Markus Knecht | University of Zurich, Switzerland (original) (raw)
Papers by Markus Knecht
2023 5th Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS)
Bookmarks Related papers MentionsView impact
2019 Crypto Valley Conference on Blockchain Technology (CVCBT), 2019
Bookmarks Related papers MentionsView impact
Lecture Notes in Computer Science, 2017
Smart contracts on a blockchain behave exactly as specified by their code. To be sure that a smar... more Smart contracts on a blockchain behave exactly as specified by their code. To be sure that a smart contract behaves as expected, the end-user has to either analyze its code or trust a potentially anonymous developer or auditor to do so. This approach proposes a smart contract deployment and management platform that can execute development tools and code quality tools in a trusted way and uses this to reduce the trust required into the smart contract developer or auditor. Additionally, such a platform can provide new capabilities for developers aiding them in the creation of smart contracts.
Bookmarks Related papers MentionsView impact
2022 IEEE International Conference on Blockchain (Blockchain)
Bookmarks Related papers MentionsView impact
Abstract. We present an algorithm for the Merkle tree traversal problem which combines the effici... more Abstract. We present an algorithm for the Merkle tree traversal problem which combines the efficient space-time trade-off from the fractal Merkle tree [3] and the space efficiency from the improved log space-time Merkle trees traversal [8]. We give an exhaustive analysis of the space and time efficiency of our algorithm in function of the parameters H (the height of the Merkle tree) and h (h = H L where L is the number of levels in the Merkle tree). We also analyze the space impact when a continuous deterministic pseudo–random number generator (PRNG) is used to generate the leaves. We further program a low storage–space and a low time–overhead version of the algorithm in Java and measure its performance with respect to the two different implementations cited above. Our implementation uses the least space when a continuous PRNG is used for the leaf calculation.
Bookmarks Related papers MentionsView impact
2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2020
Transactions (TX) sent and executed by a public Blockchain (BC) need to pay a TX fee. The fee is ... more Transactions (TX) sent and executed by a public Blockchain (BC) need to pay a TX fee. The fee is relative to the resources consumed when including the TX into a block. The sender of the TX pays for the fee in the native currency of the BC used. Such a fee protects the network from Denial-of-Service (DoS) attacks and provides incentives for TXs inclusion. BCs that support Smart Contracts (SC), thus, TXs can execute user-provided code, require a mechanism for fee calculation depending on the resources consumed by the code executed. Ethereum uses an elaborated mechanism compared to Bitcoin, leading to an increase in the attack surface of their SCs. The mechanism that makes the Bitcoin script - a limited version of SCs - more secure is the ability to compute, independent of the BC's state, an upperbound on resources needed to execute this TX. Thus, this work proposes a new approach enabling security benefits by defining an upper-bound on resource usage for general SCs. Furthermore, ...
Bookmarks Related papers MentionsView impact
Bookmarks Related papers MentionsView impact
Die Kryptowährung Bitcoin ist weltweit bekannt. Die darunterliegenden Konzepte und Technologien s... more Die Kryptowährung Bitcoin ist weltweit bekannt. Die darunterliegenden Konzepte und Technologien sind aber vielen Leuten unbekannt. Der Begriff Blockchain hingegen sagt meist nur technisch interessierten Personen etwas. Die Blockchain ist die Technologie, welche Kryptowährungen wie Bitcoin überhaupt erst ermöglicht. Kryptowährungen und vor allem Blockchains durchlaufen gerade eine Hype-Phase und immer mehr Projekte werden gestartet, die mit Blockchains zu tun haben. In diesem Artikel beschreiben wir, was es mit dem ganzen Hype auf sich hat, wie die tragende Technologie dahinter funktioniert und was sich damit alles bewerkstelligen lässt.
Bookmarks Related papers MentionsView impact
Für ein neuartiges Überwachungssystems von Lieferketten entwickeln wir mit Groovy und Java eine m... more Für ein neuartiges Überwachungssystems von Lieferketten entwickeln wir mit Groovy und Java eine modulare DSL-Engine, welche es ermöglicht, eine domänenspezifische Sprache zu implementieren, deren Syntax und Semantik jederzeit durch neue Module ergänzt werden kann. Durch dieses modulare Konzept lässt sich die Funktionalität eines Systems, wie auch die DSL, sehr einfach an die sich ständig verändernden Bedürfnisse der Domänenspezialisten anpassen.
