Blockchain-Enabled Secure Logging for Fiscal Electronic Mechanisms: Evaluation of the Greek eSEND and myDATA Tax Systems
Panagiotis Mavridis, Anargyros Baklezos, Christos Nikolopoulos
cs.CR · cs.AI · econ.EM
Quick verdict
Describes Greek FEM hash chains as tamper-proof vs myDATA's integrity gap; valuable insider detail, but no threat model and SHA-1 risks unexamined.
Summary
This paper provides a descriptive security-architecture analysis of Greece's fiscal control systems. Drawing on the regulatory decisions that define them (several co-authored by the first author), the authors document how Greek Fiscal Electronic Mechanisms — Fiscal ECRs, Fiscal Printers/AFDs, EAFDSS signing machines, and FEMAS devices — build double or triple SHA-1 hash chains over receipts and daily Z reports (files a.txt through d.txt, equations 1–4), anchor progressive VAT and card-payment totals in resin-protected fiscal memory, and transmit AES-256-encrypted Z packages to the IAPR's eSEND system, which enforces sequential Z numbering and verifies the hash chain, rejecting non-conforming data. They contrast this with Electronic Invoicing Providers feeding the myDATA platform, which use HTTPS but no tamper-resistant hardware, no continuous progressive numbering (serial numbers restart each fiscal period), no integrity chain, and non-consecutive MARK acknowledgments, so an issuer can suppress or alter documents before transmission without detection. The paper concludes that hardware fiscalization provides materially stronger completeness and tamper-resistance guarantees than the software-only e-invoicing path. Limitations: the analysis is qualitative throughout, with no threat model and no empirical evaluation; the known collision weakness of SHA-1 is never discussed; the promised improvement proposals are not substantively developed; and no conflict-of-interest statement is given despite the authors' role in authoring the evaluated regulations.
Review complete
Assessment at a glance
6
risk flags identified
● high 0
● medium 3
● low 3
5 strengths · 5 weaknesses · 5 author questions
AI text signal = Binoculars zero-shot detector score over 20 sampled passages (Fast-DetectGPT co-reported) — absence does not prove human authorship, and a flag does not imply misconduct.
Levels reflect verification complexity — not a quality score. Evolve never rates your paper.
Key claims under review
- Greek hardware FEMs (ECRs, AFDs, FEMAS) implement double or triple SHA-1 hash chains (equations 1–4) plus progressive-total chaining in fiscal memory, making any alteration of recorded sales data detectable.
- eSEND's sequential Z-number gating and d.txt chain verification mean no Z package can be missing or tampered with without being rejected (Section IV.A).
- The EIPS→myDATA path lacks tamper-proof hardware, continuous progressive numbering, consecutive MARKs, and any integrity chain, so an issuer can issue invoice 1000 without 999 and delete or modify documents before transmission undetected.
- Hardware-based fiscal mechanisms therefore provide stronger transaction completeness and tamper resistance than software-only e-invoicing infrastructure.
Strengths
Primary-source depth unavailable elsewhere
Documents exact on-device artefacts (a/b/e/s/c/d.txt files), chain equations (1)–(4), the 24-hour Z-blocking timer, and the full Table C/I transmission schema with per-field lengths — sourced from the regulatory decisions the authors helped draft.
Concrete, specific integrity gap in myDATA
Section VI pinpoints that MARKs are unique but non-consecutive and serial numbering restarts each fiscal period, so an auditor cannot detect suppression of invoice 999 before 1000 — a precise, actionable finding.
Full-ecosystem coverage
Candid about a real weakness
Policy relevance
Weaknesses
SHA-1 dependence never analyzed
No threat model or formal argument
Terminology overreach and citation hygiene
No empirical evidence
Asymmetric comparison and undeclared COI
Full Review Report
$1.99 · one-timeUnlock the complete preliminary analysis Evolve produced for this paper.
