# Survey of Blockchain-Based Applications for IoT
## 5 Data Protection and Privacy  
### Cryptography  
In cryptography and cybersecurity, encryption, key exchange, and trust are foundational elements crucial for safeguarding data confidentiality, which, together with integrity and availability, comprise the three critical pillars of cybersecurity (CIA). The standard model for establishing trust on the Internet is the PKI, which uses a \"chain of trust\" approach. This chain links certificates and digital signatures in a structured, hierarchical manner, beginning with a trusted root authority and extending to end-entity certificates. The PKI relies on asymmetric encryption: data are encrypted with a public key, which is publicly available, while only the corresponding private key, kept secure, can decrypt them. Figure 6 below shows the concept of public and private keys. In the first step, Node-A intends to send data to Node-B. Both nodes are part of the blockchain ecosystem and possess a pair of cryptographic keys: a public key (available to all nodes) and a private key (securely stored in the node that owns it). In the second step, Node-A encrypts the data using Node-B's public key, which is openly available to everyone on the blockchain network. The encrypted data are then sent to the blockchain network, ensuring  
Figure 5: Sample DID and DID document. that even if intercepted, the information remains secure and unreadable. In the final step, when Node-B receives the data, only Node-B can decrypt the data using its private key, which is securely stored and not shared. This process ensures that even though the data are transmitted through a public blockchain, only the intended recipient can access and read it, thereby maintaining confidentiality and data integrity. Public and private key pairs can be used in digital signatures, providing authentication, integrity, and non-repudiation in secure communications. Digital signatures operate by having the private key sign a message, while the public key verifies the signature. This process ensures that the message comes from a trusted source and has not been tampered with. The process of digital signature is described in Figure 7 below. The steps are:  
* Node-A generates a hash of the message;
* It then encrypts the hash using its private key, creating a digital signature;
* The message and the digital signature are sent through the blockchain network to Node-B;
* Node-B receives the signed message from the blockchain network;
* It recomputes the hash from the received message;
* Then, it decrypts the digital signature using Node-A's public key, obtaining the original hash;
* If both hashes match, it confirms the message is authentic and untampered. Figure 6: PKI public and private keys. While the RSA cryptographic algorithm is a common choice on the Internet, its large key sizes make it computationally expensive. More efficient alternatives like ECDSA and EdDSA, based on elliptic curve cryptography (ECC), offer faster processing and reduced key sizes, making them ideal for blockchain transactions, IoT authentication, and secure messaging. Table 4 below compares these three algorithms and their applicability to IoT devices. Although effective, the PKI is inherently centralized, so blockchain systems needed to establish an equivalent model for cryptography and trust that leverages decentralization. To avoid the reliance on a central root certificate authority to establish trust between nodes in the blockchain, DIDs are widely used in blockchains for secure, self-sovereign IoT device identification. Multiple frameworks and services were developed to provide a decentralized alternative to the PKI [34], which is consistent with the decentralized nature of the blockchain. To overcome the resource limitations of IoT devices, various approaches tackle issues with certificate registration and key sizes. A fog layer is a practical solution that shifts computational tasks from IoT devices, reducing their processing load. This architecture