Connect with us

Analysis

IOTA Update: The Tangled Web of Home-Rolled Cryptography

Published

on

Time for a disclosure: this author is not an application to monitor the behavior of the ICOs post-analysis. Sometimes, by the time of publication, things are already shifting, and updates are necessary. In IOTA, there was a rush to publishing because we did not want readers to miss out on the obvious hype bubble. We feel that plenty of such readers were able to extract profit at the top there, but this doesn’t prevent us from checking in on IOTA.

We find that a few days ago, a major security vulnerability was discovered in IOTA, and that trading was suspended at Bitfinex for at least a day. We find two separate blog posts from IOTA on the matter, we’ll call these Exhibit A and Exhibit B.

In Exhibit A, IOTA cursorily alludes to the security vulnerability:

One of the cryptographers we reached out to months ago to review Curl has disclosed that he is worried there might be a potential vulnerability in Curl. We have since had our internal team, as well as other cryptographers review it and asked the disclosing party for more information. While the party that did the responsible disclosure has been quite forthcoming, there are still some of the last details to be discussed more thoroughly with the respective teams in order to reproduce the claims and verify if there was even any vulnerability.

We reached out to the researchers (associated with a security lab at MIT) who discovered the vulnerability. We spoke with Ethan Heilman from Boston’s Commonwealth Crypto, who works with Neha Narula, Tadge Dryja, Madars Virza, the other researchers. The author first reached out to Narula, but she was on vacation was traveling for work, deferring to Heilman. Heilman’s first reply to our inquiry was illuminating, and led to more questions, especially as we had just discovered Exhibit B as well. The first piece of IOTA’s response that he addressed was the following passage:

“Don’t roll your own crypto” is a compulsory uttered mantra that serves as a good guiding principle for 99.9% of projects, but there are exceptions to the rule. When spearheading technology for a new paradigm this statement is no longer axiomatic.

To this, Heilman said that if a new cryptographic hashing function is necessary, then there is a process for that and it should have been followed. “I’ve found no record of any such paper for IOTA’s Curl, we had to read the IOTA source code to understand how the algorithm functioned. For instance as part of my work on MD6 I spent two years designing a proof of differential resistance for MD6 which I then published at a peer reviewed conference. The burden of proof rests on the designer of a new cryptographic algorithm,” he wrote.

Heilman also tipped the author off to another primary source, a post on Reddit which quotes the author of IOTA’s Curl function –Sergey Ivancheglo who goes by the name of Come-from-Beyond – as saying that the vulnerability that Heilman and friends were able to exploit was actually a feature intended to copy-protect the source code of the project.

This is extraordinarily unusual among cryptocurrency projects or open source projects in general. Transparency in the code does not lead to less opacity in the ledger; open source is not only safer in argument, it’s safer in practice. Had this code been previously published, for instance, despite its design intent, the bug could have been caught. According to Heilman, it’s unlikely that this code was looked at by the alleged legion of cryptographers “over the years.”

I look forward to IOTA providing a list of cryptographers who reviewed Curl, until that point I have no way of knowing who IOTA did or didn’t speak with. What I will say is that the vulnerability we found was fairly simple and I believe many people with a cryptanalytic background would have discovered it after visually inspecting the Curl source code. Differential cryptanalysis, which is what we used to break Curl, is the first thing you check when attacking a cryptographic hash function.

Bruce Schneier, globally recognized security pundit, brilliant cryptographer, and one of the core contributors to the Skein hashing function (which has passed peer review and is currently in practice in more than one cryptocurrency) commented on the research saying:

In 2017, leaving your crypto algorithm vulnerable to differential cryptanalysis is a rookie mistake. It says that no one of any calibre analyzed their system, and that the odds that their fix makes the system secure is low.

In Exhibit B, IOTA were a little more forthcoming about what all went down, but still couldn’t help themselves: they had to spin it.

As part of an on-going conversation between the IOTA Team and security researchers from Boston University and MIT DCI, the teams published their report on a vulnerability in Curl today. […] We have since formed stronger partnerships with several large academic institutions around the world, and will continue to do so. As for Curl, the IOTA Foundation has already subcontracted a team of 5 world-class cryptographers, as well as 3 independent ones to come up with a final design of Curl and then start the long peer-reviewed process, as was always the plan. No change.