Bookmarks Related papers MentionsView impact
In diesem Artikel wird die elektronische Geldbörse Scoop vorgestellt, die im Rahmen eines KTI Pro... more In diesem Artikel wird die elektronische Geldbörse Scoop vorgestellt, die im Rahmen eines KTI Projektes entwickelt worden ist. Im Gegensatz zu anderen Mobile Payment Lösungen muss bei Scoop der Point of Sale (POS) nicht mehr direkt an das Internet angeschlossen sein. Das Settlement der Zahlung wird direkt am POS vorgenommen und, falls das Mobiltelefon am POS zum Zeitpunkt der Zahlung nicht online ist, so werden die Transaktionsdaten über ein langsames Netzwerk an den Server ausgeliefert. Um «Double-Spend»-Attacken zu erkennen, werden alle Transaktionen in einer Kette (Chain) gespeichert und mit kryptographischen Hash-Codes gesichert. Im POS sind die Hash-Codes in einem mit JavaCard programmierten Secure-Element gespeichert. In diesem Artikel präsentieren wir die Idee von Scoop und erläutern Aspekte der Realisierung.
Bookmarks Related papers MentionsView impact
Smart contracts on a blockchain behave precisely as specified by their code. A vulnerability in t... more Smart contracts on a blockchain behave precisely as specified by their code. A vulnerability in this code can lead to unexpected behaviour, which is hard to fix because a blockchain does not allow to change smart contract code after its deployment. Such vulnerabilities have led to several incidents. In the aftermath of such an event, a hard-fork between Ethereum and Ethereum classic was the result. This thesis proposes to develop a new smart contract programming language with the primary focus on safety, auditability, and the intention to prevent as many of the known categories of vulnerabilities by design as possible. The programming language's code is validated during deployment and afterwards isolated from other smart contracts running on the same blockchain to enforce compile-time guarantees during runtime. The designed programming language does evaluate new concepts and paradigms rarely used in non-smart contract environments for their potential benefit in a smart contract ...
Bookmarks Related papers MentionsView impact
2021 3rd Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS)
Public Blockchains (BC) in support of Smart Contracts (SC), like Ethereum, enable everyone to coo... more Public Blockchains (BC) in support of Smart Contracts (SC), like Ethereum, enable everyone to coordinate in a decentralized approach the management of scarce, valuable resources (like cryptocurrencies). Such BCs allow for building SCs that own resources and manage permissions describing who is allowed to interact with these resources and what actions can be applied to them. However, programming languages and runtime systems used in current BCs lack a secure, flexible, and straightforward way to implement permissions within their SCs. This unnecessary complexity can lead to erroneous implementations, allowing unauthorized access. The best-known incident related to a permission problem was the “Parity Hack”, which led to the “loss” of tokens, valued at approximately 31 M USD. SAMOS designed a concept to achieve an improved access control representation. It provides a secure path to a capability-based permission management system by using opaque and substructural types. This paper presents an implementation of SAMOS in the functional SC language Mandala, which offers a mechanism to enforce the key properties of opaque and substructural types during the SC execution by using an on-chain soundness checker.
Bookmarks Related papers MentionsView impact
Proceedings of the 40th International Conference on Software Engineering: Companion Proceeedings
Bookmarks Related papers MentionsView impact
2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC)
Bookmarks Related papers MentionsView impact
2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC)
Bookmarks Related papers MentionsView impact
We present an algorithm for the Merkle tree traversal problem which combines the efficient space-... more We present an algorithm for the Merkle tree traversal problem which combines the efficient space-time trade-off from the fractal Merkle tree [3] and the space efficiency from the improved log space-time Merkle trees traversal [8]. We give an exhaustive analysis of the space and time efficiency of our algorithm in function of the parameters H (the height of the Merkle tree) and h (h = H L where L is the number of levels in the Merkle tree). We also analyze the space impact when a continuous deterministic pseudo-random number generator (PRNG) is used to generate the leaves. We further program a low storage-space and a low time-overhead version of the algorithm in Java and measure its performance with respect to the two different implementations cited above. Our implementation uses the least space when a continuous PRNG is used for the leaf calculation.
