3
$\begingroup$

The recent threats to EPA data integrity have me wondering if it's possible to archive data in a way such that one can later check whether the data have been tampered with since the original archival.

One commonly used mechanism in the open source software world is hash verification. After downloading some software you compute an md5hash of the tarball and then compare that hash to a "golden" hash served by a trusted website. Of course, you trust the website because its certificate checks out with whichever certificate authorities you trust.

But if that trusted website is centrally managed by some stakeholder in the data, then the golden hash is suspect. It seems like there ought to be some kind of P2P or distributed record system that can be used for this. What I thought of was blockchain technologies such as bitcoin. Getting to critical mass with a new blockchain system built for the sole purpose of data tampering detection seems like it would not be feasible because there would be little incentive to actually join that system.

It seems like it might be easier to somehow piggyback on the existing Bitcoin system. I feel reasonably confident in saying that the Bitcoin system is unlikely to disappear any time in the near future.

Is it possible to store even tiny amounts of user data--such as a few md5hashes--in the Bitcoin blockchain?

Improve this question
$\endgroup$
0
2
$\begingroup$

I think what you might be looking for is an append-only data structure for example "Balloon: A Forward-Secure Append-Only Persistent Authenticated Data Structure". A similar concept is used for certificate transparency as specified in RFC6962

Edit: If you definitely want to use the bitcoin blockchain you should look at this or this. Somebody actually has asked this question before. A PoC implementation can be found here.

Improve this answer
$\endgroup$
2
  • $\begingroup$ Great answer. I think the "fake addresses" is what I was looking for with respect to a bitcoin solution. $\endgroup$ – Sebastian Goodman Jan 26 '17 at 17:46
  • $\begingroup$ With the Balloon system, if all of the snapshots are lost then the system can no longer be publicly verified, right? The appeal of the Bitcoin solution is that it's massively redundant/replicated. $\endgroup$ – Sebastian Goodman Jan 26 '17 at 17:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.