CI Crypto-assets
Développer un point de vue de la cybersécurité sur les crypto-actifs et identifier les usages potentiels des crypto-actifs pour la cybersécurité
Catégorie : Communauté d'intérêt
Statut : En cours
Description
The emergence of Bitcoin in 2008 and its underlying technology, the blockchain, enabled the development of a decentralised and secure peer-to-peer payment system. The rise of Bitcoin paved the way for the development of other distributed ledger technologies, with more or less similar characteristics: public, private or permissioned ledgers, blockchains or acyclic graphs, block sizes, consensus algorithms, etc. With the advent of smart contracts stored on the blockchain, it is now possible to represent assets other than financial transactions on the blockchain. In addition to utility tokens, based on the ERC20 standard, which are mainly used in decentralised applications (Dapp), the community and various projects have developed new standards (ERC721) to represent physical or digital goods, NFTs, as well as "financial tokens similar to financial instruments" (Security Tokens), representing financial assets. Finally, with the growth of new verticals in the blockchain industry, such as decentralised finance, the gaming industry and metavers, the number of use cases will continue to increase and we will see a growing number of crypto assets emerge in the future.
Although the general interest is mainly in the various crypto-assets, we will also be looking at the technologies and tools that have been put in place to develop and improve these systems. We will be looking at several concepts: public blockchain, private blockchain, permission-based blockchain and, more generally, distributed ledger technologies, as well as other principles such as data structures like Merkle trees and open architecture. As well as zero-knowledge proofs (zk-SNARK or zk-STARK) used to ensure the anonymity of transactions in certain blockchains or to make blockchains more scalable with zk rollups.
In addition, concerns about the performance and scalability of the blockchain have led to the adoption of other cryptographic algorithms such as schnorr signatures, which are used by many crypto-currencies and have replaced previously more widespread algorithms such as ECDSA. These adoptions not only improve the system, but also bring about convergence and standardisation of best practice in the cryptoasset industry. It is important to spread these best practices across all industries via an open source cryptography approach.
In addition, the paradigm shift away from security being entirely the responsibility of the user has forced the developer ecosystem to work on solutions such as hardware wallets and multi-signature wallets.
We will also be looking at the different attack schemes on p2p protocols and their countermeasures. As well as identifying innovative tools for searching for cryptographic flaws.
Finally, blockchain and distributed ledger technologies are fundamentally based on the principles of cryptography in order to bring confidentiality, integrity and therefore greater security to the system. Cybersecurity concepts are omnipresent in the construction and evolution of the technologies that enable the development of crypto-assets. These innovations therefore provide fertile ground to help strengthen the security of more traditional systems such as digital identities, securing corporate data, respecting privacy and managing proof of transactions.
In addition, the rules and good practice of cyber security are not necessarily known or applied in this innovative field, and it will be essential to take them into account in the years to come.
🡪 The aim of this working group is to bring these two points of view together and to share common objectives between companies, institutions, research bodies conducting research into cybersecurity issues and players in the French ecosystem who are innovating in the field of crypto assets. The aim is to create innovative projects and find the associated funding to develop the French ecosystem in these areas.
The first key point of this group's work will be to identify relevant cybersecurity use cases for experimenting with new solutions from the world of crypto assets. These crypto-assets are increasingly referenced in new European regulatory proposals such as the revision of the eIDAS regulation.
The second key point will be to map out new areas of research into security-by-design methodologies, risk analysis and perhaps security assessment of these new crypto asset techniques. The management of potential vulnerabilities and associated cyber crises will have to be at the heart of our thinking, enabling the alliance of crypto freedom and the security of the assets that are managed in these innovative infrastructures.
The ultimate aim is to develop innovative cybersecurity projects using cryptoasset tools that guarantee a high level of security and innovative projects to secure cryptoassets. This dual issue must be analysed from two points of view: the cryptoasset ecosystem and the cybersecurity ecosystem.
Initial objectives
- Catalogue the concrete uses of the technologies developed around cryptoassets for cybersecurity: which sub-systems? which needs? which issues?
- Identify cybersecurity use cases using cryptoasset technologies to launch prototypes and/or innovative research projects.
- Draw up a catalogue of attacks on crypto assets (key theft, consensus bias issues, define potential attack segments).
Possible deliverables
- White paper presenting: tools from the world of crypto assets relevant to cybersecurity uses
- Security by design" requirements for infrastructures using crypto assets
- The needs of this R&D with cybersecurity issues that can be resolved through the use of crypto assets.
- A map of pilot projects sorted according to their purpose: challenge, joint creation, calls for projects.
- A summary of the issues to be addressed
- Catalogue of attacks (past, current, 3 years and 10 years ahead).
WG logbook Crypto-actif
On 12/10/23, the WG Crypto-Assets worked on
- Validating the audit plan configurations for the target nodes
- The arrangements for the Paris Blockchain Society conference
- Setting up a call for comments phase for the target nodes.
He took the decisions to:
- Schedule a technical meeting for the audit plan with the Red Team.
- Finalise the pentest agreement
- Propose an operating agreement for the confidentiality aspects
- Validate the benefits of implementing a CTI platform dedicated to Web3
On 31/08/23, the WG Crypto-assets worked on
- The audit plan for the node target. The objective will be to propose countermeasures to put on the node to make it more robust.
