016 (2016)

    Google Scholar 

  18. Laurie, B., Langley, A., Kasper, E.: Certificate Transparency (2013)

    Google Scholar 

  19. Leyden, J.: Inside ’Operation Black Tulip’: DigiNotar hack analysed (2011). www.theregister.co.uk/2011/09/06/diginotar_audit_damning_fail/

  20. Matsumoto, S., Reischuk, R.M.: IKP: Turning a PKI Around with Blockchains. IACR Cryptology ePrint Archive, Report 2016/1018 (2016). eprint.iacr.org/2016/1018

  21. Melara, M.S., Blankstein, A., Bonneau, J., Felten, E.W., Freedman, M.J.: CONIKS: bringing key transparency to end users. In: USENIX Security 2015 (2015)

    Google Scholar 

  22. Nakamoto, S.: Bitcoin: a peer-to-peer electronic cash system (2008). bitcoin.org/bitcoin.pdf

  23. Nikitin, K., et al.: CHAINIAC: Proactive software-update transparency via collectively signed skipchains and verified builds. In: 26th USENIX Security Symposium (USENIX Security 17), pp. 1271–1287 (2017). USENIX Association, Vancouver

    Google Scholar 

  24. Nordberg, L., Gillmor, D., Ritter, T.: Gossiping in CT (2016). tools.ietf.org/html/draft-ietf-trans-gossip-03

  25. Ryan, M.D.: Enhanced certificate transparency and end-to-end encrypted mail. In: NDSS 2014 (2014)

    Google Scholar 

  26. Singh, A., Ngan, T.-W.J., Druschel, P., Wallach, D.S.: Eclipse attacks on overlay networks: threats and defenses. In: IEEE Conference on Computer Communications (2006)

    Google Scholar 

  27. Syta, E., et al.: Keeping authorities “honest or bust” with decentralized witness cosigning. In: IEEE Symposium on Security and Privacy (“Oakland”) (2016)

    Google Scholar 

  28. Tomescu, A., Devadas, S.: Catena: Efficient Non-equivocation via Bitcoin. In: IEEE Symposium on Security and Privacy (“Oakland”) (2017)

    Google Scholar 

Download references

Acknowledgements

Mustafa Al-Bassam is supported by a scholarship from the Alan Turing Institute, and Sarah Meiklejohn is supported by EPSRC grant EP/N028104/1.

Author information

Authors and Affiliations

  1. University College London, London, UK

    Mustafa Al-Bassam & Sarah Meiklejohn

Authors
  1. Mustafa Al-Bassam
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Sarah Meiklejohn
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Mustafa Al-Bassam .

Editor information

Editors and Affiliations

  1. Télécom SudParis, Evry, France

    Joaquin Garcia-Alfaro

  2. Enginyeria de la Informacio I de les Com, Universitat Autonoma de Barcelona, Bellaterra, Spain

    Jordi Herrera-Joancomartí

  3. Università degli Studi di Milano, Crema, Italy

    Dr. Giovanni Livraga

  4. Universidad de Málaga, Málaga, Spain

    Ruben Rios

Rights and permissions

Reprints and Permissions

Copyright information

© 2018 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Al-Bassam, M., Meiklejohn, S. (2018). Contour: A Practical System for Binary Transparency. In: Garcia-Alfaro, J., Herrera-Joancomartí, J., Livraga, G., Rios, R. (eds) Data Privacy Management, Cryptocurrencies and Blockchain Technology. DPM CBT 2018 2018. Lecture Notes in Computer Science(), vol 11025. Springer, Cham. https://doi.org/10.1007/978-3-030-00305-0_8

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-00305-0_8

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-00304-3

  • Online ISBN: 978-3-030-00305-0

  • eBook Packages: Computer ScienceComputer Science (R0)

search

Navigation