With the ever-increasing sophistication of digital tools, it’s now possible to alter digital photographs or videos with enough sophistication that it’s often extremely difficult to tell if they’ve been tampered with. In 2018, eMarketer estimated that there will be 4.57 billion people with mobile phones, not to mention huge numbers of security cameras, laptops, etc., all with image sensors capable of taking and transmitting digital images to the Internet.

Dave Maher speaking at Block World

With the ever-increasing sophistication of digital tools, it’s now possible to alter digital photographs or videos with enough sophistication that it’s often extremely difficult to tell if they’ve been tampered with. In 2018, eMarketer estimated that there will be 4.57 billion people with mobile phones, not to mention huge numbers of security cameras, laptops, etc., all with image sensors capable of taking and transmitting digital images to the Internet. In today’s world where random images can be instantly shared amongst millions of people, how can we trust what we see?

At a recent blockchain themed event in Silicon Valley, Intertrust’s CTO David Maher discussed an Intertrust R&D project that could be an answer. Code-named TIDALs (Trusted Immutable Distributed Assertion Ledgers), the project uses a combination of blockchain and trusted assertions to create the technical underpinnings of a digital trust infrastructure that could scale to meet this challenge. A self-proclaimed blockchain skeptic, Maher noted that “This is one area that I have been working in for 35 years and I think that blockchains can play a big role.”

Replacing Today’s Digital Certificates

Today’s digital trust infrastructure relies to a great extent on digital certificates, also known as certs. Dating back to the 1980s, digital certificates are widely used to authenticate devices and services such as SSL encrypted webserver traffic, encrypted e-mails, cable modems, set-top boxes, etc. While certs have played an essential role in the security of our digital world so far, to maintain the security of the vast number of connected devices as the “Internet of Everything” marches forward, Maher says that another technology is needed. Pointing out that as more and more IoT devices come online, he says that securing these devices at their expected scale will be difficult for current security techniques such as network security and certs.

Maher notes that while X.509 certs have worked well in his 35 years of experience in using them, they will have problems adapting to the scale and ubiquity of the expected tsunami of connected devices. Other issues with certs are that “they are hard to manage and once they are compromised, recovery is very hard” (Maher). At that point all the keys signed with that cert have now become untrustworthy and anything that uses them has to be recertified with new trusted certs.

Then there is the problem of relying on centralized cert management authorities that are mainly focused on key management. These organizations are not ideally set up for managing constantly changing attributes associated with the keys. One example that Maher brought up is a company might use a cert to authenticate an employee to perform a task one day but that employee may no longer be in that position the next day.

Moving to TIDALs

One thing that needs to be clear is that Maher isn’t calling for a quick retirement of the entire cert infrastructure but a gradual change to something more suited to the world of trillions of connected devices. As noted above, Maher is proposing TIDALs as an alternative. As he describes it, TIDALs are “assertion oriented blockchains.” In TIDALs, blocks in blockchains will contain hashed tags to data files that can assert for the provenance and authenticity of whatever the block is associated with.

For example, if the associated object is an image sensor, the tags could point to the manufacturer of the sensor, the model type, firmware revision, device the sensor is built into, etc. These could be chained to other blocks that would be associated with image files recorded by the sensor and contain tags associated with the date and location stamps and even blocks with information on the owner of the device. Each of the hashed tags would be signed with a secret key issued by an authority to demonstrate that the assertion can be trusted. As Maher puts it, “The concept is having a universal oracle but it’s highly distributed and very heterogenous.”

The TIDALs project also includes the concept of TIDAL derivatives. These would be collections of assertions that would likely be constructed and maintained by organizations that are focused on a particular application type. These derivatives would typically be an ordered hash table pointing to a subset of records contained in the TIDALs blockchain. An example brought up by Maher would be a hash table of the web server bindings associated with all the world’s URLs. “You could have a 256-bit hash table of all the world’s URLs fit in 32 GB, basically half of your cell phone memory,” (Maher). According to Maher, looking up information from such a table would be “much much quicker than anything that’s done today.”

Maher’s description of TIDALs, once implemented, could create a broad and highly distributed trust infrastructure that could scale gracefully. Large numbers of organizations could act as authorities to build and maintain this blockchain and meet the challenge of bringing trust to a vast number of devices and quantities of information on the Internet. If you’re interested in finding out more, feel free to download the presentation and get in touch.