Project Title: NullBlock: An Immutable, Non-Repudiable Threat Intelligence Ledger Using Custom SHA-256 Blockchain and Asymmetric Cryptography
Domain: Applied Cryptography, Cybersecurity, Distributed Systems, SOC/Incident Response
Repository: NullBlock
In modern Security Operations Centers (SOCs) and Computer Incident Response Teams (CIRTs), Threat Intelligence (malicious IPs, attack vectors, malware file signatures) is conventionally stored in centralized relational databases (e.g., PostgreSQL, Elasticsearch) or shared through centralized platforms (MISP, OpenCTI).
These architectures suffer from single-point-of-trust vulnerabilities:
- Privileged Access Tampering: Database administrators or attackers with compromised credentials can alter, forge, or purge historical attack logs, destroying forensic evidence.
- Identity Spoofing & Repudiation: Logs lack cryptographic binding to individual analysts. An analyst can deny logging an incident, or a malicious actor can forge reports under someone else's name.
- Public Blockchain Infeasibility: Public blockchains (Ethereum, Bitcoin) require constant internet connectivity, have high latency, and incur expensive gas transaction fees, making them unsuitable for confidential, air-gapped enterprise environments.
NullBlock addresses these limitations by introducing a lightweight, zero-dependency, local-storage custom blockchain paired with 2048-bit RSA-PSS digital signatures. Every logged threat indicator is permanently chained and cryptographically bound to a registered analyst’s identity, providing tamper-evidence, non-repudiation, and an unbreakable chain of custody.
| Metric / Feature | Traditional Relational DB / SIEM | Public Blockchains (Ethereum / BTC) | NullBlock (This Project) |
|---|---|---|---|
| Tamper Resistance | ❌ None (Admin can UPDATE/DELETE) |
✅ High (Global Consensus) | ✅ High (SHA-256 Hash Chaining) |
| Non-Repudiation | ❌ Weak (Session/RBAC based) | ✅ Wallet-based signatures | ✅ RSA-PSS 2048-bit Signatures |
| Transaction Cost | ✅ Free | ❌ Expensive (Gas fees per write) | ✅ Zero Cost (Gas-Free) |
| Air-Gapped Operation | ✅ Yes | ❌ Impossible (Requires Internet) | ✅ 100% Offline / Air-Gapped Ready |
| Verification Speed | ✅ Instant |
||
| Key Custody Model | ❌ Centralized passwords/tokens | ✅ Local Cryptographic Key Custody |
┌───────────────────────────┐
│ Threat / IOC Detected │
└─────────────┬─────────────┘
│
▼
┌───────────────────────────┐
│ Authorized Threat Analyst│
│ (Holds RSA Private Key) │
└─────────────┬─────────────┘
│
▼
┌───────────────────────────┐
│ Construct Block Payload: │
│ - Event Data (IP, Hash) │
│ - Previous Block Hash │
│ - Timestamp & Index │
└─────────────┬─────────────┘
│
▼
┌───────────────────────────┐
│ Deterministic Canonical │
│ JSON Serializer (Sorted) │
└─────────────┬─────────────┘
│
▼
┌───────────────────────────┐
│ SHA-256 Hash Engine │
│ Hash = SHA256(Block) │
└─────────────┬─────────────┘
│
▼
┌───────────────────────────┐
│ RSA-PSS Digital Signer │
│ Sig = RSA_Sign(PrivKey, H)│
└─────────────┬─────────────┘
│
▼
┌───────────────────────────┐
│ Commit to Immutable Chain │
│ (nullblock_chain.json / │
│ Browser LocalStorage) │
└─────────────┬─────────────┘
│
▼
┌───────────────────────────┐
│ Forensic Validator Engine│
│ - Recomputes Hashes │
│ - Verifies Linkages │
│ - Validates Signatures │
└───────────────────────────┘
- Cryptographic Immutability: Each block stores the SHA-256 hash of the block before it. Modifying any historical block creates an immediate cascade failure in all subsequent block linkages.
- Non-Repudiation: Non-repudiation is the assurance that the author of a statement or record cannot successfully challenge the authenticity of their authorship. RSA-PSS digital signatures ensure only the holder of the corresponding private key could have created the entry.
-
Forensic Chain of Custody: Critical for digital forensics and cyber-crime investigations. Proves exactly who logged the evidence and that it remained unmodified since timestamp
$T$ . - Zero-Trust Local Key Custody: Private keys never leave the analyst's local custody (stored in secure local files or downloaded from browser memory).
Answer: "A standard logging script writes append-only text to a file. An attacker who gains access can open the file and modify a historical line without detection. NullBlock is a blockchain because each block contains
previous_hashforming a cryptographic hash chain. Any historical modification changes that block's hash, causing a mismatch with the next block'sprevious_hashpointer, instantly breaking the chain during mathematical validation."
Answer: "NullBlock uses RSA-PSS (Probabilistic Signature Scheme) with SHA-256. Unlike legacy PKCS#1 v1.5 (which is deterministic and susceptible to padding oracle attacks), RSA-PSS incorporates a random salt via Mask Generation Function 1 (MGF1), making it provably secure in the Random Oracle Model and compliant with modern NIST standards."
Answer: "Proof-of-Work is designed for trustless public networks with Byzantine actors competing for currency incentives, which introduces massive compute overhead and latency. In an enterprise Threat Intelligence consortium or internal SOC, the threat model is audit integrity and non-repudiation rather than open sybil resistance. Identity-based authorization via asymmetric digital signatures provides absolute accountability without energy waste or latency."
Answer: "When an analyst registers, a 2048-bit RSA keypair is generated. The public key is serialized to binary SubjectPublicKeyInfo (SPKI) format and hashed with SHA-256 to create an analyst fingerprint (
SHA256:...). When a block is logged, the signature is verified specifically against the public key matching that fingerprint, ensuring strict identity verification."
Answer: "The validation algorithm runs in $O(N)$ linear time, where $N$ is the number of blocks. It performs two SHA-256 calculations and one RSA-PSS signature verification per block, making full audit scans nearly instantaneous even for large chains."
- MITRE ATT&CK & STIX/TAXII: NullBlock logs standard Indicators of Compromise (IOCs) such as malicious IPs, attack types, and malware file hashes.
- SIEM Integrity Layers: NullBlock can serve as an immutable audit sidecar for SIEM platforms (Splunk, Elastic, Microsoft Sentinel) to secure critical audit trails against insider threat tampering.