Most of this sounds good, and positive. This post also works to downplay the seriousness of the steps that were skipped in the process of developing the IOTA alpha. There are several arguments you can make in their defense, but in the end, doesn’t it begin to feel like IOTA were just afraid their grand idea wouldn’t fund in another, less frenetical ICO investor setting?

Regardless, there’s more to it. There is this post which emerges from the IOTA community. In it, we learn that Come-from-Beyond has made a statement on the matter:

IOTA team has already responded to the paper published by Neha Narula.
It was me who created Curl and IOTA signature scheme in those old days when there was no IOTA Foundation.
[…] […] In 2013 I created the first full Proof-of-Stake currency and protected it with my novel techniques against cloning.
Those who knew me as BCNext were sure that I would do the same trick to protect IOTA, some people even approached me asking about that.
Remembering how quickly Nxt protection was disarmed I was keeping in secret the fact of existence of such mechnism in IOTA.
I was pretty sure that the protection would last long time because it was hidden inside cryptographical part and programming skills would be insufficient to disarm the mechanism.
[…]

Sergey Ivancheglo aka Come-from-Beyond

To this, Heilman responded:

Is IOTA saying they backdoored their own cryptocurrency? How does that relate to David Sønstebø earlier statements?

It would seem there remains more to the story, but we’re here to talk about the impact on the market.

Updated Disposition

All of these things being noted, we can’t leave IOTA in such high standing by comparison to her peers who are blameless of these sorts of hubris-induced mistakes. For whatever IOTA wants to say in their press releases, they were given a serious pass by the entire industry in getting listed at Bitfinex in the first place. The machinations there, allowing unreviewed cryptographric code on a multi-billion dollar exchange, are interesting. Economic impact was had by their entire investment community, in a negative way: trading was halted for at least one day because of something the firm did. This disposition would be reading differently if things had not turned upward following resumption of trading.

Nonetheless, after trading did resume, it appears the market was okay with their response, while this author clearly isn’t, and while established cryptographers are clearly calling warning signs on this project, and the market rewarded the token with a moderate rise:

 

 

Thus, our actual point revision has to be less. It looks like they might get through this, but there are serious issues raised during this episode, some of which the author is keeping under his collar for the moment, which make us weary of the future for IOTA.

Luckily for everyone involved, IOTA have a vault of cash to throw at these problems. It seems they might even know where it should be thrown. As such, we’re deducting 99% of one point from IOTA, since we believe their response and intent was worth about 1% of the market reward that followed it. We still believe this technology has legs, but like with Enigma, at this point, they’re vulnerable to a far more competent team coming along and doing the job independently of them. More to the point, those copy protections aren’t going to slow down a firm if they see the opportunity and the gains that IOTA had just through being the big first-mover on sponge-type cryptocurrency. This leaves their updated rating at a 6.01, still probably plenty to be made in speculating here. 

Important: Never invest (trade with) money you can't afford to comfortably lose. Always do your own research and due diligence before placing a trade. Read our Terms & Conditions here. Trade recommendations and analysis are written by our analysts which might have different opinions. Read my 6 Golden Steps to Financial Freedom here. Best regards, Jonas Borchgrevink.

Rate this post:

Important for improving the service. Please add a comment in the comment field below explaining what you rated and why you gave it that rate. Failed Trade Recommendations should not be rated as that is considered a failure either way.
0 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 5 (0 votes, average: 0.00 out of 5)
You need to be a registered member to rate this.
Loading...

5 stars on average, based on 2 rated postsP. H. Madore has covered the cryptocurrency beat over the course of hundreds of articles for Hacked's sister site, CryptoCoinsNews, as well as some of her competitors. He is a major contributing developer to the Woodcoin project, and has made technical contributions on a number of other cryptocurrency projects. In spare time, he recently began a more personalized, weekly newsletter at http://ico.phm.link




Feedback or Requests?

2 Comments

2 Comments

  1. jmcc

    September 10, 2017 at 10:22 pm

    Well-balanced analysis of speculative outlook in this situation. The bitcoin hack in 2010 is a good reminder that all code has bugs. Perhaps most troubling may be the personalities running IOTA, as alluded to.

