What is a Notary Service in a Blockchain Network? A notary system is at the root of blockchain, where transactions need to be time-stamped by a trusted authority.
This means that notaries, which are understood as abstract entities here, validate the transactions by signing them and eventually certifying that the time of the transaction was registered via a time-stamping process.
The blockchain notary system, as present in Corda, for example, must not be confused with real notaries who might eventually use blockchain. A physical notary is a witness that is trusted and who will sign documents to certify and validate them. In the blockchain system, a notary does the same thing. It uses its private key to sign transactions, along with the time the transaction is signed.
In public blockchains, there is no real role for a dedicated notary since any user can become a notary if they are chosen by the consensus algorithm.
In private blockchains, such as the ones used by banks, the notary plays a dedicated role because they are part of the consensus. In other words, in a public blockchain network, some users are chosen by the consensus to play the role of notaries, while in private blockchain networks, this is more or less the opposite.
Why Do We Need Notaries in Private Blockchain Networks?
In private networks, competition between distrusting individuals does not usually play the major and central role that it plays in public blockchain networks. In public blockchain networks, such as the BTC, security is often created by the fact that among distrusting individuals, the most significant work will be done by honest people (proof-of-work). This is because rogue competitors will not have enough significant power to become superior to the honest “miners” since the honest miners are assumed to account for the vast majority of the miners.
In a private blockchain, such concept does not exist. There is no “mining”. For example, there is no competition among banks to provide proof of the better work regarding a transaction. Instead, there is often a decentralized amount of notaries that will run consensus algorithms to decide whether a transaction is valid and proceed to timestamp it when it is deemed to be valid.
The concept is quite simple, we illustrate it by a possible consensus algorithm:
A transaction is deemed valid if n notaries picked randomly validate it all together. In such a case, the timestamp is the product of all the n individual timestamps. If e is the proportion of rogue notaries, the probability p of collusion between the n notaries needed to produce a fraudulent validation is p=en. If we have e=5% and n=10 then p=0,0000000000001. This shows that the transaction and the timestamps must be considered as valid.
How Notaries Work in Banking Blockchain Networks
As an illustrative example, we will look at how notaries work within the Corda framework.
In the Corda framework, notaries are authorities attesting that transactions have not been double-spent. They use composite keys and PKI for this. As aforementioned, they run a consensus algorithm, then they decide whether to validate a transaction. If they validate it, they timestamp it.
The multi-signature scheme requires that the transaction is signed by at least a given group of signatures among a possible set of groups. For instance, “the head of sales and two different assistants” or “two of the associated directors of the sales department” or “three different bank branch agencies directors.”
In permissioned blockchains, notaries make extensive use of PKI. Since the security of the consensus mostly relies on the fact that the private keys are protected, and that the cryptographic operations involving signature are performed in secure environments or devices such as HSMs, banks should take all necessary precautions to make sure the PKI is protected accordingly.
The Need for HSMs and Key Management Systems
Notary services incorporate the time-stamping service in blockchain to assure that the date and time is a part of the content for later verification. HSMs provision the trusted root by securely storing the cryptographic identity used for the digital signing and time-stamping of data. The cryptographic identity generally contains the public/private keypair and X.509 digital certificate. The identity key for time-stamping is stored in a tamper-proof manner such that it cannot be accessed and/or cloned outside the HSM critical boundary and can only be used to digitally sign the timestamp. HSMs also serve the purpose of Time Stamping Authority (TSA).
Blog post by Martin Rupp, Priyank Kumar and Ulrich Scholten
