FAQs Archive | Page 5 of 7

Q: Why not use Ethereum smart contracts?

We managed to create a solution that covers our requirements without needing complex smart contract functionality, which is prone to more attack vectors.

Q: Can we use Ethereum without smart contracts?

Yes. Our solution just requires storing some data on a public blockchain and thus it is blockchain agnostic.

Q: How secure is issuing on the Litecoin blockchain?

Being able to make attacks requires significant processing power, or hashrate. Hashrate depends on the specific hashing algorithm used by the network. As long as the network has the highest hashrate for the specific algorithm it is very secure. Bitcoin is the network with the highest hashrate on the SHA-256 algorithm. Litecoin is the network with the highest hashrate on the Scrypt algorithm.

Q: Can we issue in a private blockchain? How useful or secure would that be?

Yes, since our solution is blockchain agnostic. All is needed is to be able to store a small amount of data on that blockchain. However, using a private blockchain limits the solution significantly given that it will only be auditable and transparent for the members of the private blockchain. However, that can also have its uses.

Q: Why not use PDF signatures?

With PDF signatures, one uses the traditional centralized Public Key Infrastructure (PKI). The issuers need to register with a Certificate Authority (CA) that will verify their signature and sign in turn that it is valid. This process is centralized and has several single points of failure that we want to avoid through decentralization. Please see article on our design principles.

Q: What is a cryptographic hash function?

A hash function takes an arbitrary size of binary data and produces a fixed size random sequence of bytes, call a hash (or hash value or digital fingerprint or digest). This is a one-way process and there is no way to get back to the data from the hash value. Even the smallest modification to the original data would produce a completely different hash value which is impossible to relate with any other hash value.

Q: What is a key-pair in public key cryptography?

In public key or asymmetric cryptography, a key-pair is two keys that are mathematically related. One is called public key and the other private (or secret) key. The mathematical relation ensures that what one key can do the other key can undo. Only the public key can be shared with others. In practice, this allows two participants to exchange encrypted messages or authenticate messages via digital signatures.

Q: How does signing work with public key cryptography?

The owner of a private key can sign a message and send both the message and the signature to the recipient. The recipient can use the corresponding public key to ensure that the message was not tampered with.

Q: Do we usually sign the whole digital file in asymmetric cryptography?

For efficiency reasons we typically sign the cryptographic hash of a digital file. The hash uniquely represents the file and is faster to sign.

Q: What is public key infrastructure (PKI)?

PKI uses public key cryptography to allow for secure message exchange between participants online. More importantly it allows for uniquely identifying users/entities online, i.e., what is the public key of John Smith. John Smith will be validated the same way he would be validated in real life (ID, passport) and a digital certificate that contains John’s public key will be created and disseminated as needed. PKI, effectively tries to solve identity and secure distribution of public keys. Certificate Authorities (CAs) are the entities responsible for creating the digital certificates and are federated for scalability.