CI Crypto-assets
Développer un point de vue de la cybersécurité sur les crypto-actifs et identifier les usages potentiels des crypto-actifs pour la cybersécurité
Catégorie : Communauté d'intérêt
Description
The emergence of Bitcoin in 2008 and its underlying technology, the blockchain, enabled the development of a decentralised and secure peer-to-peer payment system. The rise of Bitcoin paved the way for the development of other distributed ledger technologies, with more or less similar characteristics: public, private or permissioned ledgers, blockchains or acyclic graphs, block sizes, consensus algorithms, etc. With the advent of smart contracts stored on the blockchain, it is now possible to represent assets other than financial transactions on the blockchain. In addition to utility tokens, based on the ERC20 standard, which are mainly used in decentralised applications (Dapp), the community and various projects have developed new standards (ERC721) to represent physical or digital goods, NFTs, as well as "financial tokens similar to financial instruments" (Security Tokens), representing financial assets. Finally, with the growth of new verticals in the blockchain industry, such as decentralised finance, the gaming industry and metavers, the number of use cases will continue to increase and we will see a growing number of crypto assets emerge in the future.
Although the general interest is mainly in the various crypto-assets, we will also be looking at the technologies and tools that have been put in place to develop and improve these systems. We will be looking at several concepts: public blockchain, private blockchain, permission-based blockchain and, more generally, distributed ledger technologies, as well as other principles such as data structures like Merkle trees and open architecture. As well as zero-knowledge proofs (zk-SNARK or zk-STARK) used to ensure the anonymity of transactions in certain blockchains or to make blockchains more scalable with zk rollups.
In addition, concerns about the performance and scalability of the blockchain have led to the adoption of other cryptographic algorithms such as schnorr signatures, which are used by many crypto-currencies and have replaced previously more widespread algorithms such as ECDSA. These adoptions not only improve the system, but also bring about convergence and standardisation of best practice in the cryptoasset industry. It is important to spread these best practices across all industries via an open source cryptography approach.
In addition, the paradigm shift away from security being entirely the responsibility of the user has forced the developer ecosystem to work on solutions such as hardware wallets and multi-signature wallets.
We will also be looking at the different attack schemes on p2p protocols and their countermeasures. As well as identifying innovative tools for searching for cryptographic flaws.
Finally, blockchain and distributed ledger technologies are fundamentally based on the principles of cryptography in order to bring confidentiality, integrity and therefore greater security to the system. Cybersecurity concepts are omnipresent in the construction and evolution of the technologies that enable the development of crypto-assets. These innovations therefore provide fertile ground to help strengthen the security of more traditional systems such as digital identities, securing corporate data, respecting privacy and managing proof of transactions.
In addition, the rules and good practice of cyber security are not necessarily known or applied in this innovative field, and it will be essential to take them into account in the years to come.
🡪 The aim of this working group is to bring these two points of view together and to share common objectives between companies, institutions, research bodies conducting research into cybersecurity issues and players in the French ecosystem who are innovating in the field of crypto assets. The aim is to create innovative projects and find the associated funding to develop the French ecosystem in these areas.
The first key point of this group's work will be to identify relevant cybersecurity use cases for experimenting with new solutions from the world of crypto assets. These crypto-assets are increasingly referenced in new European regulatory proposals such as the revision of the eIDAS regulation.
The second key point will be to map out new areas of research into security-by-design methodologies, risk analysis and perhaps security assessment of these new crypto asset techniques. The management of potential vulnerabilities and associated cyber crises will have to be at the heart of our thinking, enabling the alliance of crypto freedom and the security of the assets that are managed in these innovative infrastructures.
The ultimate aim is to develop innovative cybersecurity projects using cryptoasset tools that guarantee a high level of security and innovative projects to secure cryptoassets. This dual issue must be analysed from two points of view: the cryptoasset ecosystem and the cybersecurity ecosystem.
Initial objectives
- Catalogue the concrete uses of the technologies developed around cryptoassets for cybersecurity: which sub-systems? which needs? which issues?
- Identify cybersecurity use cases using cryptoasset technologies to launch prototypes and/or innovative research projects.
- Draw up a catalogue of attacks on crypto assets (key theft, consensus bias issues, define potential attack segments).
Possible deliverables
- White paper presenting: tools from the world of crypto assets relevant to cybersecurity uses
- Security by design" requirements for infrastructures using crypto assets
- The needs of this R&D with cybersecurity issues that can be resolved through the use of crypto assets.
- A map of pilot projects sorted according to their purpose: challenge, joint creation, calls for projects.
- A summary of the issues to be addressed
- Catalogue of attacks (past, current, 3 years and 10 years ahead).
WG logbook Crypto-actif
On 12/10/23, the WG Crypto-Assets worked on
- Validating the audit plan configurations for the target nodes
- The arrangements for the Paris Blockchain Society conference
- Setting up a call for comments phase for the target nodes.
He took the decisions to:
- Schedule a technical meeting for the audit plan with the Red Team.
- Finalise the pentest agreement
- Propose an operating agreement for the confidentiality aspects
- Validate the benefits of implementing a CTI platform dedicated to Web3
On 31/08/23, the WG Crypto-assets worked on
- The audit plan for the node target. The objective will be to propose countermeasures to put on the node to make it more robust.
He took the decisions to:
- Make 2 nodes available to start the red team mission by testing and attacks and threats on the nodes.
- Add a crypto document to the target node
- Recruit people for the red team
- In parallel, start work on the smart contract target.
It should be noted that a meeting with the Banque de France lab has been scheduled to discuss the Innovation Challenge.
