5

One of the key tenets of Blockchain technology is that it is a trustless, distributed ledger which removes the need for a trusted (but hackable) third party to oversee the veracity of transactions (e.g. a bank). The original concept was implemented in Bitcoin and depended upon "miners" to verify the authenticity and ordering of transactions. These miners are owned by participants in the blockchain and no one is able to control all (or even a significant number of) the miners in the network, thus rendering the system secure.

We now have the concept of "blockchain as a service" from providers like Microsoft and others, where apparently there is no need for miners: so does this mean that the technology provider just became a replacement trusted third party and if so what prevents them from being a weak (hackable) link which would undermine the whole purpose?

2 Answers 2

3

First lets distinguish between a blockchain and Blockchain as a Service (BaaS), because they're two different things.

Bitcoin, and other crypto-currencies, use a distributed ledger in a peer-to-peer network - a blockchain. This is the original use of a blockchain. As you state correctly, the fundamental concept is that it is decentralized, permissionless and trustless. There is no central management, anybody can use it and it does not require trusting in a third party. For Bitcoin, and other crypto-currencies, the peer-to-peer (P2P) network propagates transactions, verifies the transactions as valid, and then adds these transactions to the blockchain. Bitcoin is the first blockchain application to create a cryptocurrency. Ethereum is a cryptocurrency which is also a platform for running distributed applications (DApps).

Software corporations like Microsoft and IBM are offering Blockchain as a Service. This is something completely different than a cryptocurrency. It's closer to what Amazon provides with it's AWS cloud platform. If you're not familiar with cloud computing platforms get up to speed on that.

Looking at Microsoft's blockchain solutions and IBM's blockchain solutions you can say that BaaS provides tools, infrastructure and/or a simulated network environment for companies to develop their own blockchain applications. These blockchains may be on an established decentralized public platform like Ethereum, or it might be a private permissioned blockchain.

A private blockchain is not anything like permissionless Bitcoin or Ethereum cryptocurrencies. Comparing a private blockchain with Bitcoin is analogous to what the public internet is to a private LAN. It may use concepts like proof-of-work mining or other features of Bitcoin, but it's entirely different thing essentially. I'm not sure exactly how companies are finding this more valuable than simply using a database. Maybe there's good reason or maybe it's largely hype and wanting to get on the blockchain bandwagon.

A private blockchain would require a P2P network, but there would be a restriction on what nodes could access and interact with the network. Also the software would be closed source and not freely available. In contrast crypto-currencies like Bitcoin and Ethereum are open-source and anybody is free to participate in the P2P network.

Going back to the specific questions you had: Does this mean that the technology provider just became a replacement trusted third party and if so what prevents them from being a weak (hackable) link which would undermine the whole purpose?

As explained already BaaS provides tools and infrastructure for other companies to create blockchain applications. There is no "Microsoft Blockchain". It's up to individual companies to create either public or private blockchain applications however they like. In general and ideally blockchain applications are peer-to-peer and decentralized.

If it is an Ethereum DApp then ultimately it would run on the public internet on Ethereum platform in distributed way without any centralized reliance on third parties. If it is a private blockchain, then it will be a hybrid of decentralized and centralized architecture and not anything like Bitcoin or Ethereum.

2
  • Can you please elaborate answer the main question? Does it really replace Trusted Third Party? Why not? Thanks
    – sanket1729
    Jun 21, 2017 at 3:23
  • Hopefully it's clear now
    – MrJLP
    Jun 21, 2017 at 6:02
0

TL;DR: It depends on the deployment and on who dictates consensus on the blockchain. If it's the provider then, yes, the provider is a single point of failure (assuming a non-diverse deployment). If users participate in the consensus algorithm then, with some care, the provider could be trusted with only storage and availability.

Your question

[...] concept of "blockchain as a service" [...] where apparently there is no need for miners: so does this mean that the technology provider just became a replacement trusted third party

This depends on how the users of this blockchain reach agreement on it. If users simply trust the "blockchain as a service" provider to dictate consensus on what the blockchain is, then, yes, the provider is the only trusted 3rd party.

However, if users take part in the consensus protocol, voting on what the current valid blockchain is by verifying transactions, executing smart contracts and so on, then not necessarily. The provider can merely be trusted with availability and storage while 2f+1 users out of the total 3f+1 users are trusted to vote correctly on what the valid blockchain is (see [6]). There are various design points that could be explored.

In this last case, however, the blockchain provider or someone else has to be trusted for admission control: who is allowed to vote on what the current valid blockchain is? Someone has to let people in and out. And if they're not careful, it's very easy to attack the system: just add a bunch of fake extra voters that swing the election your way (see [7]).

Put another way, if you're not going to mine (i.e., do proof-of-work/stake/etc.), then you can't defeat "fake voter" attacks (see [7]), so your system needs to be permissioned: it needs a trusted party that does admission control.

[...] if so what prevents them from being a weak (hackable) link which would undermine the whole purpose?

Assuming the blockchain provider dictates consensus, not much. Unless a "blockchain as a service" deployment spans multiple administrative domains (e.g., clouds from 5 different continents) it will be easier to undermine.

By the way, if we stop and think, then the whole "blockchain as a service" philosophy is self-defeating: it gets us farther away from a blockchain like Bitcoin, not closer. Consider this: From a security perspective, why do we need a provider of a "blockchain service" anyway? If it's gonna dictate consensus on the blockchain, then it's a trusted third party. And if it's not going to, then we don't need it to begin with: we can just replicate the blockchain and agree on it ourselves.

The answer, I suspect, has to do with all the hype around "blockchain." Everybody wants one, missing the bigger point: we're all supposed to share one (for security), not have our own.

Nitpicking your assumptions

One of the key tenets of Blockchain technology is that it is a trustless, distributed ledger [...]

Regardless of what "blockchain technology" means nowadays, it's misleading to call it a trustless distributed ledger. In Bitcoin, Ethereum and z.cash, for example, users like me and you have to trust many things:

  1. That miners are actually incentivized to only mine on the longest chain (see [1] and [2]).
  2. That both the overlay network (P2P) and the underlying network (the Internet) between miners is reliable: it delivers blocks on time (see [3] and [4]).
  3. That attackers are not rich enough to reverse your transactions by adversarially mining. Or, that your transactions are not worth it (see [5]).
  4. That there are no other errors in the design: e.g., what happens with z.cash's security when miners jump from mining one cryptocurrency to another compatible one as they deem it profitable?
  5. That there are no bugs in the code.

...and much more.

[...] removes the need for a trusted (but hackable) third party to oversee the veracity of transactions (e.g. a bank).

Sure, there's no single trusted 3rd party. In Bitcoin there are around 20 now (or, however many big mining pools Bitcoin has, assuming they don't collude). Maybe z.cash and Ethereum are more decentralized due to their memory-hard proof-of-work, but it remains to be seen how long that will last.

Also, because there is no single (or distributed) trusted 3rd party, the network now plays a critical role in the system's security [3, 4].

[...] no-one being able to control all (or even a significant number of) the miners in the network, thus rendering the system as secure.

GHash.IO controlled over 50% at some point in the summer of 2014. Once again, it remains to be seen whether a single entity or multiple colluding entities can (again!) control more than 50% of the computational power in the network.

References

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.