The Takeaway:
- Enterprise blockchain solutions in Russia have to get their cryptographic elements certification with the FSB, the counter-espionage agency
- The process can take several years to complete and up to $100,000
- Some foreign-developed blockchains canât satisfy the requirement without a fork
- Russian-made systems might end up isolated from the global market due to distrust of Russian government cryptography standards
Blockchain technology was created to be borderless. But in the real world, borders still impose limits on this technology.
Everything related to cryptography in Russia falls under the supervision of the Federal Security Service, or FSB, which is the successor to the KGB. The FSB has a certification process for blockchain companies, which might cost over $100,000 and take more than a year, according to experts on the Russian enterprise blockchain market.Â
Related: Russia to Treat Crypto as a Taxable Property
Last year, the Fintech Association, a consortium helmed by the Bank of Russia, reported obtaining the certification for Masterchain, its blockchain for banks. The process took about three years to complete, and itâs still not the end of story.Â
Read more: âDisappointedâ by Central Bank Blockchain, Russiaâs Largest Bank Eyes Alternatives
The Fintech Association is working on getting another certificate from the FSB, this time for a particular product on Masterchain. Going forward, any new iteration and implementation of the code using cryptographic elements needs to go through this process.Â
Other Russian enterprise blockchain projects, including Waves and Bitfuryâs Exonum, are still working on getting certified as well â and they also may need more than a year.Â
Related: Wanted Wirecard Exec Said to Be Sheltered by Secret Service in Russia
The FSBâs certification process is challenging the borderless feature of blockchain technology in two ways. Globally, Russia is trying to get the cryptographic community to accept its encryption algorithm as a standard. Inside the country, the blockchain industry is trying to figure out what to do with a product that foreign partners might be reluctant to adopt.Â
Unofficial must
While there is no law directly stating that blockchain companies must be certified by the FSB, companies have strong incentives to do so. First, according to Russian law, documents that are signed electronically must use state-certified electronic signatures to be legally binding documents.
âIf weâre talking about financial services, certification is a must, otherwise the transactions between [blockchain system] participants wonât have any legal significance. And the digital signature should be built into the blockchain system,â explained Anatoly Konkin, head of DLT at the Fintech Association.Â
Certification also could help convince big clients, in particular government agencies in Russia, that the system youâre building is secure, says Ivan Maslov, Bitfuryâs head of development in Russia.Â
Read more: Waves and the Tricky Task of Being a Russian Crypto Brand
âIf you are creating a system for a government body, it must be certified,â Maslov said.
âItâs an additional competitive advantage for [enterprise blockchain] vendors, which allows them to promise that the system will satisfy all the security requirements,â said Dmitri Plakhov, head of the technical committee of the Center for Distributed Ledger Tech at the Saint Petersburg State University.Â
The situation is not unique to Russia, notes Sasha Ivanov, CEO of Waves: âUsing local cryptography for government-level blockchain projects is a reality that we will have to deal with, be it Russian, Chinese, or Western projects.âÂ
The certification process in Europe, he adds, might take less time than in Russia, but the principle is the same.
Russian standard
For blockchain companies, however, the FSB certification process brings special challenges. Blockchain technology is supposed to be a transparent, agile and auditable system, but having certified cryptographic modules raises questions about transparency and reliability.Â
The easiest way to comply with the FSB requirements is to use a solution from a licensed vendor â but the code of such solutions is not open source and can not be audited. This is not obligatory, and Masterchain, for example, is using its own cryptography elements, Konkin said. However, an FSB-licensed company named Crypto PRO has been supervising the entire creation of Masterchain.Â
CryptoPRO is also one of the licensed providers of the GOST (GOvernment STandard) cryptography solutions certified by the FSB.
Bitfuryâs Maslov explains that to get Exonum compatible with the requirements of Russian government bodies that the company is working with, Bitfury used software made by one of the FSB-certified providers. The software is responsible for data encryption, hashing and securing channels for the nodes to connect, Maslov said, but itâs up to the blockchain architect to decide what functions should be used.Â
The process is far from transparent. When a company gets a document from the FSB saying its product is now certified, most of that document is classified.Â
If the blockchain solution is open source, itâs certified version wonât be. For example, the certified version of Bitfuryâs Exonum will not be open source, even though Exonum itself is, Maslov said. âThe open code can not be certified. You need to certify a certain version of it, but if somebody can change it with one click, itâs hard to control this,â he adds.
Read more: Moscow Said to Hire Kaspersky to Build Voting Blockchain With Bitfury Software
Furthermore, the certification process is complicated by the need to check not just the code, but also its implementations. Even though Masterchain was already certified as a platform, it also had to get a separate certificate for each app itâs building on top, Konkin said. For one of these apps, which stores digital mortgage bonds, the certification is already complete. But for another one, the inter-bank letter of credit project, the process is still ongoing. Â
The certification touches every part of the blockchain architecture. Artem Kalikhov, Wave Enterprise director of product, explained that the certification process entails the entire architecture of the blockchain being scrutinized. This includes ânot just the use of the cryptographic functions, but also the information security, correctness of the consensus algorithm. Different threat models for the system must be studied.â
The task gets further complicated by the fact that the FSB hasnât dealt with blockchain systems before, excluding Masterchain, and it has to grapple with the novel concepts of blockchain architecture.
