Podcast
Root Causes 41: What Is Blockchain's Killer App?


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
October 3, 2019
Our hosts frequently run into the assumption that blockchain and PKI are extremely similar technologies and are possibly even competitive to each other. While the two approaches accomplish some related goals, they are very different in how they work and ultimately accomplish different ends. Join us as we explain what blockchain actually does and how it compares to PKI, including some examples of use cases that are appropriate for each of these technologies.
Podcast Transcript
Lightly edited for flow and brevity.
It’s come up so much, it’s just like a movie star that might’ve had too much exposure. You know people get tired of seeing their pictures. People sometimes get tired of hearing about blockchain.
I think this podcast today is going to be a real quick one where you and I talk about where it’s important and in fact, we might even want to title this podcast something around killer app. In other words, what’s blockchain really good at?
One of the things that I routinely run into is people who don’t fundamentally understand the difference between blockchain and PKI, pure and simple. And cryptography. They just kind of have all these ideas mixed up in their minds. And you understand to some degree why, because they accomplish some similar goals, right? It’s about non-reputability. It’s about identifying information very specifically in a way that you know it’s valid.
I want to take it more from the technological standpoint of what’s underlying this. If you tuned in today to hear all about the math behind it, you’re going to be disappointed; you’re going to have to wait for a future podcast.
So Tim, if you and I are doing business together, we don’t know who each other are, and therefore we don’t necessarily trust each other. But we’ve successfully committed a transaction, and we were using any system, say PKI. I have a certificate, you have a certificate, then, we were going to do some sort of a transaction with a third-party that we don’t know yet and haven’t established a relationship. When that third-party comes in, we don’t know if this person is trustworthy or not, and if this person has been issued from a centralized certificate authority: A PKI certificate, just as an example of a technology.
The fact of the matter is it’s in so many use cases it’s almost hard to imagine. And that centralized database, that tiny bit of latency of double checking, you just don’t even think about it. In fact, I know as a certificate authority I think the number is into the billions per day or more of OCSP responder checks that we do, right?
Let’s get back to blockchain, and create a real-world scenario. Let’s say, you’re a bank and I'm a person who wants to apply for a loan. Well, in a very simplistic sense one of the ways that it works today is, you’re going to go off to a centralized database to check my credit rating. And there are several major credit rating agencies in North America. That’s pretty cool and It’s worked for an awfully long time. But jeez, wouldn’t it be interesting if I could present to you an artifact, and you could then look me up on a completely public type of system so that I could assert who I am and my credentials of my credit rating that were issued by other entities that I’ve done business with. And they’re not going to be seen by anybody except the people I want to give access to.
Therefore, essentially there’s no revocation check. You’re not checking to see if I'm a bad guy or a good guy based off of a centralized database. You’re checking out what is essentially a publicly distributed system. Which then can vet out what I'm claiming.
So, think about all the scenarios where the lookup of someone is better when it’s on a distributed system, because of the fact that you want to reduce that latency of checking on a centralized system. That’s just an example.
Let me give you an example of hash chaining that’s near and dear to your heart, and that’s the certificate transparency logs. That is in technical terms, a one-way Merkle tree: Every single certificate that’s issued by a CA has a record that’s appended to the certificate transparency log. It cannot be modified, It cannot be deleted, It’s only one way. And, if there’s a mistake that’s made, the correction to the mistake record is added, and then you add the new record that makes the correction. And that is why you often hear about blockchain as a distributed ledger. It is absolutely a ledger because there’s no such thing as changing a record on a blockchain. You merely add records to it.

