Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

MobileCoin: A New Cryptocurrency from Moxie Marlinspike

wired.com

Post reply on HN
Print view View original

241–250 of 258 posts

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#241

Post by betterunix2 »

ajennings wrote: post #8

Wow. MM is really going all-in on for Software Guard Extensions (secure enclave) on the server. What does HN say? Do we trust Intel (motivation and implementation) that much?

I am pessimistic about SGX. It's basically a DRM system that was dressed up to look like something else. Even if one trusts Intel, the entire security model hinges on Intel's ability to detect a compromised key and revoke it; that makes plenty of sense for DRM, where compromised keys are typically announced on forums etc., but why would a service operator or government agency tell anyone?

Moxie has good ideas, but SGX is a trap and he fell into it.

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#242

Post by betterunix2 »

orblivion wrote: post #223
wmf wrote: post #130

Earlier quoted context omitted.

The nodes can prove that they are running the correct software using SGX.

I'm not sure what this means. Supposing I'm a node that runs the correct software as well as some incorrect software. I prove (however this works) using SGX that I'm running the correct software. You send me the data and I run it through the incorrect software. I imagine my ignorance of SGX has something to do with this. Is there a 101 link somewhere?

One approach: use attestation to prove that a public key was created inside an SGX "enclave". Encrypt the inputs using the public key, and now only the enclave can decrypt and use the inputs.

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#243

Post by baybal2 »

Stupidly bad design - storing other people's private keys in a protected memory region. This is as good as entrusting a safe with your money to a thief, thinking that the guy will be unable to open it.

Marlinspike, yet again, flops face down with his credibility as a crypto researcher.

Remember his his angry letter about silent key renegotiation hole in Facebook messenger

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#244

Post by elago »

Asdfbla wrote: post #208
subway wrote: post #161

Earlier quoted context omitted.

Moxie has made it pretty clear through the way Signal operates than Moxie's worldview is one where our feudal lords know better than mere serfs can ever hope to. I'm not at all surprised that yet again trust roots are taken out of the hands of end users.

Seems unnecessarily adversarial of you. I think Moxie has justified his standpoint relatively convincingly, even if you may not agree with it. And to some degree, the success of Signal, or Signal's protocol as implemented widely used services in WhatsApp, supports his approach. If cypherpunk-purists had their way, encryption would still only be a thing exclusively used by a slim minority of nerds who are capable of m…

What success of Signal? I use To in Android for texting but only a small percentage of my contacts are even using it.

However I'm not really convinced Signal is all that secure in the Android ecosystem, and I trust Open Whisper Systems even less than bigger tech companies to not fold under pressure.

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#245

Post by peoplewindow »

SmellyGeekBoy wrote: post #213
Cyberdog wrote: post #119

Earlier quoted context omitted.

Oh, please. You and the other replier knew what I meant by "implemented."

"Code written and passing integration tests" seems like a pretty typical definition to me..?

By that definition I've implemented a search engine, several video games and many other projects that never launched.

Lightning Network has not launched, in the sense of, it is not being used by the community it was designed for. And it never will.

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#246

Post by mike_hearn »

cyphunk wrote: post #181
Uptrenda wrote: post #140

I think this is going in the right direction. You take a bunch of tamper-proof hardware devices from different manufacturers and then model attack costs to compromise them as part of a proof-of-stake scheme. Now you can build consensus algorithms on top of them that are highly secure and scalable compared to anything that exists today. I'm not convinced that Stellar consensus here is the right algorithm for doing thi…

You know it was hard enough for PayTV smart card developers to keep transistor level reverse engineers from getting inside their chips, and all that was at stake then was $35 content subscriptions. I can't imagine how putting personal banking inside SGX will fare. Or, I acknowledge I am probably missing something. Am i?

It wasn't that hard and the stakes were much higher than that. Individual subscriptions could be much more, but the entire black market of glitching units was an industry worth many hundreds of millions of dollars.

Ultimately DirecTV was able to kill pay TV hacking by simply introducing a new generation of cards that were better protected, the P4 series iirc. Other pay TV firms invested less and were mostly undermined by just one guy (Tarnovsky) - not exactly an army of reverse engineers.

The weak points in SGX security aren't the electronics themselves. So far all attacks on it are side channel based.

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#247

Post by mike_hearn »

mtgx wrote: post #155
teraflop wrote: post #128

Earlier quoted context omitted.

Oh, it's not quite that bad. You can run SGX code and work with encrypted data, including generating attestation messages. It's just that there's no way to verify those attestation messages yourself; you have to ask Intel to do it. It's also worth noting that SGX can run in two modes. There's "debug mode", which provides absolutely no security because a debugger has complete access to the state of the enclave. And th…

Why the hell would Intel require an NDA to give you the private key? That's shady af.

It's not actually an NDA (I've signed it). You have to agree to not use SGX to make un-debuggable malware.

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#248

Post by mike_hearn »

orblivion wrote: post #223
wmf wrote: post #130

Earlier quoted context omitted.

The nodes can prove that they are running the correct software using SGX.

I'm not sure what this means. Supposing I'm a node that runs the correct software as well as some incorrect software. I prove (however this works) using SGX that I'm running the correct software. You send me the data and I run it through the incorrect software. I imagine my ignorance of SGX has something to do with this. Is there a 101 link somewhere?

As betterunix says, the way you do it is that the signed data structure proving what software you're running can contain a public key, for which the private key exists only in the enclave. So you can then encrypt secrets that are readable only in the enclave.

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#249

Post by mike_hearn »

rjromero wrote: post #120
qznc wrote: post #75

Earlier quoted context omitted.

Essentially, the CPU has a private key. Using the corresponding public key you can send code to the CPU to execute and the CPU prevents even the OS from looking at the decrypted code. You can also check the signature of the CPU against a public Intel key to verify it is indeed an Intel CPU you are sending code to.

Ah I see. I'm seeing that you have 2 128-bit private keys on the enclave, one known to Intel and what that is not. Can you not use the one not known to intel to do your own code signing against another client with ECDH? Why does it seem like they are pushing this "Intel Attestation" service? Wouldn't that cause Intel servers to be a single POF incase they aren't around to give a proper reply for the attestation reque…

IAS isn't technically a requirement of SGX. But if you want the ability to revoke hardware that is found to be compromised, someone needs to have that list and check against it.

I believe the plan is for IAS to be optional in future. It might already be, but then you have to implement the signature checking logic yourself. EPID is quite a complex signature scheme and you'd also need to find out from Intel which microcode/platform versions are revoked, etc. So IAS is more of a convenience than anything else.

Re: MobileCoin: A New Cryptocurrency from Moxie Marlinspike

#250

Post by philipwhiuk »

dustdrops wrote: post #77

The title here says "A new Cryptocurrency from Moxie Marlinspike." But the article describes his involvement as "Marlinspike has been working on as a technical advisor." Those two descriptions sound different.

The cryptographer is an advisor and there's no mention of any financial experience / economics experience.

I assume this is another early adopter, mining platform....

Nobody's decided to solve that rather fatal flaw.

Post reply on HN