âNow they are figuring out blockchain, consensus, smart contracts,â Kalikhov said.
The certification process requires quite a lot of company resources. Normally, two or more people in the company need to work on it full time, writing the technical papers and communicating with the FSB, Maslov said. The product thatâs getting certified basically gets frozen for the period of certification, and any updates need to go through the process again, he said.Â
A game of algorithms
The FSB certification requires international blockchain companies to use Russian standards, but those Russian standards could be viewed with suspicion abroad.Â
Historically, Russia has maintained its own cryptographic standard, the so-called GOST, as did China, staying clear of the global market of cryptographic solutions and not trusting foreigners to sell them encryption tools.Â
This strategy was vindicated by stories such as that of Crypto AG, a Swiss code machine manufacturer, which turned out to be controlled by the NSA for decades and sold compromised machines across the globe, as the Washington Post reported.Â
The certification process also makes it harder for global blockchain projects to make it in Russia.Â
âCryptographic algorithms created abroad canât be recognized as legitimate in Russia by the law,â Alexey Lukatsky, security advisor at CISCO, said. âAccording to the FSB requirements, a cryptographic solution developer should be based in Russia and have a license from FSB, which is unfeasible for foreign companies.â
Yet another problem is that Russian certification could cause blockchain projects to be cut off from the global developer community.Â
âThere are no platforms, and wonât be any, where you can build the Russian cryptography in and keep the full tech support available before,â CryptoPROâs engineer Dmitri Pichulin told CoinDesk.Â
Currently, most blockchain solutions are based on the hashing algorithms built upon the Advanced encryption standard, or AES, established by the U.S. National Institute of Standards and Technology.Â
For internationally recognized standards, there are multiple libraries that developers can use, while for national standards, there are less opportunities to build upon freely. Libraries for GOST are harder to find, a cybersecurity expert Sergey Prilutsky says.
For example, there is no GOST library for the Go language, which is used to build on Hyperledger Fabric, Prilutsky said. âSo the devs have to transfer [their code] from C++ to Go. But in this case, there is a danger to introduce serious vulnerabilities into a system,â he added.
In addition, the GOST crypto algorithm itself has been viewed with apprehension by the global cryptographic community. When the algorithm, named Kuznyechik (âgrasshopperâ in Russian), was presented to the International Organization for Standardization (ISO) last summer, it got a cold reception, Vice reported, as the experts from other countries found potential vulnerabilities in the cipher.Â
According to the French cryptographer Pascal Paillier, the research has shown that âthe Russian standards may contain what looks like a backdoor, which, if confirmed, would allow Russia to be able to break the confidentiality of communications,â he told Vice.
No more Fabric?
Blockchain products with foreign roots might get pushed out of the Russian market. Take the example of Hyperledger Fabric by IBM. Hyperledger has been the most popular framework for enterprise blockchain, and the giants like the Russian Railways, Sberbank and Gazpromneft used it as a platform of choice for blockchain proof-of-concepts. But maybe not anymore.Â
Previously, there was a way to build the GOST cryptography into Fabric without forking it â which is, without making it incompatible with the main branch code â by using plugins, and CryptoPRO even created some for Russian companies to use. However, the most recent version of Fabric, released late January, no longer supports plugins.Â
Read more: Meet the Russian Oligarch Launching a Metal-Backed Crypto Token
IBM engineer Chris Ferris, who is the Ñhair of Hyperledgerâs Technical Steering Committee, said via a spokesperson that itâs still possible to build in an alternative cryptography but âit would require a recompile of the binaries.â As for the plugins, supporting them âwas not sustainable and required significant work-arounds to manage dependencies,â Ferris added.
There is also an opening for Russian developers to find a way to securely build the GOST cryptography into Fabric and provide quality tech support and regular code updates, essentially replacing the Hyperledger community.Â
Some companies have been working on commercial forks of Hyperledger Fabric already. One of them is CryptoPRO, which has already patented its forked version, named CryptoPRO HLF 1.0.Â
Itâs not a commercial product yet, Pichulin says, but it might become one. âThe demand is there, tech support and updates are on our agenda.â
Still, the challenge of certification, combined with Russiaâs law demanding that all Russianâs data be stored inside the country, might further insulate Russia from the global technology market.Â
Cryptographic elements are rooted deep in any productâs core, which makes systems based on different standards incompatible, Prilutsky says.Â
He added:
âThe open source solutions based on Western [cryptographic] standards, available in hundreds of countries, canât be used in Russia because of the certification requirements, and the blockchains with Russian cryptography are a non-starter for the global market players â they are not trusted.â
Related Stories