Bookmarks Related papers MentionsView impact
SATOS: Storage Agnostic Tokens over Opaque and Substructural Types, 2019
Public blockchains in support of Smart Contracts (SC), like Ethereum enable everyone to represent... more Public blockchains in support of Smart Contracts (SC), like Ethereum enable everyone to represent scarce, valuable resources (like cryptocurrencies) as so-called tokens. Token issuing and management was the first blockchain use case. However, programming languages and runtime systems used in the current blockchains for their SCs lack a secure and straightforward way to implement and handle tokens. The unnecessary complexity in doing so can lead to erroneous implementation of tokens and applications built on top of these, including the loss or theft of tokens as it happened. The most known attack was "TheDAO" attack which led to the "loss" of tokens, valued at that time at approximately 60 M US Dollar. A better and secure token representation directly embedded into a SC runtime and SC programming language could prevent loss of tokens. Thus this paper presents an approach including parts of a programming language using it. The core of the model is to use opaque and substructural data types together with an on-chain soundness checker to generically represent tokens securely as values similar to integers and booleans. Opaque data types enforce that only a designated piece of code can create values of that type. The substructural data types allow values to express scarcity by preventing the duplication and elimination of values. The on-chain soundness checker ensures that the deployed code does not violate guarantees given by the type system, which includes opaque and substructural data types.
Bookmarks Related papers MentionsView impact
Smart contracts on a blockchain behave precisely as specified by their code. A vulnerability in t... more Smart contracts on a blockchain behave precisely as specified by their code. A vulnerability in this code can lead to unexpected behaviour, which is hard to fix because a blockchain does not allow to change smart contract code after its deployment. Such vulnerabilities have led to several incidents. In the aftermath of such an event, a hard-fork between Ethereum and Ethereum classic was the result. This thesis proposes to develop a new smart contract programming language with the primary focus on safety, auditability, and the intention to prevent as many of the known categories of vulnerabilities by design as possible. The programming language's code is validated during deployment and afterwards isolated from other smart contracts running on the same blockchain to enforce compile-time guarantees during runtime. The designed programming language does evaluate new concepts and paradigms rarely used in non-smart contract environments for their potential benefit in a smart contract environment.
Bookmarks Related papers MentionsView impact
Smart contracts on a blockchain behave exactly as specified by their code. To be sure that a smar... more Smart contracts on a blockchain behave exactly as specified by their code. To be sure that a smart contract behaves as expected, the end-user has to either analyze its code or trust a potentially anonymous developer or auditor to do so. This approach proposes a smart contract deployment and management platform that can execute development tools and code quality tools in a trusted way and uses this to reduce the trust required into the smart contract developer or auditor. Additionally, such a platform can provide new capabilities for developers aiding them in the creation of smart contracts.
Bookmarks Related papers MentionsView impact
Mit der Vorliegenden Arbeit wird eine modulare Domänenspezifisch Abfragesprache mithilfe der Prog... more Mit der Vorliegenden Arbeit wird eine modulare Domänenspezifisch Abfragesprache mithilfe der Programmiersprache Scala, nach dem Prinzip einer internen Domänenspezifisch Sprache, für das Babelfisch-Projekt entwickelt. Mithilfe der Abfragesprache ist es möglich, Pfade aus einer versionierten Graphdatenbank zu extrahieren, welche ein bestimmtes Muster vorweisen. Die resultierenden Pfade können dann falls gewünscht in eine Tabelle transformiert werden. Für die Abfragen wird auf das Datenbankschema zurückgegriffen, wodurch die darin enthaltenen Domänenspezifischen Ausdrücke verwendet werden können. Die Abfragesprache ist modular aufgebaut, damit neue Funktionalität über Module hinzugefügt werden kann.