Report preview
Scope & Claims
This paper (arXiv:2609.04356) is a descriptive security-architecture study of Greece's two fiscal reporting pipelines. Pipeline 1 (Sections II–IV): tamper-resistant Fiscal Electronic Mechanisms — Fiscal ECRs (II.A), Fiscal Printers/AFDs (II.B), EAFDSS signing machines (II.C), FEMAS (II.D), plus mandatory EFTPOS interconnection (III, per A.1098/2022 and amendments) — build double or triple SHA-1 hash chains over receipts and daily Z reports and transmit AES-256-encrypted Z packages to IAPR's eSEND, which gates on sequential Z numbers and verifies the chain. Pipeline 2 (V–VI): Electronic Invoicing Providers forward issuer documents over HTTPS to myDATA. Central claims: (1) hardware fiscalization makes transmitted sales data complete and tamper-evident; (2) myDATA lacks hardware, continuous numbering, consecutive MARKs, and any chain, so issuers can suppress or alter documents undetected; (3) hardware therefore beats software-only infrastructure. The claims are plausible and grounded in primary regulations, but asserted rather than demonstrated.
The remaining sections cover Methodology Assessment, Statistical Evidence, Results & Reproducibility, Limitations & Risks, and Verdict & Recommendations.
- All 5 strengths & 5 weaknesses, analyzed in detail
- 6 risk flags with severity, section & reviewer questions
- Methods & statistical evidence assessment
- 5 questions a peer reviewer would ask
- Full six-dimension evaluation report & recommendations
One-time purchase · this paper only
One-time purchase, this paper only. AI-generated preliminary analysis — not peer review.
Frequently asked questions
What is the difference between Greece's eSEND and myDATA tax systems?
eSEND receives AES-256-encrypted daily 'Z' packages from tamper-resistant fiscal devices (cash registers, fiscal printers, signing machines, FEMAS) and enforces strict sequential numbering plus SHA-1 hash-chain verification, rejecting any gap or mismatch. myDATA receives e-invoices from software-based Electronic Invoicing Providers over HTTPS with unique but non-consecutive MARK acknowledgment numbers and no integrity chain, so missing documents are much harder to detect.
Does Greece actually use blockchain in its fiscal cash registers?
Not in the strict sense. Greek fiscal devices build SHA-1 hash chains where each receipt and each daily Z report references the hash of its predecessor — tamper-evidence similar to a blockchain, but with no distributed blocks or consensus. The paper's use of the word 'blockchain' is loose terminology for these centralized hash chains.
Why is myDATA considered weaker for transaction integrity?
Because invoices are produced on ordinary computers with no tamper-proof hardware, numbering restarts each fiscal period, the system does not require invoice 999 before invoice 1000, and MARK acknowledgment numbers are not consecutive — so a business could suppress or alter documents before transmission without a tax auditor being able to tell.
Is SHA-1 still secure enough for fiscal hash chains?
The paper does not address this, which is the review's main security criticism. SHA-1 collision attacks have been practical since 2017, so integrity schemes relying on plain SHA-1 hashing without digital signatures should be treated as overdue for migration to SHA-256 or stronger primitives.
About this review
This is an AI-generated preliminary review by Evolve.Pub, produced from the openly available text of the paper. It is not peer review and does not represent the authors' views. The canonical record of the paper is at the publisher link above.
- Figures 1–7 are images whose content is not present in the extracted text; visual evidence could not be assessed.
- Equations (1)–(4) are garbled by PDF extraction (e.g., 'ctxt = SHA1 nX i=1 ...'); the readings rely on the surrounding prose descriptions.
- The extracted reference list ends at [26] while Section VI cites [27]; whether [27] exists just beyond the extraction edge cannot be confirmed.
Go deeper on this paper
Wrote a paper? Stress-test it before reviewers do.
Upload your manuscript for the same structured scrutiny — reasoning, statistics, evidence, figures, and reproducibility.