Distributed Ledgers

Section III: Distributed Systems Fundamentals

Army Cyber Institute

April 9, 2026

The Shared Notebook Problem

Scenario: Three agencies must keep the same incident log. No one is “the boss.” Changes must be visible, final, and independently verifiable.

  • What happens when Agency B writes an entry while Agency A is offline?
  • What if someone needs to correct a past entry — can they just edit it?
  • Does the order of entries matter? What if two agencies write at the same time?
  • What if one agency’s copy gets corrupted — how do the others know?

From Logs to Ledgers

  • Logs record events or actions over time — server access logs, transaction histories, audit trails.
    • Each entry is append-only: you add to the end, you don’t edit the past.
  • What challenges do we face when trying to distribute logs?
    • Consistency: If multiple nodes write simultaneously, which version is correct?
    • Integrity: How do you detect if one node silently edits a past entry?
    • Ordering: Does the sequence of entries matter? (Yes — especially for financial transactions, access records, or anything where “who went first” has consequences.)
  • A ledger takes the append-only log and adds the machinery to solve these problems across multiple participants:
    • Replication — every participant holds a copy, so no single node controls the record
    • Hash-linking — each entry commits to the one before it, making retroactive edits detectable
    • Consensus — a process to agree on what gets appended and in what order

A Distributed Ledger

Definition: A distributed ledger is a shared, append‑only record replicated across multiple participants, where entries are accepted and ordered according to a consensus process, and tamper‑evidence is provided by cryptographic linking.

  • Replicated state
  • Append‑only, tamper‑evident history
  • Agreement on order (consensus)

Distributed Ledger vs. Centralized Database (Compare/Contrast)

Feature Distributed Ledger Centralized Database
Trust Model Adversarial-tolerant Admin-trusted
Mutability Append-only Mutable
Ordering Consensus-ordered index-based ordering
Governance Protocol / Consortium Owner

Immutability Source

  • Hash‑chaining makes retroactive edits detectable.
    • What would this look like in practice?
    • If I drop the oldest entries to save space:
      • can I still add new data to the chain?
      • under what circumstances can I detect if someone else has made changes to dropped data?
  • Distributed replication makes unilateral edits ineffective.
  • Requires a consensus model to derive finality.

Transparency vs. Privacy

  • Transparency: anyone (or any permitted member) can verify state changes.
  • Privacy: access control, encryption, or partitioning restricts who sees what.
  • Are there ways around the tension between these two?
    • Commit private data through hashing
    • Zero-knowledge Proofs
    • Homomorphic Encryption

Permissioned Ledgers

A permissioned ledger is a distributed ledger where participation is restricted to known, authenticated entities admitted through a governance process.

  • Membership is curated: organizations join by invitation or application — each participant is identified and authenticated (e.g., via certificates from a Membership Service Provider).
  • Access control is explicit: policies define who can propose transactions, who must endorse them, who orders them, and who can read which data.
  • Performance and privacy can be tuned: because participants are known, the system can optimize for throughput and use private data channels.
  • Exemplar: Hyperledger Fabric separates execution, ordering, and validation — a modular architecture built for enterprise inter-organizational workflows.

What are potential use cases for permissioned ledgers outside of finance?

Permissionless Ledgers

A permissionless ledger is a distributed ledger where anyone can participate — read, write, and validate — without needing approval from a central authority.

  • Open by default: participation is gated by protocol rules, not an access control list. Identity is expressed through key pairs, not real-world vetting.
  • Sybil resistance through economics: because anyone can join, the system uses economic or computational costs (proof of work, proof of stake) to prevent one actor from cheaply overwhelming the network.
  • Probabilistic or economic finality: confidence in an entry grows as the network builds on top of it, rather than being declared final by an authority.
  • Exemplar: Bitcoin — transactions are authorized by digital signatures, broadcast peer-to-peer, and accepted into the shared history by nodes following common validation rules.

Where would you want to use permissionless ledgers outside of cryptocurrencies?

Permissioned vs. Permissionless: Comparison

Dimension Permissioned Permissionless
Membership Known, authenticated; join by governance Open; anyone with software + keys
Identity Real-world identity via certificates/MSP Pseudonymous via key pairs
Sybil resistance Admission control Economic cost (PoW, PoS)
Throughput Higher (fewer nodes, known trust) Lower (broad replication, open membership)
Finality Deterministic (once ordered, it’s final) Probabilistic (confidence grows over time)
Privacy Private channels / selective disclosure Public by default (all nodes see all data)
Trust assumption Trust the governance process Trust the protocol + economic incentives
Example Hyperledger Fabric Bitcoin, Ethereum

Governance Models

Permissionless Governance

  • Changes proposed via improvement proposals (BIPs, EIPs)
  • Adopted through rough consensus among independent operators
  • Disagreements can lead to hard forks — the network splits and both chains continue (e.g., Bitcoin vs. Bitcoin Cash)
  • No authority can force an upgrade; users “vote with their nodes”

Permissioned Governance

  • Changes governed by charters, contracts, or consortium votes
  • Membership changes require formal approval
  • Disagreements resolved through contractual or legal processes — not forks
  • A governing body can mandate upgrades, revoke membership, or roll back errors
  • In both models: clarity on governance reduces technical surprises. Write down decision rights before arguing about throughput.

