The response of sorts from IOTA team,
https://blog.iota.org/curl-disclosure-beyond-the-headline-18...
Cryptographic vulnerabilities in IOTA
11–20 of 73 posts
Re: Cryptographic vulnerabilities in IOTA
#12I even think that the issues with new cryptocurrencies is underestimated in the article. The problem goes beyond the cryptographic aspect to game theoretical challenges: the cryptographic protocols could be perfect and yet the cryptocurrency be insecure or offer a low security threshold. For example, Bitcoin is perfect from the cryptographic perspective but its security threshold is around 33% [1]. Last year we also…
It's not really a vulnerability. Miners don't have an incentive to destroy the currency with a >50% attack, they are heavily invested in it.
Re: Cryptographic vulnerabilities in IOTA
#13I even think that the issues with new cryptocurrencies is underestimated in the article. The problem goes beyond the cryptographic aspect to game theoretical challenges: the cryptographic protocols could be perfect and yet the cryptocurrency be insecure or offer a low security threshold. For example, Bitcoin is perfect from the cryptographic perspective but its security threshold is around 33% [1]. Last year we also…
It's not really a vulnerability. Miners don't have an incentive to destroy the currency with a >50% attack, they are heavily invested in it.
This kind of analysis are vulnerabilities in the consensus sense. You can think of a state actors not caring about the investment done but about the harm they can do.
Re: Cryptographic vulnerabilities in IOTA
#14The thing that I think should really worry you is that the reaction among the professional cryptographers to this (or at least the dozens I talk to on Slack and Twitter) is "well, that's cryptocurrency for you".
If you have the impression that serious cryptographers are knee deep in the problem space of trying to make sure cryptocurrencies are actually secure, revise your expectations.
Re: Cryptographic vulnerabilities in IOTA
#15Earlier quoted context omitted.
It's not really a vulnerability. Miners don't have an incentive to destroy the currency with a >50% attack, they are heavily invested in it.
This kind of analysis are vulnerabilities in the consensus sense. You can think of a state actors not caring about the investment done but about the harm they can do.
Almost any state is capable of spending a few billion dollars and making a >50% attack (assuming they can buy enough ASICs), no matter how good your crypto is. There are much cheaper ways to bring something like Bitcoin to its knees. DDoS the nodes for a year, for instance.
Re: Cryptographic vulnerabilities in IOTA
#16I even think that the issues with new cryptocurrencies is underestimated in the article. The problem goes beyond the cryptographic aspect to game theoretical challenges: the cryptographic protocols could be perfect and yet the cryptocurrency be insecure or offer a low security threshold. For example, Bitcoin is perfect from the cryptographic perspective but its security threshold is around 33% [1]. Last year we also…
It's not really a vulnerability. Miners don't have an incentive to destroy the currency with a >50% attack, they are heavily invested in it.
You're assuming that attackers are always profit-motivated, which would not be true in the case of a government protecting the sovereignty of their national currency, for instance.
Re: Cryptographic vulnerabilities in IOTA
#17Earlier quoted context omitted.
This kind of analysis are vulnerabilities in the consensus sense. You can think of a state actors not caring about the investment done but about the harm they can do.
Almost any state is capable of spending a few billion dollars and making a >50% attack (assuming they can buy enough ASICs), no matter how good your crypto is. There are much cheaper ways to bring something like Bitcoin to its knees. DDoS the nodes for a year, for instance.
So, are you saying that this is not part of the fundamental analysis you should do if you have money at stake? You have made such analysis to argue about the threshold numbers.
Re: Cryptographic vulnerabilities in IOTA
#18The response of sorts from IOTA team, https://blog.iota.org/curl-disclosure-beyond-the-headline-18...
Good old "the vulnerability is purely theoretical". Thank God no individuals on this planet focus on making the theoretical practical, especially not when there is money at stake. That would be unsportsmanlike.
Re: Cryptographic vulnerabilities in IOTA
#19Earlier quoted context omitted.
Almost any state is capable of spending a few billion dollars and making a >50% attack (assuming they can buy enough ASICs), no matter how good your crypto is. There are much cheaper ways to bring something like Bitcoin to its knees. DDoS the nodes for a year, for instance.
So, are you saying that this is not part of the fundamental analysis you should do if you have money at stake? You have made such analysis to argue about the threshold numbers.
Where did I say "this is not part of the fundamental analysis you should do"?
My only point is that >50% attacks by the people involved are purely theoretical. Attacks by almost any state are the end of your project. A billion dollars is enough to DDoS pretty much everything.
Re: Cryptographic vulnerabilities in IOTA
#20The thing that I think should really worry you is that the reaction among the professional cryptographers to this (or at least the dozens I talk to on Slack and Twitter) is "well, that's cryptocurrency for you". If you have the impression that serious cryptographers are knee deep in the problem space of trying to make sure cryptocurrencies are actually secure, revise your expectations.
This curl function actually came up in conversation with someone about a month ago. We figured that there was no way the core transformation was secure, and that was about the extent of our interest in it.