Hacker News Reader

Comment by zmanian | Hacker News Reader

Guardtime is set of tooling around a FIPS 140 timestamping appliance. Systems on the network submit hashes of their logs to the time stamping. Assuming the appliance remains secure, you can go back in the event of compromise and prove that your logs are unaltered up to a certain point.

It's amazing that they seem to have built a $50 -$100 million dollar business here.

View on HN

RSA key fobs were an extremely simple invention, yet they are ubiquitous in enterprise. Often the value of a product lies not in its technical sophistication, but in whether that product solves an unmet business need. Spotting these opportunities is the difficult part. That is where these entrepreneurs add value.

Well, when your adversaries are the likes of China, Russia, multibillion dollar corporations, powerful domestic adversaries, etc... you'd want to be absolutely certain your safeguards are as strong as possible.

>> "Assuming the appliance remains secure"

Makes me wonder what mathematics would prove this, or if it's assumed to be out of scope, and if so, what else is out of scope too.

The article mentioned that the project includes formal verification. From a moment scanning Galois' web page: https://galois.com/research-development/software-correctness...

I'm pretty sure the Guardtime product is a Merkle tree of timestamps. I'm also pretty sure whatever protocol they use to maintain it would _not_ be immediately recognized as a "blockchain" protocol. Of course the protocol can be modeled and checked. The question is why does anyone think that this activity can apply to "blockchains" in general. But, welcome to the world of industrial research funding.

(I work for Guardtime; I’m happy to answer any questions.) Some online resources might not make it very clear, but the KSI blockchain is indeed a blockchain; for example, new blocks are released periodically (1 block per second on average), and the new blocks contain hashes of the previous blocks, among other things. Then, blocks get distributed around so that users can verify their data against these blocks, etc.

Most people associate "blockchains" with a protocol by which the "blocks" are inserted. Usually these things revolve around proof-of-work, proof-of-stake, proof-of-space, fairness criteria, etc. I think everyone gets that the Guardtime product is hashtree. From a formal verification perspective, the critical behavior is probably in the protocol, and most likely not the implementation of the datastructure or database.

One way to look at it is that KSI is a proof of stake blockchain where the stakeholders are (mostly) fixed. Often people would call that a private blockchain (or a consortium blockchain), to use the terminology from the following article:

https://blog.ethereum.org/2015/08/07/on-public-and-private-b...

Thanks for that clarification! It is a great pleasure to talk with an knowledgeable person like you.

> 1 block per second on average

What stops a double-spend or other attacks like that in a 1-second timeframe? The 10 minute threshold of Bitcoin was chosen under belief that the network would be settled after roughly 10 minutes.

The speed comes from the fact that private and consortium blockchains tend not use Proof of Work (at least not as the only algorithm; you could mix and match, if you wanted to). Instead, such blockchains tend to use voting-based protocols (e.g. Proof of Stake), where a certain subset of nodes are trusted with voting rights, who together vote to approve the next block. In some systems you also have automatic punishments built in to incentivise correct behaviour (i.e., if someone attempts to fork a blockchain --- for example by voting for 2 conflicting forks -- and if other nodes see any evidence of that, the node who attempted the fork could automatically lose their rights as a trusted validator, and may also automatically lose a lot of money or face legal fees.)

I'm from Guardtime - this is our secure appliance that we built with a team of engineers coming out of the US Military Ant-Tamper community: http://bit.ly/2cgXiDu

Redirected link from bitly link above:

https://media.voog.com/0000/0036/0235/files/Black_Lantern_da...

What's wrong with posting a bitly link?

Transparency

I was just reading the Wikipedia page on Linked timestamping yesterday. Though I don't know that this is what Galois & Guardtime are doing.

https://en.wikipedia.org/wiki/Linked_timestamping

Reply on news.ycombinator.com