Threats to Distributed Ledgers

Both permissioned and permissionless ledgers face threats — but the specific risks differ:

  • Network partitions and eclipse attacks: An adversary isolates a node or group of nodes, feeding them a false view of the network.
    • Permissionless: eclipsed miners/validators may waste resources on the wrong chain.
    • Permissioned: a partitioned organization may miss critical updates or fall out of sync.
  • Majority or collusion attacks: An actor (or coalition) gains enough influence to control the ledger.
    • Permissionless: 51% attacks — amassing hash power or stake to rewrite recent history.
    • Permissioned: colluding member organizations can push fraudulent transactions if endorsement policies are too weak.

Threats to Distributed Ledgers (cont.)

  • Long-range or history rewrite attacks: An attacker uses old credentials (keys or stake) to construct an alternative version of distant history and present it as legitimate. Unlike a 51% attack on recent blocks, this targets the deep past.
    • Permissionless: in proof-of-stake systems without checkpointing, an attacker who held stake months ago can cheaply build a competing chain from that point forward. Proof-of-work is less vulnerable because re-mining old blocks requires re-spending real energy.
    • Permissioned: largely mitigated by deterministic finality. Once a block is committed by the ordering service, it is final and there is no mechanism to “fork from the past.”
  • Insider and operational failures: Key compromise, misconfigured policies, or governance failures.
    • Permissionless: lost private keys = lost funds, permanently.
    • Permissioned: compromised admin credentials can alter membership, endorsement policies, or channel configurations.

Consensus

Consensus is the process by which distributed nodes agree on a single, consistent ordering of events — ensuring that every participant sees the same history, even when some nodes fail or act maliciously.

  • Finality: There is a point at which an entry is considered permanent. This can be deterministic (a protocol step declares it final, as in BFT-based systems) or probabilistic (confidence grows as more work builds on top, as in Bitcoin). Think: “when can I treat this as done?”

Different consensus families (PoW, PoS, BFT) deliver these properties under different assumptions. We will unpack specific algorithms in the next lesson.

Trade‑offs

We saw the permissioned vs. permissionless comparison — now zoom out to the underlying trade-off:

  • Decentralization increases overhead: more verification, more propagation, more conservative assumptions → lower throughput, higher latency.
  • Centralization boosts speed and privacy — but concentrates power and risk in fewer hands.
  • The design choice is where you want the trust boundary to lie.
  • There is no one-size-fits-all solution.

Case Study A — Hyperledger Fabric (Permissioned)

  • Membership Service Provider (MSP): known organizations with verifiable identities.
  • Execute–Order–Validate architecture separates execution from consensus.
  • Endorsement policies define which peers must approve a transaction.
  • Private channels and collections restrict data visibility.
  • Focus: governance, confidentiality, and modular consensus.

Case Study B — Public Sector: EBSI & Estonia (KSI)

  • European Blockchain Services Infrastructure (EBSI)
    • EU initiative to provide a shared, permissioned ledger for trusted cross-border services.
    • Focus areas: digital diplomas, verifiable credentials, business registries, and document notarization.
    • Operated by national authorities under EU governance
      • Trust through institutional federation rather than mining.
  • Estonia — Keyless Signature Infrastructure (KSI)
    • Protects the integrity of government and healthcare data through hash-linked proofs anchored in public ledgers.
    • Nation-scale auditability without exposing data by using hashes instead of content.
    • Public, permissioned ledger.

Case Study C — Bitcoin Ledger (Permissionless)

  • Anyone can validate; open read/write under rules.
    • Anyone can write, although they need to solve a puzzle first
  • Pseudonymous keys and public auditability of transactions.
  • Payments cleared via network‑verified history as recorded in the ledger.

Poll: When Does a Distributed Ledger Help?

  • A. Multi‑company supply provenance with audits and no trusted hub
  • B. Single‑company HR system with strict privacy and 100k writes/sec
  • C. Cross‑border diploma verification among universities
  • D. Internal sensor telemetry with one operator and strict real‑time needs
  • E. An online karma system for use in a psuedo-anonymous message board

When a Centralized Database Wins

  • One owner can be trusted to administer the truth.
  • Heavy transaction processing requirements with strict latency targets.
  • Regular changes to data and rich queries.

