This thesis examines the vulnerabilities due to low-level implementation deficiencies of otherwise secure communication protocols in smart-cards. Smart-cards are considered to be one of the most secure, tamper-resistant, and trusted devices for implementing confidential operations, such as authentication, key management, encryption and decryption for financial, communication, security and data management purposes. The self-containment of smart-cards makes them resistant to attacks as they do not depend on potentially vulnerable external resources. As such, smart-cards are often incorporated in formally-verified protocols that require strong security of the cryptographic computations. Such a setting consists of a smart-card which is responsible for the execution of sensitive operations, and an Application Programming Interface (API) which implements a particular protocol. For the smart-card to execute any kind of operation there exists a confidential low-level communication with the API, responsible for carrying out the protocol specifications and requests. This communication is kept secret on purpose by some vendors, under the assumption that hiding implementation details enhances the system’s security. The work presented in this thesis analyses such low-level protocol implementations in smart-cards, especially those whose implementation details are deliberately kept secret. In particular, the thesis consists of a thorough analysis of the implementation of PKCS#11 and Bitcoin smart-cards with respect to the low-level communication layer. Our hypothesis is that by focusing on reverse-engineering the low-level implementation of the communication protocols in a disciplined and generic way, one can discover new vulnerabilities and open new attack vectors that are not possible when looking at the highest levels of implementation, thereby compromising the security guarantees of the smart-cards. We present REPROVE, a system that automatically reverse-engineers the low-level communication of PKCS#11 smart-cards, deduces the card’s functionalities and translates PKCS#11 cryptographic functions into communication steps. REPROVE deals with both standard-conforming and proprietary implementations, and does not require access to the card. We use REPROVE to reverse-engineer seven commercially available smart-cards. Moreover, we conduct a security analysis of the obtained models and expose a set of vulnerabilities which would have otherwise been unknown. To the best of our knowledge, REPROVE is the first system to address proprietary implementations and the only system that maps cryptographic functions to communication steps and on-card operations. To that end, we showcase REPROVE’s usefulness to a security ecosystem by integrating it with an existing tool to extract meaningful state-machines of the card’s implementations. To conduct a security analysis of the results we obtained, we define a threat model that addresses low-level PKCS#11 implementations. Our analysis indicates a series of implementation errors that leave the cards vulnerable to attacks. To that end, we showcase how the discovered vulnerabilities can be exploited by presenting practical attacks. The results we obtained from the PKCS#11 smart-card analysis showed that proprietary implementations commonly hide erroneous behaviours. To test the assumption that the same practice is also adopted by other protocols, we further examine the low-level implementation of the only available smart-card based Bitcoin wallets, LEDGER. We extract the different protocols that the LEDGER wallets implement and conduct a through analysis. Our results indicate a set of vulnerabilities that expose the wallets as well as the processed transactions to multiple threats. To that end, we present how we successfully mounted attacks on the LEDGER wallets that lead to the loss of the wallet’s ownership and consequently loss of the funds. We address the lack of well-defined security properties that Bitcoin wallets should conform to by introducing a general threat model. We further use that threat model to propose a lightweight fix that can be adopted by other, not necessarily smart-card-based, wallets.

In the past year cryptocurrencies have gained a lot of attention because of the increase in price. This attention has increased the number of people trading and investing in different cryptocurrencies which has lead to an increased number of transactions flowing through the different networks. This has revealed scalability issues in some of them, especially in the most popular cryptocurrency, Bitcoin. Many people are working on solutions to this problem. One proposed solution replaces the blockchain with a DAG structure. In this report the scalability of Bitcoin’s protocol will be compared to the scalability of the protocol used in the newer cryptocurrency, Nano. The comparison is conducted in terms of throughput and latency. To perform this comparison, an experiment was conducted where tests were run with an increasing number of nodes and each test sent different number of transactions per second from every node. Our results show that Nano’s protocol scales better regarding both throughput and latency, and we argue that the reason for this is that the Bitcoin protocol uses a blockchain as a global data-structure unlike Nano that uses a block-lattice structure where each node has their own local blockchain.

Las nuevas tecnologías han implicado un cambio en nuestras conductas dentro de la sociedad, dentro de ello la forma como utilizamos el mercado financiero. Así, actualmente las nuevas figuras como el Dinero Electrónico y Crowdfunding plantean nuevos retos a considerar.Al respecto, en nuestro país tenemos una reciente ley de Dinero Electrónico y la Superintendencia de Banca y Seguros emitió una alerta referida al uso de la figura del Crowdfunding como mecanismo de financiemiento, así el Dr. Morachimo nos explica la naturaleza de las presentes figuras y sus implicancias en nuestra legislación.