Bookmarks Related papers MentionsView impact
2023 5th Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS)
Bookmarks Related papers MentionsView impact
2019 Crypto Valley Conference on Blockchain Technology (CVCBT), 2019
Bookmarks Related papers MentionsView impact
Lecture Notes in Computer Science, 2017
Smart contracts on a blockchain behave exactly as specified by their code. To be sure that a smar... more Smart contracts on a blockchain behave exactly as specified by their code. To be sure that a smart contract behaves as expected, the end-user has to either analyze its code or trust a potentially anonymous developer or auditor to do so. This approach proposes a smart contract deployment and management platform that can execute development tools and code quality tools in a trusted way and uses this to reduce the trust required into the smart contract developer or auditor. Additionally, such a platform can provide new capabilities for developers aiding them in the creation of smart contracts.
Bookmarks Related papers MentionsView impact
2022 IEEE International Conference on Blockchain (Blockchain)
Bookmarks Related papers MentionsView impact
Abstract. We present an algorithm for the Merkle tree traversal problem which combines the effici... more Abstract. We present an algorithm for the Merkle tree traversal problem which combines the efficient space-time trade-off from the fractal Merkle tree [3] and the space efficiency from the improved log space-time Merkle trees traversal [8]. We give an exhaustive analysis of the space and time efficiency of our algorithm in function of the parameters H (the height of the Merkle tree) and h (h = H L where L is the number of levels in the Merkle tree). We also analyze the space impact when a continuous deterministic pseudo–random number generator (PRNG) is used to generate the leaves. We further program a low storage–space and a low time–overhead version of the algorithm in Java and measure its performance with respect to the two different implementations cited above. Our implementation uses the least space when a continuous PRNG is used for the leaf calculation.
Bookmarks Related papers MentionsView impact
2020 IEEE 19th International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom), 2020
Transactions (TX) sent and executed by a public Blockchain (BC) need to pay a TX fee. The fee is ... more Transactions (TX) sent and executed by a public Blockchain (BC) need to pay a TX fee. The fee is relative to the resources consumed when including the TX into a block. The sender of the TX pays for the fee in the native currency of the BC used. Such a fee protects the network from Denial-of-Service (DoS) attacks and provides incentives for TXs inclusion. BCs that support Smart Contracts (SC), thus, TXs can execute user-provided code, require a mechanism for fee calculation depending on the resources consumed by the code executed. Ethereum uses an elaborated mechanism compared to Bitcoin, leading to an increase in the attack surface of their SCs. The mechanism that makes the Bitcoin script - a limited version of SCs - more secure is the ability to compute, independent of the BC's state, an upperbound on resources needed to execute this TX. Thus, this work proposes a new approach enabling security benefits by defining an upper-bound on resource usage for general SCs. Furthermore, ...
Bookmarks Related papers MentionsView impact
Bookmarks Related papers MentionsView impact
Die Kryptowährung Bitcoin ist weltweit bekannt. Die darunterliegenden Konzepte und Technologien s... more Die Kryptowährung Bitcoin ist weltweit bekannt. Die darunterliegenden Konzepte und Technologien sind aber vielen Leuten unbekannt. Der Begriff Blockchain hingegen sagt meist nur technisch interessierten Personen etwas. Die Blockchain ist die Technologie, welche Kryptowährungen wie Bitcoin überhaupt erst ermöglicht. Kryptowährungen und vor allem Blockchains durchlaufen gerade eine Hype-Phase und immer mehr Projekte werden gestartet, die mit Blockchains zu tun haben. In diesem Artikel beschreiben wir, was es mit dem ganzen Hype auf sich hat, wie die tragende Technologie dahinter funktioniert und was sich damit alles bewerkstelligen lässt.
Bookmarks Related papers MentionsView impact
Für ein neuartiges Überwachungssystems von Lieferketten entwickeln wir mit Groovy und Java eine m... more Für ein neuartiges Überwachungssystems von Lieferketten entwickeln wir mit Groovy und Java eine modulare DSL-Engine, welche es ermöglicht, eine domänenspezifische Sprache zu implementieren, deren Syntax und Semantik jederzeit durch neue Module ergänzt werden kann. Durch dieses modulare Konzept lässt sich die Funktionalität eines Systems, wie auch die DSL, sehr einfach an die sich ständig verändernden Bedürfnisse der Domänenspezialisten anpassen.