Design Questions

  • Who are the writers and readers? Is membership open or curated?
  • What are the trust assumptions and incentives?
  • What privacy model is required?
  • What throughput/latency is acceptable?
  • What is the governance and upgrade process?
  • What external systems must interoperate?

Common Pitfalls

  • ”Blockchain everywhere” without a trust problem
    • If there’s no multi-party trust issue, a database run by the responsible owner is simpler, faster, and cheaper.
    • Ask: “Would a shared spreadsheet with an auditor solve this?” If yes, you probably don’t need a ledger.
  • Ignoring identity/governance in permissioned designs
    • Permissioned ledgers are identity-driven systems. If you don’t define who can join, who can sign, and how upgrades are approved before writing code, you’ll discover obligations mid-incident.
    • PKI, membership services, and endorsement policies are core components, not afterthoughts.

Common Pitfalls (cont.)

  • Assuming “transparent” means “public data”
    • Transparency means verifiability: proving that rules were followed and history is intact.
    • It does not mean exposing personally identifiable information. Design for selective disclosure: make proofs broadly checkable and limit payload visibility to authorized parties.
  • Underestimating operational complexity
    • Distributed systems require monitoring, key rotation, upgrade coordination, and incident response across multiple organizations.
    • The hardest problems are often social (governance disputes, key compromise response) rather than technical.

Micro Lab: Tamper-Evident Ledger

Open Tamper-Evident Ledger Lab

References

[1]
D. Yaga, P. Mell, N. Roby, and K. Scarfone, “Blockchain technology overview,” National Institute of Standards and Technology, Gaithersburg, MD, NIST IR 8202, Oct. 2018. doi: 10.6028/NIST.IR.8202.
[2]
UK Government Chief Scientific Adviser, “Distributed Ledger Technology: Beyond Block Chain.” 2016. Available: https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/492972/gs-16-1-distributed-ledger-technology.pdf
[3]
S. Nakamoto, “Bitcoin: A Peer-to-Peer Electronic Cash System.” Satoshi Nakamoto Institute, Oct. 31, 2008. Accessed: Sep. 12, 2025. [Online]. Available: https://cdn.nakamotoinstitute.org/docs/bitcoin.pdf
[4]
S. Haber and W. S. Stornetta, “How to time-stamp a digital document,” J. Cryptology, vol. 3, no. 2, pp. 99–111, Jan. 1991, doi: 10.1007/BF00196791.
[5]
P. Ruan et al., “Blockchains vs. Distributed Databases: Dichotomy and Fusion.” Accessed: Oct. 17, 2025. [Online]. Available: https://arxiv.org/abs/1910.01310
[6]
E. Androulaki et al., “Hyperledger fabric: A distributed operating system for permissioned blockchains,” in Proceedings of the Thirteenth EuroSys Conference, Porto Portugal: ACM, Apr. 2018, pp. 1–15. doi: 10.1145/3190508.3190538.
[7]
D. Boneh and V. Shoup, “Zero Knowledge ProofsIntroduction.” 2020. Available: https://intensecrypto.org/public/lec_14_zero_knowledge.html
[8]
D. Boneh and V. Shoup, “Fully Homomorphic Encryption (FHE) — Overview.” 2020. Available: https://intensecrypto.org/public/lec_15_FHE.html
[9]
Hyperledger, “A Blockchain Platform for the EnterpriseHyperledger Fabric Docs main documentation.” Accessed: Oct. 27, 2025. [Online]. Available: https://hyperledger-fabric.readthedocs.io/en/release-2.5/
[10]
E. Deirmentzoglou, G. Papakyriakopoulos, and C. Patsakis, “A Survey on Long-Range Attacks for Proof of Stake Protocols,” IEEE Access, vol. 7, pp. 28712–28725, 2019, doi: 10.1109/ACCESS.2019.2901858.
[11]
European Commission, “European blockchain services infrastructure | Shaping Europe’s digital future.” Accessed: Oct. 28, 2025. [Online]. Available: https://digital-strategy.ec.europa.eu/en/policies/european-blockchain-services-infrastructure
[12]
European Commission, VC Framework | EBSI hub.” Accessed: Oct. 27, 2025. [Online]. Available: https://hub.ebsi.eu/vc-framework
[13]
Estonia Business and Innovation Agency, KSI blockchain.” Accessed: Oct. 27, 2025. [Online]. Available: https://e-estonia.com/solutions/cyber-security/ksi-blockchain/
[14]
European Commission, EBSI Hub.” Accessed: Oct. 27, 2025. [Online]. Available: https://hub.ebsi.eu/
[15]
Hyperledger Fabric Docs, “Chaincode for Developers.” 2018. Available: https://hyperledger-fabric.readthedocs.io/en/release-1.3/chaincode4ade.html