Cryptocurrencies has become a very hot topic recently, with Bitcoin being the most popular. The increase in interest has led to an incentive to create payment systems for the currency that makes it easier to use for day-to-day shopping. A lot of companies are inves- tigating possible solutions for credit cards that are used for cryptocurrencies. This thesis aims to present and perform a security analysis on an already created concept of a credit card payment system for Bitcoin. The security analysis is done in a systematical approach where the modules were analyzed with predetermined restrictions and assumptions. The restricitons and assumptions are then removed one-by-one to find potential threats in the system. The outcome of the analysis is then evaluated in an attempt to find possible im- plementation methods that would mitigate or prevent the discovered threats. The possible implementations are also evaluated in terms of how they would affect the system.

BAKGRUND: Kryptovalutor saknar de makroekonomiska faktorer som ligger till grund för prissättningen av vanliga valutor. Istället visar forskning att spekulativ handel och trendsökande handlare är vanligt förekommande och att det bidrar till ökad volatilitet på marknaden. Forskning visar också att overconfidence och confirmation bias bidrar med såväl ökad volatilitet som påverkan på investeringars resultat. Kunskapen om psykologiska bias och hanteringen av dem kan få stora konsekvenser på resultatet men hur privata kryptoinvesterare ser på dem är fortfarande ett outforskat ämne. SYFTE: Syftet med uppsatsen är att undersöka och analysera hur väl privatsparare på kryptovalutamarknaden känner till overconfidence och confirmation bias, vilka erfarenheter de har och vilka åtgärder de gör för att hantera dessa bias. GENOMFÖRANDE: Studien har genomförts genom kvalitativa intervjuer med åtta privata kryptoinvesterare. Intervjuerna har utgått från en intervjumall konstruerad för att på djupet kunna ta del av respondenternas kunskaper och erfarenheter. Intervjun har även inkluderat ett test för overconfidence för att möjliggöra för respondenternas egna reflektioner kring sin egen eventuella overconfidence.   SLUTSATS: Studien visar att den teoretiska kunskapen om overconfidence och confirmation bias är låg men att den erfarenhetsbaserade kunskapen är hög. Vad gäller hanteringen av risk och psykologiska bias ligger inte respondenternas strategier i linje med forskningen men marknadens säregna egenskaper möjliggör för ekonomisk vinning i utnyttjandet av andra investerares bias.

This paper shows the existence of the size effect in the cryptocurrency market. The size effect is a market phenomenon observed in the stock market in which smaller assets outperform larger assets. Recent literature has revealed the size effect in other financial markets as well. In order to explain the size effect, this paper proposes a general quantitative theory that supports its existence in any financial markets under specific conditions. Furthermore, the paper tests for the size effect in the cryptocurrency market using daily price data from April 2013 to April 2018. The paper finds a statistically significant size effect across the cryptocurrency market during the sample period. In the process, we test a profitable pair-trading strategy that involves opening a short position on the higher rank (larger assets) and opening a long position on the lower rank (smaller assets) of the cryptocurrency market. Based on our findings, we discuss the implications on modern finance, specifically on the subjects of Efficient Market Hypothesis and asset pricing models.

