FAQs Archive | Page 6 of 7

Q: What is a web of trust?

Web of Trust tries to solve the same problem as PKI in a decentralized way, i.e., without the Certificate Authorities (CA). To achieve that, it allows users to vouch for other users, e.g. John says that Mary is who she says she is, and that her public key is X. If several people, maybe known in real life, claim that a public key corresponds to Mary then others will be more inclined to trust it. Since there are several such trust connections between the participants, it is called a web of trust.

Q: Does Block.co use public key infrastructure or web of trust?

It uses neither (arguably, it uses a Decentralized form of PKI).

Q: Why do we say that Block.co’s solution is decentralized?

Verifiable PDFs (or vPDFs) is the open-source technology that Block.co leverages. VPDFs allow anyone to ensure that a PDF’s integrity is secured by anchoring a hash of that PDF on a public blockchain. Since public blockchains are decentralized and immutable the hash will be tamperproof. Thus, it can be trusted that it was never modified, which allows anyone with the PDF to validate the document by consulting directly with the blockchain (and not necessarily the entity that created the PDF). In addition, we make sure that the identity of the person that created and anchored the PDF document can be validated in a decentralized way by consulting several public online resources that the entity controls.

Q: In what way is it and how does it differentiate with the traditional solutions like PKI? I.e. Why would someone use our vPDFs instead of the traditional PKI signature scheme that PDFs support natively?

PKI signature scheme with CAs issuing digital certificates has been in operation for many years. It works, albeit not without issues. There have been several occasions that CAs have been hacked (and in some cases it was even an inside job) so that certificates, and thus all security depending on them, were compromised. I.e. CAs are a central point of failure. vPDFs provide a practical way to ensure that several public online sources are consulted to ensure identification of an entity’s public key thus improving on the centralized nature of CAs. The actual data and signatures are also immutable and tamperproof further improving on trustworthiness. In addition, the PDF signature mechanism makes use of a feature called Incremental Updates to add signatures which was proved to be prone to several attacks, effectively bypassing the signature. VPDFs use the simpler and more practical solution of hashing the entire document, therefore eliminating this type of attacks.

Q: What is a Bitcoin address?

A bitcoin address is constructed by the public key of a key-pair. It can be thought of as an account in Bitcoin where you can receive funds and send funds from.

Q: How do we (in Block.co) uniquely identify a client in public?

From the client's Bitcoin address which can be seen during validation. All different identity mechanisms used to ensure the client’s identity are also displayed, to a user validating a vPDF document.

Q: How does a validator verify the identity of a client? We currently use two methods. Which ones? Are they decentralized?

We currently make use of three methods although more can be easily added according to the clients’ requirements. First, a domain name verification is used where our client proves ownership of a domain name that they are using. Second, Block.co provides a verification service that can also be used. And finally, a GitHub verification method can be used where the client uses their GitHub account to prove ownership of their identity. Although, each one of the identity verification methods above are centralized, when used in conjunction ensure that there is no centralized point of failure.

Q: When we say issuing/anchoring to the blockchain what do we mean, i.e. what are we issuing/anchoring/storing to the blockchain?

We are issuing/anchoring/storing the cryptographic hash of the digital document. This is an over-simplification that we use for the purpose of this Q&A. In reality more data are stored based on a meta-protocol that has been constructed to allow for additional functionality like timestamping, batching, etc.

Q: How does Block.co ensures that a PDF file is not tampered with? I.e. what does a vPDF contain that a PDF does not?

A vPDF contains a blockchain proof in the metadata (the non-visible, machine-readable part of the PDF). The proof can be used to validate the document.