He took the decisions to:
- Make 2 nodes available to start the red team mission by testing and attacks and threats on the nodes.
- Add a crypto document to the target node
- Recruit people for the red team
- In parallel, start work on the smart contract target.
It should be noted that a meeting with the Banque de France lab has been scheduled to discuss the Innovation Challenge.
On 29/06/23, the WG Crypto-assets worked on'
- The target nodes: CLR labs has received various comments from the last members of the WG to fine-tune the few remaining details. These comments will be incorporated into the document next week. The document will therefore be finalised. The next stage is to audit the Node target, attacking the node with several Red Teams (ledger and exaion) to test the robustness of the target.
- The innovation challenge:
- The objective of the innovation challenge will be to propose and develop specific tools for detecting and potentially blocking cyber attacks in a blockchain environment using smart contracts.
- Tools of this type already exist, so it would be interesting at the time of the challenge to give the resources we already know about.
- The aim would be to create a link between the various tools, to create a toolbox: "Bringing Web3 into the CERT".
- Prizes for the winners have yet to be determined.
He made the decisions to:
- Finalise the target nodes next week
- Plan a meeting next Friday to define the audit plan
- To name the innovation challenge "Bringing Web3 to CERT".
- To cancel the WGs held in mid-July and early August. The next session will take place at the end of August.
On 08/06/23, the WG Crypto-assets worked on
- The Nodes evaluation target document
It took the following decisions:
- Finalise the document for the next session on 29 June.
- Carry out an audit plan to test the product on nodes and then produce a REX.
- Begin drafting the Smart Contract target, taking into account the test audit carried out for the Nodes target.
On 13/04/23, the WG Crypto-assets worked on'
- The Challenge Innovation use case. It emerged from the discussions that it would be interesting to develop a toolbox, a Web3 dashboard capable of managing and analysing incidents. A sort of Web3 SOC.
- The ToE diagram for the Nodes target. It needs to be clarified and the fact that the consensus algo needs to be controlled needs to be made explicit.
He made the decisions to:
- Concentrate on drafting the Nodes target
- Refine the ToE diagram
- The next session will be devoted to a workshop on drafting the Nodes target.
On 16/03/23, the WG Crypto-assets worked on'
- Use cases for the Innovation Challenge
- The scope of CSPNs
He made the decisions to:
- To support the use case on the detection of attacks in a decentralised environment of the blockchain type integrating smart contracts at the Banque de France
- To apply the CSPN to an example of an asset (nodes and smart contracts) and to produce generic specifications common to these assets.
Note that the V2 workshops are scheduled to take place before the end of the month. The next meeting with the Banque de France to validate the Innovation Challenge will take place on 27.03.23.
On 23/02/23, the WG Crypto-assets worked on'
- The first draft of the CSPN security target document for blockchain nodes.
- The study of new proposals and use cases for the Innovation Challenge
He made the decisions to:
- Redo the work on the security target with a blockchain other than Ethereum to identify other threats.
- Submit a new use case to the Banque de France for the Innovation Challenge.
- Contact Ledger
On 02/02/23, the WG Crypto-assets worked on'
- The schedule for drafting security targets
- The allocation of WG members to each workshop
It decided to:
- Organise the two workshops on nodes and smart contracts.
- Contact Ledger
The idea of joining the BSI and Ledger was born.
It should be noted that the team will be working in triads on the subjects of nodes and smart contracts.
On 12/01/23, the WG Crypto-assets worked on
- The CSPN working methodology
- The methodology for producing a TOE dedicated to nodes and smart contracts.
It took the following decisions:
- Finalise the framework document for the Innovation Challenge
- Identify experts and new members
- Rewrite the umbrella document and the timetable for implementation
It should be noted that the CSPN target will rely on a specific Ethereum master node/stacking.
On 01/12/22, the WG Crypto-assets worked on
- The framework note for the Innovation Challenge
He decided to:
- Finalise the document and present it to the Banque de France
- Contact the inter CERT to validate one of the challenge scenarios
- Validate the contours of the implementation of the Innovation Challenge
Other topics discussed:
- Distribution of the Innovation Challenge
On 10/11/22, the WG Crypto-assets worked on
- Defining a topic for an Innovation Challenge on Crypto-assets
He took the decisions to:
- Define a use case for a Cyber Campus blockchain.
- To hold a meeting ahead of the next WG to discuss CSPN as applied to crypto-assets.
Other topics discussed:
- The drafting of a risk analysis on the Council's text on e-identity, which will be published in January 2023.
Groupes de travail
| Status | Description | |
|---|---|---|
| Crypto - actifs : Cible d'évaluation - Smart Contracts | En cours | Cible d'évaluation de Smart contracts exécutés par l’EVM. |
| Crypto-actif : Cible d'évaluation - Noeud Ethereum | Terminé | Cible d'évaluation de nœuds instanciés sur clients Ethereum |
| GT Crypto-actif - Pentest noeud Ethereum | En cours | Audit des nœuds de validation Ethereum et recommandations pour leur sécurisation |
| GT Crypto-actif : Catalogue d'attaques | Terminé | Référencer et suivre l'évolution des cyberattaques sur les crypto-actifs |