Submitted by Eliana Barboza (eliana.silva1@mackenzie.br) on 2017-09-29T13:21:38Z No. of bitstreams: 2 Luiz Gustavo Doles Silva.pdf: 1222093 bytes, checksum: 4e5012bc801cc9175a097eba3bb0a86b (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Approved for entry into archive by Paola Damato (repositorio@mackenzie.br) on 2017-09-29T16:18:46Z (GMT) No. of bitstreams: 2 Luiz Gustavo Doles Silva.pdf: 1222093 bytes, checksum: 4e5012bc801cc9175a097eba3bb0a86b (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) / Made available in DSpace on 2017-09-29T16:18:46Z (GMT). No. of bitstreams: 2 Luiz Gustavo Doles Silva.pdf: 1222093 bytes, checksum: 4e5012bc801cc9175a097eba3bb0a86b (MD5) license_rdf: 0 bytes, checksum: d41d8cd98f00b204e9800998ecf8427e (MD5) Previous issue date: 2017-08-23 / Humanity has used various instruments as a medium of exchange during its history, from shells to the paper pieces with which we are familiar. However, technological development has eliminated much of the need to give the medium of exchange a physical substrate, making it virtual and preserving only its most important part: the information and value attributed to it by society. Thus, this movement has generated many types of medium of exchange, including Bitcoin and the other Cryptocurrencies. These goods, created and maintained by specific social groups, expand daily as the time passes and the markets realize the great opportunities generated by this new technology. However, such disruption raises great questions in the legal sphere since the legal system currently in force finds it difficult to deal with the Cryptocurrencies given its unique characteristics. Thus, the present paper seeks to verify how the Cryptocurrency fits in the Brazilian legal system and, given the absence of specific regulation regarding the subject, how this sector could be regulated of self-regulated at the national level. Thus, through the analysis of national and foreign doctrine and jurisprudence, analysis of empirical data and legislation, this research presents the functioning of the cryptocurrencies, using Bitcoin as an example given the fact that it is the most popular Cryptocurrency, indicates its legal status (which makes its use and legal treatment better defined) and how the regulation and self-regulation of its use should be carried out, pointing out how this issue was addressed in other countries and how similar structures and markets dealt with issues related to new technologies. / A humanidade utilizou diversos instrumentos como meio de troca durante a sua história, desde conchas até os pedações de papel com os quais somos familiares. Contudo, o desenvolvimento tecnológico eliminou grande parte da necessidade de substrato físico do meio de troca, tornando-o virtual e preservando apenas a parte mais importante: a informação e o valor atribuído a este instrumento pela sociedade. Assim, este movimento gerou muitos tipos de meio de troca, incluindo a Bitcoin e as outras Criptomoedas. Estes bens, criados e mantido por grupos sociais específicos, expande-se dia após dia na medida em que o mercado passa a perceber as grandes oportunidades geradas por esta nova tecnologia. Contudo, tal disrupção gera grandes questionamentos na esfera jurídica vez que o sistema legal atualmente em vigor encontra dificuldade ao lidar com a Criptomoeda dadas as suas características únicas. Assim, o presente trabalho busca verificar como a Criptomoeda se encaixa no sistema jurídico brasileiro e, dada a ausência de regulação específica a respeito do tema, como o regramento da utilização de Criptomoedas pode se dar em âmbito nacional. Assim, por meio da análise da doutrina e jurisprudência nacional e estrangeira, análise de dados empíricos e legislação, esta pesquisa apresenta o funcionamento da Criptomoeda, utilizando a Bitcoin, dado o fato de que esta é a Criptomoeda mais popular atualmente, indica a natureza jurídica desta (o que faz com que a sua utilização e tutela jurídica possam ser mais bem definidas) e como a regulação e autorregulação do seu uso deve ser realizada, apontando como esta questão foi abordada em outros países e como estruturas e mercados similares lidaram com questões relacionadas a novas tecnologias.

Bitcoin has emerged as the leading cryptographic currency since its inception in 2009 and at the time of writing holds a market capitalization of $28.4 billion. This ever-increasing figure has attracted adopters seeking to advance their investments, often leaving purely technical aspects on the sidelines. As is the case with any innovative technology, misconceptions are plentiful and information is not always conclusive. The research effort presented in this paper consists of a quantitative study seeking to address the subject of user anonymity in the Bitcoin network by employing an online survey on one of the most prominent Bitcoin forums. This includes 50 eligible participants, whose motivation is derived through the application of temporal motivation theory. The survey seeks to form an understanding of user attitudes towards the aspect of anonymity by following a methodological approach for exploring common tendencies among the representatives and will serve as the underlying data set from which conclusions can be drawn. Furthermore, this paper will present a literary study of the actual state of anonymity in this peer-to-peer technology by reviewing current findings highlighted in the area, thus presenting a comprehensive view of anonymity in the Bitcoin network, which will contrast the user study.

No description available.

in English The motivation for this thesis is to analyze Bitcoin as Bitcoin is still a new phenomenon and requires an economical, legal, and legislative evaluation. In this thesis we seek an answer to the question what is Bitcoin. This thesis is divided into three main blocks, within them we use analytical, descriptive, and comparative methods. In the first part, we aim mostly on the economic side of Bitcoin, comparing Bitcoin to money in general sense. In the second part, we argue whether Bitcoin shall be considered a thing in a legal sense under the Czech law. In the third part, we describe the current Bitcoin's regulatory situation and suggest a drafting of Bitcoin specific regulation. The conclusion of this thesis is that Bitcoin is a digital medium of exchange that cannot be considered money or currency. To the extent, Bitcoin might be interpreted in ways where it does not satisfy the legal definition of a thing in legal sense, but for regulatory purposes it shall be, at least for now, considered a thing in legal sense. We also suggest that Bitcoin shall be systematically regulated by imposing various duties on persons who's scope of business is relating to the Bitcoin.