In Corda, what data is sent to a non-validating notary service?

Question

This question frequently comes up in conversations: When a Corda transaction is sent to a non-validating notary service for finalisation, what can the notary service see and deduce about the world?

Mide

Answer 1

Before sending a transaction to a non-validating notary, it is filtered as follows:

stx.buildFilteredTransaction(Predicate { 
    it is StateRef || it is TimeWindow || it == notaryParty 
})

(see NotaryFlow.kt in the main Corda repo). This means that the non-validating notary will only see:

• Any inputs, in the form of StateRefs
• The time-window, if it exists (since the notary is also the timestamping authority)
• The identity of the transaction's notary

Because the transaction is a Merkle tree (see https://docs.corda.net/_images/merkleTree.png), although the remaining components have been removed and can't be seen by the notary, the contents of the transaction can't be changed later once the notary signature has been applied.

Attrahent

Hi @joel, Appreciate the insights :) Do you know what information can be reversed engineered from a StateRef and what additional information an attacker would need to be successful in doing so? Thanks! – Whoredom

@RichardLogwood That's an interesting question. Can you raise it as a separate question and I'll give an answer? – Attrahent