On 29/06/23, the WG Crypto-assets worked on'
- The target nodes: CLR labs has received various comments from the last members of the WG to fine-tune the few remaining details. These comments will be incorporated into the document next week. The document will therefore be finalised. The next stage is to audit the Node target, attacking the node with several Red Teams (ledger and exaion) to test the robustness of the target.
- The innovation challenge:
- The objective of the innovation challenge will be to propose and develop specific tools for detecting and potentially blocking cyber attacks in a blockchain environment using smart contracts.
- Tools of this type already exist, so it would be interesting at the time of the challenge to give the resources we already know about.
- The aim would be to create a link between the various tools, to create a toolbox: "Bringing Web3 into the CERT".
- Prizes for the winners have yet to be determined.
He made the decisions to:
- Finalise the target nodes next week
- Plan a meeting next Friday to define the audit plan
- To name the innovation challenge "Bringing Web3 to CERT".
- To cancel the WGs held in mid-July and early August. The next session will take place at the end of August.
Le 08/06/23, le GT Crypto-actifs a travaillé sur
- Le document sur la cible d'évaluation Nœuds
Il a pris les décisions de :
- Finaliser le document pour la prochaine session, le 29 juin
- Réaliser un plan d'audit pour tester le produit sur des nœuds puis faire un RETEX
- Commencer la rédaction de la cible Smart Contract en tant compte de l'audit de test réalisé pour la cible Nœuds.
Le 13/04/23, le GT Crypto-actifs a travaillé sur
- Le cas d'usage du Challenge Innovation. Il ressort des discussions qu'il serait intéressant de développer une boite à outils, un dashboard sur le Web3 capable de gérer les incidents et de les analyser. Une sorte de SOC du Web3.
- Le schéma du ToE pour la cible Nœuds. Il est nécessaire de le repréciser et d'expliciter le fait que l'algo de consensus doit être contrôlé.
Il a pris les décisions de :
- Se concentrer sur la rédaction de la cible Nœuds
- Perfectionner le schéma du ToE
- La prochaine session sera dédiée à un atelier de travail sur la rédaction de la cible Nœuds.
Le 16/03/23, le GT Crypto-actifs a travaillé sur
- Les cas d’usage du Challenge Innovation
- Le périmètre des CSPN
Il a pris les décisions de :
- Soutenir le cas d’usage sur la détection des attaques dans un environnement décentralisé de type blockchain intégrant des smart contracts auprès de la Banque de France
- D’appliquer les CSPN sur un exemple d’asset (nœuds et smart contract) et d’en sortir les spécifications génériques et communes à ces asset
Il est à noter que les ateliers V2 sont programmés et auront lieu avant la fin de mois. La prochaine réunion avec la Banque de France pour valider le Challenge innovation aura lieu le 27.03.23
Le 23/02/23, le GT Crypto-actifs a travaillé sur
- La première ébauche du document sur la cible de sécurité CSPN sur les nœuds d'une blockchain
- L'étude de nouvelles propositions et cas d'usage pour le Challenge Innovation
Il a pris les décisions de :
- Refaire le travail sur la cible de sécurité avec une autre blockchain que Ethereum pour identifier d'autres menaces
- Soumettre un nouveau cas d'usage pour le Challenge Innovation à la Banque de France
- Contacter Ledger
Le 02/02/23, le GT Crypto-actifs a travaillé sur
- Le planning sur la rédaction des cibles de sécurité
- La répartition des membres du GT sur chaque atelier
Il a pris les décisions de :
- Organiser les deux ateliers relatifs aux noeuds et aux smart contract
- Contacter Ledger
Les sujets d'intégrer le BSI et Ledger ont éclos.
Il est à noter que l'équipe va travailler en trinôme sur les sujets de noeuds et smart contract.
Le 12/01/23, le GT Crypto-actifs a travaillé sur
- La méthodologie de travail CSPN
- La méthodologie de production d’un TOE dédié aux nœuds et aux smart contract
Il a pris les décisions de :
- Finaliser le document de cadrage du Challenge innovation
- Identifier des experts et des nouveaux membres
- Ré écriture du document chapeau et du planning de réalisation
Il est à noter que la cible CSPN va s’appuyer sur un master node/stacking Ethereum spécifique.
Le 01/12/22, le GT Crypto-actifs a travaillé sur
- La note de cadrage du Challenge innovation
''Il a pris les décisions de :
- Finaliser le document et aller le présenter auprès de la Banque de France
- Contacter l'inter CERT pour valider un des scénarios du challenge
- Valider les contours de la mise en place du Challenge innovation
Les autres sujets discutés :
- La diffusion du Challenge innovation
Le 10/11/22, le GT Crypto-actifs a travaillé sur
- La définition d’un sujet pour initier un Challenge innovation sur les Crypto-actifs
Il a pris les décisions de :
- Définir un cas d’usage autour d’une blockchain Campus Cyber
- Faire une réunion en amont du prochain GT pour discuter du CSPN appliqué aux crypto-actifs
Les autres sujets discutés :
- La rédaction d’une analyse de risque sur le texte du Council concernant l'e-identité qui sortira en janvier 2023.
Groupes de travail
| Status | Description | |
|---|---|---|
| Crypto - actifs : Cible d'évaluation - Smart Contracts | En cours | Cible d'évaluation de Smart contracts exécutés par l’EVM. |
| Crypto-actif : Cible d'évaluation - Noeud Ethereum | Terminé | Cible d'évaluation de nœuds instanciés sur clients Ethereum |
| GT Crypto-actif - Pentest noeud Ethereum | En cours | Audit des nœuds de validation Ethereum et recommandations pour leur sécurisation |
| GT Crypto-actif : Catalogue d'attaques | Terminé | Référencer et suivre l'évolution des cyberattaques sur les crypto-actifs |