Bookmarks Related papers MentionsView impact
In diesem Artikel wird die elektronische Geldbörse Scoop vorgestellt, die im Rahmen eines KTI Pro... more In diesem Artikel wird die elektronische Geldbörse Scoop vorgestellt, die im Rahmen eines KTI Projektes entwickelt worden ist. Im Gegensatz zu anderen Mobile Payment Lösungen muss bei Scoop der Point of Sale (POS) nicht mehr direkt an das Internet angeschlossen sein. Das Settlement der Zahlung wird direkt am POS vorgenommen und, falls das Mobiltelefon am POS zum Zeitpunkt der Zahlung nicht online ist, so werden die Transaktionsdaten über ein langsames Netzwerk an den Server ausgeliefert. Um «Double-Spend»-Attacken zu erkennen, werden alle Transaktionen in einer Kette (Chain) gespeichert und mit kryptographischen Hash-Codes gesichert. Im POS sind die Hash-Codes in einem mit JavaCard programmierten Secure-Element gespeichert. In diesem Artikel präsentieren wir die Idee von Scoop und erläutern Aspekte der Realisierung.
Bookmarks Related papers MentionsView impact
Smart contracts on a blockchain behave precisely as specified by their code. A vulnerability in t... more Smart contracts on a blockchain behave precisely as specified by their code. A vulnerability in this code can lead to unexpected behaviour, which is hard to fix because a blockchain does not allow to change smart contract code after its deployment. Such vulnerabilities have led to several incidents. In the aftermath of such an event, a hard-fork between Ethereum and Ethereum classic was the result. This thesis proposes to develop a new smart contract programming language with the primary focus on safety, auditability, and the intention to prevent as many of the known categories of vulnerabilities by design as possible. The programming language's code is validated during deployment and afterwards isolated from other smart contracts running on the same blockchain to enforce compile-time guarantees during runtime. The designed programming language does evaluate new concepts and paradigms rarely used in non-smart contract environments for their potential benefit in a smart contract ...
Bookmarks Related papers MentionsView impact
2021 3rd Conference on Blockchain Research & Applications for Innovative Networks and Services (BRAINS)
Public Blockchains (BC) in support of Smart Contracts (SC), like Ethereum, enable everyone to coo... more Public Blockchains (BC) in support of Smart Contracts (SC), like Ethereum, enable everyone to coordinate in a decentralized approach the management of scarce, valuable resources (like cryptocurrencies). Such BCs allow for building SCs that own resources and manage permissions describing who is allowed to interact with these resources and what actions can be applied to them. However, programming languages and runtime systems used in current BCs lack a secure, flexible, and straightforward way to implement permissions within their SCs. This unnecessary complexity can lead to erroneous implementations, allowing unauthorized access. The best-known incident related to a permission problem was the “Parity Hack”, which led to the “loss” of tokens, valued at approximately 31 M USD. SAMOS designed a concept to achieve an improved access control representation. It provides a secure path to a capability-based permission management system by using opaque and substructural types. This paper presents an implementation of SAMOS in the functional SC language Mandala, which offers a mechanism to enforce the key properties of opaque and substructural types during the SC execution by using an on-chain soundness checker.
Bookmarks Related papers MentionsView impact
Proceedings of the 40th International Conference on Software Engineering: Companion Proceeedings
Bookmarks Related papers MentionsView impact
2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC)
Bookmarks Related papers MentionsView impact
2021 IEEE International Conference on Blockchain and Cryptocurrency (ICBC)
Bookmarks Related papers MentionsView impact
We present an algorithm for the Merkle tree traversal problem which combines the efficient space-... more We present an algorithm for the Merkle tree traversal problem which combines the efficient space-time trade-off from the fractal Merkle tree [3] and the space efficiency from the improved log space-time Merkle trees traversal [8]. We give an exhaustive analysis of the space and time efficiency of our algorithm in function of the parameters H (the height of the Merkle tree) and h (h = H L where L is the number of levels in the Merkle tree). We also analyze the space impact when a continuous deterministic pseudo-random number generator (PRNG) is used to generate the leaves. We further program a low storage-space and a low time-overhead version of the algorithm in Java and measure its performance with respect to the two different implementations cited above. Our implementation uses the least space when a continuous PRNG is used for the leaf calculation.
