I'm thinking up a scheme where a merkle tree is used to ensure integrity of a set of data items, and different parties are allowed to verify the integrity of different subsets of that data.

Let's assume a process where an operator measures a physical property of items that pass his workstation on a conveyor belt. Let's, for example, define the following properties that are collected for each measurement event.

operator id
item id
workstation id

For reasons of data integrity and traceability the measuring device computes a signature over all the properties whenever it produces a measurement.

Now let's assume a hash of all these properties and the signature are to be stored publicly (for example on the Blockchain). Anyone with access to all properties can verify the publicly stored hash and signature. But what if we have multiple stakeholders interested in the integrity of different subsets of those properties, what if we want to let people verify a subset of the properties without disclosing others.

If we create a merkle tree of all these properties we could disclose the value of some properties (leaves in the tree) and only root hashes of some subtrees, allowing people to calculate the root hash and verify the signature.

But there is still a concern of confidentiality. For example, the same operator id will always hash to the same value. So what if a salt was introduced into the operator id subtree. I.e. the operator id subtree-hash would be H(operator id | salt) where | denotes concatenation. Thus, if we with to disclose the operator id, we disclose the operator id and the salt. If we do not wish to disclose the operator id, we only disclose the root hash of the subtree.

Let's assume the length of all properties and salts is fixed, or is prepended to the item in question.

If the hash function is cryptographically secure, noone should be able to come up with a different operator-id-salt combination that produces the same hash.

From the perspective of some verifiers, they only learn one or two properties, and a large number of random-looking subtree root hashes. Maybe some subtree root hashes don't belong to actual subtrees, but are just random data. Is there a scenario where this could be a problem for verifiers.

Is this a terrible idea?

(I'm aware that there is also concern of a length extension attack, depending on the hash function used, where someone could append another subtree on the right side and calculate a valid root hash).

  • $\begingroup$ Hmmmm... well my biggest question would be why you need a blockchain here? So taking a step backward, in the case of cryptocurrency, by creating a blockchain you are able to create a list of transactions and are able to trace back to an origin source of coin creation. But in your conveyor belt model, I see no such preservation of data required or even whether there is a link between the conveyor belts. Of course, it is not a necessary requirement for a blockchain, but it feels like this solution is a bit too complex for your needs. $\endgroup$ – Haris Nadeem May 4 '18 at 5:16
  • $\begingroup$ I'd have to give this a reread but is this the actual use case? If not is it possible to describe a more related use case I could tie your scenario to? $\endgroup$ – Haris Nadeem May 4 '18 at 5:18
  • $\begingroup$ It's quite close to the actual use case. Concretely the Ethereum blockchain is used and a smart contract makes some autonomous decisions based on the input data. But a big aspect is also just the immutable storage of a hash of all the data. When an auditor requests all the data they can compute the hash and compare it with the one on the blockchain and verify no data was changed. But subset of the data could also be made available to other stakeholders and they should be able to verify the integrity of that subset. $\endgroup$ – Andy May 7 '18 at 8:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.