P4man
Legacy Member
P4man zei:
P4man zei:
Cryptographic vulnerabilities in IOTA
...
So when we noticed that the IOTA developers had written their own hash function, it was a huge red flag. It should probably have been a huge red flag for anyone involved with IOTA.
We found that IOTA’s custom hash function Curl is vulnerable to a well-known technique for breaking hash functions called differential cryptanalysis, which we then used to generate practical collisions. We used our technique to produce two payments in IOTA (they call them “bundles”) which are different, but hash to the same value, and thus have the same signature. Using our techniques, a bad actor could have destroyed users’ funds, or possibly, stolen user funds.
...
In 2017, leaving your crypto algorithm vulnerable to differential cryptanalysis is a rookie mistake. It says that no one of any calibre analyzed their system, and that the odds that their fix makes the system secure is low
https://medium.com/@neha/cryptographic-vulnerabilities-in-iota-9a6a9ddc4367
Ik vind het bijna jammer dat het eerlijke cryptografen zijn die deze blunder ontdekte; nu gaat bijna niemand dit lezen of er van wakker liggen. Het zou niet slecht zijn als een altcoin eens echt gehackt wordt en mensen geld verliezen. Misschien dat security of op zijn minst de perceptie ervan, dan weer iets serieuzer genomen zal worden.