  2. yillinchen

    September 11, 2017 at 10:27 am

    This is a very balanced analysis, Thank you.
    Too bad it came out few hours before the full response from Come-from-Beyond came out on the same day, it would be extremely useful to know what the author things about it.
    Especially this sensed competition that is perceived between already established blockchain projects, and what it means for the market goin forward.
    :

    http://ist3-1.filesor.com/pimpandhost.com/1/3/7/4/137440/3/U/i/x/3Uixh/Feet_worship_day_part%201_giftrailerFHD.gif

You must be logged in to post a comment Login

Leave a Reply

Altcoins

XRP Price Analysis: Explosive Breakout from Pennant Confirmed; SBI Holdings CEO Bullish on XRP

Published

on

  • XRP/USD is enjoying three consecutive sessions of gains, having jumped around 17%.
  • SBI Holdings CEO believes XRP market capitalization will be higher than bitcoin’s.

Ripple’s XRP price has been enjoying a decent move to the north over the past few sessions, as life flows back into the bulls. XRP/USD is currently running at a third consecutive session in the green, having gained around 17% within this period. The explosion of buying pressure came after the price managed to escape a bullish pennant pattern.

XRP/USD: Price Recap

XRP/USD had initially been cooling since the big bull run at the back end of 2018. The price rallied on 24th December up to a high of around $0.4670, before quickly losing upside momentum. It was then forced to trade within the confinements of a descending wedge pattern. XRP lost over 30% in value before it was able to break out from the wedge.

On 8th February a chunky push higher from the bulls was observed, resulting in a breach of the upper acting trend line. XRP/USD jumped around 10% on this day but then eased south to retest the trend line for a few sessions. During the cooling period, price action has formed a pennant structure which saw an eventual big breakout to the upside, as described earlier.

SBI Holdings CEO Bullish on XRP

The SBI Holdings CEO, Yoshitaka Kitao, was recently speaking on XRP and said this year is a significant one for the so-called banker’s cryptocurrency. He believes that the market capitalization of XRP is likely to dwarf bitcoin’s at some point in the future. Kitao has firm belief in the future sucess of XRP and can see it being adopted on a global scale. He was quoted saying:

“Because XRP is already beginning to become international, xRapid will be used for fund transfers in 2019. By increasing the so-called XRP’s plastic use, we anticipate that the XRP market capitalization will easily exceed the market capitalization of bitcoin.”

SBI has many joint ventures set up with Ripple across the blockchain industry; it’s therefore not too surprising to see such comments. The organization will also be launching its very own cryptocurrency exchange called VCTRADE, scheduled for March. Deposits and withdrawals for bitcoin, XRP, and Ethereum (ETH) are already available on the platform.

Technical Review – XRP/USD

XRP/USD daily chart.

Given current upside, eyes must now be on the next likely barriers of resistance for the bulls. A supply area noted from $0.3450 up to $0.3600 is the next target; XRP has not traded comfortably above this region since 10th January. A break above this zone should put the bulls in an excellent position to retest the $0.4000 area. On several occasions, this price territory has caused issues for the bulls in their attempts to push further north. In terms of support, this is seen back down at the psychological $0.3000 mark. If that fails to hold, then there is a demand which runs from $0.3000 down to $0.2500.

Disclaimer: The author owns Bitcoin, Ethereum and other cryptocurrencies. He holds investment positions in the coins, but does not engage in short-term or day-trading.

Featured image courtesy of Shutterstock.

Important: Never invest (trade with) money you can't afford to comfortably lose. Always do your own research and due diligence before placing a trade. Read our Terms & Conditions here. Trade recommendations and analysis are written by our analysts which might have different opinions. Read my 6 Golden Steps to Financial Freedom here. Best regards, Jonas Borchgrevink.

Rate this post:

Important for improving the service. Please add a comment in the comment field below explaining what you rated and why you gave it that rate. Failed Trade Recommendations should not be rated as that is considered a failure either way.
1 vote, average: 5.00 out of 51 vote, average: 5.00 out of 51 vote, average: 5.00 out of 51 vote, average: 5.00 out of 51 vote, average: 5.00 out of 5 (1 votes, average: 5.00 out of 5)
You need to be a registered member to rate this.
Loading...

4.6 stars on average, based on 124 rated postsKen has over 8 years exposure to the financial markets. During a large part of his career, he worked as an analyst, covering a variety of asset classes; forex, fixed income, commodities, equities and cryptocurrencies. Ken has gone on to become a regular contributor across several large news and analysis outlets.




Feedback or Requests?

