Fixing cross-chain bridges with confidential computing

From time to time we hear {that a} cross-chain bridge has been hacked. In 2022 alone, six bridges have been hacked, and greater than $1.2 Billion price of crypto property have been stolen.

What are cross-chain bridges? What function do they serve? And why are they such outstanding honeypots? Can Confidential Computing be used to enhance the safety of cross-chain bridges?  

Cross-chain bridges assist in shifting crypto property from one blockchain to a different. Fascinating circumstances are popularizing them. For one: Older blockchains which have survived over time find yourself having extra useful property. However older blockchains are sometimes sluggish, have low throughputs and supply greater transaction charges. On the flip aspect, newer blockchains or sidechains might be quick, have excessive throughput and the transaction charges could also be extraordinarily low. Cross-chain bridges make it simple to maneuver well-liked property from older blockchains onto newer blockchains and sidechains the place they could be transacted extra effectively.  

Allow us to perceive how a cross-chain bridge works. A crypto asset is locked in a vault sensible contract on the supply blockchain, and a illustration of that asset is minted within the peg sensible contract on the vacation spot blockchain. A set of entities which are generally referred to as “guardians” are chargeable for monitoring the vault sensible contract on the supply chain for brand spanking new deposits and for creating their representations within the peg sensible contract on the vacation spot blockchain.

Conversely, when the representations are destroyed within the peg sensible contract, these guardians are chargeable for releasing an equal quantity of tokens held within the vault sensible contract on the supply chain.  

It’s simple to see that an attacker can both assault the vault sensible contract, the peg sensible contract or the guardians. Typically, vulnerabilities are present in sensible contracts. For instance, the newest hack on bridge supplier Nomad resulted within the lack of almost $200 million, exploiting vulnerabilities within the sensible contract logic on the supply blockchain. These had been launched throughout a sensible contracts improve course of. The assault on Axie Infinity’s Ronin bridge led to a lack of $625 million; the assault on Horizon Bridge operated by California-based agency Concord led to the lack of $100 million. Each of these assaults concerned compromising the keys held by guardians.  

Concord didn’t use knowledge in-use encryption. It’s fairly potential that the personal keys had been misplaced following a reminiscence dump assault. It’s irrelevant if the keys had been doubly encrypted when at relaxation. When these keys are getting used, they’re delivered to the primary reminiscence. If the reminiscence of the method utilizing the secret’s dumped, the personal key might be extracted.  

Enterprise-grade Confidential Computing

Confidential Computing is a expertise that helps knowledge in-use encryption. Easy reminiscence dump assaults don’t work when utilizing Confidential Computing applied sciences similar to Intel SGX. Additionally it is potential to boost the bar and create an enterprise-grade Confidential Computing platform. This includes supporting cluster mode operations, excessive availability, catastrophe restoration, acquiring a wide range of safety certifications, and encasing nodes with tamper-resistant {hardware} to stop side-channel assaults. Enterprise-grade Confidential Computing platforms additionally assist quorum approvals for utilizing saved keys. A number of approvers might be required for signing transactions with every key.  

On condition that cross-chain bridges retailer remarkably excessive sums of cryptocurrencies, enterprise-grade Confidential Computing platforms needs to be utilized by guardians for producing, storing and utilizing keys.  

However it is usually laborious for a bridge guardian to fully belief an enterprise-grade Confidential Computing platform. What if the platform operator denies service for some motive? Producing keys that don’t rely on a user-provided seed might be harmful. A DOS assault may result in the funds being completely locked.

One resolution is to personal the platform and to deploy it your self in datacenters of your selection. The opposite resolution is to make the platform generate a key after which make it generate elements of the important thing utilizing a threshold secret sharing scheme. The shares might be encrypted with public keys offered by the bridge guardians. This fashion, if a threshold variety of guardians can mix their shares, the important thing might be re-generated even when there’s a DOS assault by the supplier of the enterprise-grade Confidential Computing platform.  

Bridge guardians must rethink how they’re managing their keys. We’ve seen too many assaults that would have been averted with higher key administration practices. Holding keys on-line and sustaining them securely is a tricky activity.

Fortunately, enterprise-grade Confidential Computing can go a great distance in enhancing the safety of bridge guardian keys. 

Pralhad Deshpande, Ph.D. is senior options architect at Fortanix.