Certification of digital documents, such as academic credentials, seems a particularly suitable application for the use of blockchain and distributed ledger technologies. Indeed, these technologies enable decentralized certification systems that rely on the immutability and persistence of their distributed ledgers. However, in the absence of a central trusted authority, it is not easy to guarantee the authenticity of the connection between the real identity of an academic institution and the digital identity of the certificate issuer. In this paper, we demonstrate that one of such systems, known as Block.co, has a vulnerability that allows the production of forged certificates that are recognized as valid by the system. Since this is an inherent limitation of the approach used for blockchain-based certification, our attack is likely to be extendable to other systems adopting the same approach.

The use of blockchains for data certification and traceability is now well established in both the literature and practical applications. However, while blockchain-based certification of individual data is clear and straightforward, the use of blockchain to certify large amounts of data produced on a nearly continuous basis still poses some challenges. In such a case, in fact, it is first necessary to collect the data in an off-chain buffer, and then to organize it, e.g., via Merkle trees, in order to keep the size and quantity of certification data to be written to the blockchain small. In this paper, we consider a typical system for blockchain-based traceability of a production process, and propose and comparatively analyze some strategies for certifying the data of such a process on blockchain, while maintaining the possibility of verifying their certification in a decentralized way.

Cyber risk assessment is one of the top priorities of modern organizations and companies, owing to the massive amount of data they process on a daily basis and to the increasing number of successful cyber attacks. The probability of occurrence of these cyber incidents can be estimated by means of statistical tools, which exploit numerical categories to compute the probability that the organization will be breached by one or more cyber attacks. However, these approaches heavily rely on experts' estimates and/or on past data, which are not always available. In this paper we show that, by exploiting machine learning tools, cyber risk can be assessed by using some easily obtainable parameters (called maturity, complexity, attractiveness) representing the cyber posture of the organization under exam. To validate the method we propose, we apply it to three organizations in the healthcare sector having different values of maturity and complexity. The results highlight how the model can be successfully used to assign each organization a class of cyber risk, even in a crucial sector such as healthcare.

We propose a protocol to jointly achieve authentication and consensus on a blockchain network, in which endpoints are required to digitally sign some random message using fuzzy keys according to a classic fuzzy signature paradigm typical, for example, of biometric authentication. We consider classic RSA digital signatures, showing that fuzziness in the secret key translates into some noise affecting the derived signatures. The removal of such a noise provides the basis for building a blockchain consensus mechanism, which we name Proof of Fuzzy Signature (PoFS). It basically provides a special instance of Proof of Work in which the mining process corresponds to the de-noising process of RSA digital signatures derived from fuzzy keys. This way, the authentication process is delegated to a distributed network and, at the same time, requires executing the useful task of removing noise from fuzzy signatures.