Continue Reading

Analysis

3 Things You Need to Know About the Market Today: New High in Gold, Dow 26,000?, Euro Weakness

Published

on

1, Gold Jumps to 9-Month High, $1360 in Sight

Gold Futures, 4-Hour Chart Analysis

We have been following the resurrection of gold in the past few months, and since fundamentals just got better for the precious metal, the current technical strength is great news for long-term investors. Today, gold quietly reached a new 9-month high, despite the still ongoing risk rally and the relative strength of the US Dollar.

The metal topped the $1330 level, and with the next major resistance level being found near $1360, a quick surge to the vicinity is in the cards in the coming days. We continue to advise holding gold for the long run, and for now, the short-term technicals also remain bullish. Should the risk rally finally roll over, the uptrend could even accelerate, with longer-term targets being found near $1400 and $1550.

2, US Stocks Drift Lower After Long Weekend as Trade Talks Resume

Dow 30 Futures, 4-Hour Chart Analysis

US stocks are having a quiet start for the day, with the major indices drifting slightly lower following the long weekend. The US economic calendar is empty today, and all eyes will be on the trade talks with China which are set to resume today in Washington in the wake of the unexpected extension of last week’s round of negotiations in Beijing.

The Dow, which approached the 26,000 level last week during the Friday surge to new 9-week highs, is lower today, in-line with the market-wide trends. The mega-cap index could get a lift in early trading thanks to the better-than-expected quarterly report by Walmart (WMT). The firm’s holiday-quarter sales topped estimates, despite the reports regarding the widening growth-gap between online and brick-and-mortar stores, and in light of the positive guidance by the company, the pre-market surge in the stock is no surprise.

With the week’s main economic releases coming in the second half of the period, today we could be in for another choppy session on Wall Street. That said, the momentum of the recovery-rally continues to be suspicious, and especially given the weakness in the Nasdaq, investors should pay close attention to the Volatility Index (VIX), market internals and other under-the-hood indicators for signs of negative divergences.

3, Euro Under Pressure Again, Despite Sentiment Beat

EUR/USD, 4-Hour Chart Analysis

While the Dollar’s break-out to new multi-year highs still didn’t happen last week, technicals continue to agree that the long-term uptrend in the reserve currency will continue. The Euro, on the other hand, is still showing signs of broad weaknes, drifing lower against the Dollar and the Pound today, despite the better-than-expected German Zew Economic Sentiment report.

The indicator is still deep in negative territory, and together with the recent weakness in the Eurozone PMIs and industrial production, recessionary fears seem to be legit in Europe.

We will have a new batch of PMIs coming out tomorrow, and together with the Fed minutes a huge day could be ahead for forex markets and especially for the EUR/USD pair. The 1.12 level could be tested in the case of another negative surprise in the PMIs, while the Fed minutes will be under scrutiny even more than usual following the sharp dovish shift by the Central Bank.

ChartBook

Major Stock Indices

S&P 500 Futures, 4-Hour Chart Analysis

Nasdaq 100 Futures, 4-Hour Chart Analysis

VIX (US Volatility Index), 4-Hour Chart Analysis

DAX 30 Index CFD, 4-Hour Chart Analysis

FTSE 100 Index CFD, 4-Hour Chart Analysis

EuroStoxx50 Index CFD, 4-Hour Chart Analysis

Nikkei 225 Futures, 4-Hour Chart Analysis

Shanghai Composite Index CFD, 4-Hour Chart Analysis

EEM (Emerging Markets ETF), 4-Hour Chart Analysis

Forex

USD/JPY, 4-Hour Chart Analysis

GBP/USD, 4-Hour Chart Analysis

EUR/GBP, 4-Hour Chart Analysis

AUD/USD, 4-Hour Chart Analysis

Commodities

WTI Crude Oil, 4-Hour Chart Analysis

Copper Futures, 4-Hour Chart Analysis

Featured image from Shutterstock

Important: Never invest (trade with) money you can't afford to comfortably lose. Always do your own research and due diligence before placing a trade. Read our Terms & Conditions here. Trade recommendations and analysis are written by our analysts which might have different opinions. Read my 6 Golden Steps to Financial Freedom here. Best regards, Jonas Borchgrevink.

Rate this post:

Important for improving the service. Please add a comment in the comment field below explaining what you rated and why you gave it that rate. Failed Trade Recommendations should not be rated as that is considered a failure either way.
0 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 5 (0 votes, average: 0.00 out of 5)
You need to be a registered member to rate this.
Loading...