Bookmarks Related papers MentionsView impact
SATOS: Storage Agnostic Tokens over Opaque and Substructural Types, 2019
Public blockchains in support of Smart Contracts (SC), like Ethereum enable everyone to represent... more Public blockchains in support of Smart Contracts (SC), like Ethereum enable everyone to represent scarce, valuable resources (like cryptocurrencies) as so-called tokens. Token issuing and management was the first blockchain use case. However, programming languages and runtime systems used in the current blockchains for their SCs lack a secure and straightforward way to implement and handle tokens. The unnecessary complexity in doing so can lead to erroneous implementation of tokens and applications built on top of these, including the loss or theft of tokens as it happened. The most known attack was "TheDAO" attack which led to the "loss" of tokens, valued at that time at approximately 60 M US Dollar. A better and secure token representation directly embedded into a SC runtime and SC programming language could prevent loss of tokens. Thus this paper presents an approach including parts of a programming language using it. The core of the model is to use opaque and substructural data types together with an on-chain soundness checker to generically represent tokens securely as values similar to integers and booleans. Opaque data types enforce that only a designated piece of code can create values of that type. The substructural data types allow values to express scarcity by preventing the duplication and elimination of values. The on-chain soundness checker ensures that the deployed code does not violate guarantees given by the type system, which includes opaque and substructural data types.
Bookmarks Related papers MentionsView impact
Smart contracts on a blockchain behave precisely as specified by their code. A vulnerability in t... more Smart contracts on a blockchain behave precisely as specified by their code. A vulnerability in this code can lead to unexpected behaviour, which is hard to fix because a blockchain does not allow to change smart contract code after its deployment. Such vulnerabilities have led to several incidents. In the aftermath of such an event, a hard-fork between Ethereum and Ethereum classic was the result. This thesis proposes to develop a new smart contract programming language with the primary focus on safety, auditability, and the intention to prevent as many of the known categories of vulnerabilities by design as possible. The programming language's code is validated during deployment and afterwards isolated from other smart contracts running on the same blockchain to enforce compile-time guarantees during runtime. The designed programming language does evaluate new concepts and paradigms rarely used in non-smart contract environments for their potential benefit in a smart contract environment.
Bookmarks Related papers MentionsView impact
Smart contracts on a blockchain behave exactly as specified by their code. To be sure that a smar... more Smart contracts on a blockchain behave exactly as specified by their code. To be sure that a smart contract behaves as expected, the end-user has to either analyze its code or trust a potentially anonymous developer or auditor to do so. This approach proposes a smart contract deployment and management platform that can execute development tools and code quality tools in a trusted way and uses this to reduce the trust required into the smart contract developer or auditor. Additionally, such a platform can provide new capabilities for developers aiding them in the creation of smart contracts.
Bookmarks Related papers MentionsView impact
Mit der Vorliegenden Arbeit wird eine modulare Domänenspezifisch Abfragesprache mithilfe der Prog... more Mit der Vorliegenden Arbeit wird eine modulare Domänenspezifisch Abfragesprache mithilfe der Programmiersprache Scala, nach dem Prinzip einer internen Domänenspezifisch Sprache, für das Babelfisch-Projekt entwickelt. Mithilfe der Abfragesprache ist es möglich, Pfade aus einer versionierten Graphdatenbank zu extrahieren, welche ein bestimmtes Muster vorweisen. Die resultierenden Pfade können dann falls gewünscht in eine Tabelle transformiert werden. Für die Abfragen wird auf das Datenbankschema zurückgegriffen, wodurch die darin enthaltenen Domänenspezifischen Ausdrücke verwendet werden können. Die Abfragesprache ist modular aufgebaut, damit neue Funktionalität über Module hinzugefügt werden kann.
Bookmarks Related papers MentionsView impact