4.7 stars on average, based on 466 rated postsTrader and financial analyst, with 10 years of experience in the field. An expert in technical analysis and risk management, but also an avid practitioner of value investment and passive strategies, with a passion towards anything that is connected to the market.




Feedback or Requests?

Continue Reading

Altcoins

IOTA Price Analysis: Bulls on the Loose as IOTA Foundation Announces New Collaboration with Nova to Fund Start-ups

Published

on

  • The IOTA Foundation has entered into a partnership with Nova to provide funded support for start-ups.
  • IOT/USD is currently enjoying a decent push north, following a breakout of a bullish pennant pattern structure.

IOT/USD: Recent Price Behaviour

IOT/USD has been on a decent run of gains over the five sessions, having jumped around 18% at the time of writing. The price has been on a path to the north since 7th February, after hitting a low for 2019 around $0.2400. A chunky amount of buying pressure was observed down at these depressed levels.

The bulls enjoyed an initial jump between 7-8th February, gaining around 18% on the fast two-day rally. IOT/USD then consolidated trading within a range-bound nature to then have formed a bullish pennant pattern formation. On 17th February, an explosive amount of upside came into play following this technical breakout.

IOTA Announces New Collaboration with Nova

The IOTA Foundation has announced a new partnership with Nova, a start-up incubator, according to an official press release from the organization. As part of the collaboration, its goal is to begin funding start-ups employing the platform of IOTA. The program will be called IOTA Cofoundery on Nova’s website; it will be focusing on early stages of development and seed funding.

Start-ups will be able to leverage through the program a mentoring and tech start-up service to consist of over 20 consultants that specialize in technology. There will be much nurturing and guidance as part of this offering. To-date Nova has already co-founded over 80 technology start-ups, with over half of those still being active after three years. It is further noted within the official release that the three-year start-up survival rate is 10%.

Nova will invest in ideas that can prove user problem-fit. IOTA via their grant program will match the investment. It will provide a comforting amount of support and the foundations for viable businesses to develop within the ecosystem of IOTA.

The program will allow entrepreneurial tech start-ups to build new innovative business models by leveraging IOTA technology. Nova has noted that this new offering is now already open for applications and can apply directly on the Nova website.

Technical Review – IOT/USD

IOT/USD daily chart.

Given the noted move north from a bullish pennant pattern structure, the doors to further upside potential have opened. Near-term supply is observed heading into the $0.3400 territory, IOT/USD last traded here in January and dealt a rejection blow. Should the bulls manage to maintain current upside momentum and break above this zone, eyes will then be on the 2019 high area. At the start of the year, the price managed to hit $0.4088 on 2nd January.

In terms of support, this should be noted back down at the broken pennant pattern. A retest just on top could be seen which currently tracks at around $0.2750-40. Failure of this holding could then see the February gains wholly reversed.

Disclaimer: The author owns Bitcoin, Ethereum and other cryptocurrencies. He holds investment positions in the coins, but does not engage in short-term or day-trading.

Featured image courtesy of Shutterstock.

Important: Never invest (trade with) money you can't afford to comfortably lose. Always do your own research and due diligence before placing a trade. Read our Terms & Conditions here. Trade recommendations and analysis are written by our analysts which might have different opinions. Read my 6 Golden Steps to Financial Freedom here. Best regards, Jonas Borchgrevink.

Rate this post:

Important for improving the service. Please add a comment in the comment field below explaining what you rated and why you gave it that rate. Failed Trade Recommendations should not be rated as that is considered a failure either way.
0 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 50 votes, average: 0.00 out of 5 (0 votes, average: 0.00 out of 5)
You need to be a registered member to rate this.
Loading...

4.6 stars on average, based on 124 rated postsKen has over 8 years exposure to the financial markets. During a large part of his career, he worked as an analyst, covering a variety of asset classes; forex, fixed income, commodities, equities and cryptocurrencies. Ken has gone on to become a regular contributor across several large news and analysis outlets.




Feedback or Requests?

Continue Reading

Recent Posts

A part of CCN

Hacked.com is Neutral and Unbiased

Hacked.com and its team members have pledged to reject any form of advertisement or sponsorships from 3rd parties. We will always be neutral and we strive towards a fully unbiased view on all topics. Whenever an author has a conflicting interest, that should be clearly stated in the post itself with a disclaimer. If you suspect that one of our team members are biased, please notify me immediately at jonas.borchgrevink(at)hacked.com.

Trending