Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Join us in building a kind, collaborative learning community via our updated Code of Conduct.

For questions relating to the security of IoTA and how to mitigate these issues or avoid them altogether.

-1
votes
1answer
21 views

What is the absolute minimum cumulative weight that a transaction must have to be considered confirmed by a vendor?

I assume that referencing a Milestone is not sufficient for a vendor (exchange). That is, they must be making sure that both a Milestone is referenced AND that some time or cumulative weight threshold ...
0
votes
0answers
36 views

If the coordinator were to be identified or located, what attacks could be carried out against it?

The coordinator is currently vital to the operation of the Iota network. There are both security (leaking the seed used to generate milestones) and availability (it must be able to issue milestones) ...
1
vote
1answer
66 views

Can the coordinator be found or identified?

The coordinator is currently vital to the operation of the Iota network. There are both security (leaking the seed used to generate milestones) and availability (it must be able to issue milestones) ...
1
vote
1answer
72 views

What could an adversary do with the seed of the coordinator?

The coordinator issues milestones that the Iota network use as a root of trust when validating transactions. These milestones are signed, which in turn means that keys exist for signing the milestones....
1
vote
2answers
32 views

Are inbound/outbound Iota connections encrypted?

If I am running a full node, what can an adversary determine from sniffing the traffic to and from my node, or is it all encrypted?
2
votes
0answers
47 views

How is the secrecy of the Iota seed maintained on IoT devices?

Iota is intended to be deployed on IoT devices. A problem with IoT devices is that they are placed in insecure locations, allowing attackers to gain physical access and perform advance/prolonged ...
0
votes
0answers
94 views

What causes the entire Tangle to be only the Side-Tangle? [on hold]

For several hours right now (more than 10 hours), the entire tangle has been replaced by only the side-tangle. Furthermore, there are currently no value carrying transactions on the tangle at all ...
1
vote
1answer
84 views

When can a transaction be considered irreversable? (without COO)

In an interesting exchange between Come-From-Beyond (CFB) and a Nxt developer, the question is asked: DEV. So when can a transaction be considered irreversable? CFB. Never, look at formula #14 in ...
1
vote
2answers
129 views

As per “The Stability and the Security of the Tangle”, how will IOTA ensure that all honest nodes are continuously using their hashing power?

As per the recently released The Stability and the Security of the Tangle, a 2018 ICUBE - University of Strasbourg "study of the stability and the security of the distributed data structure at the ...
2
votes
3answers
87 views

What happens if we generate a “seed” that already exists?

According to this answer, "our seed is as the combined username and password that grants access to our bank account. If anyone obtains our seed, they can login and access our funds." Despite ...
2
votes
1answer
83 views

How to compute the % of network computing power the attacker hold?

It is known generally that Tangle is susceptible to 34% attack(of total computing power) that gives a 100% successful attack. The example given on page 19 of white paper says that an upper limit to ...
1
vote
1answer
22 views

Can a bundle be 3 transactions for security level 1?

A bundle has 4 transactions: The output; address and amount of IOTA recipient gets. The input; address, and amount of IOTA sender gives, and half of their signature. The other half of the sender's ...
4
votes
1answer
415 views

What prevents someone from using a Precomputed POW Spam Attack against the network?

What prevents someone from using a Precomputed POW Spam Attack against the network? I am going to outline what I coined the Precomputed POW Spam Attack, an evil attack that can be carried out against ...
2
votes
2answers
71 views

How to send a sidekey securely to the subscriber for my channel

Sending the sideKey and channel-id is important for new subscribers to read my stream. How can I securely transmit them over the network? Shouldn´t be the key exchange algorithm also quantum proof?
2
votes
1answer
334 views

IOTA Winternitz Signature Scheme Details

IOTA uses Winternitz one time signature scheme (W-OTS). Page no 45 W-OTS uses one-way function f and cryptographic hash function g. W-OTS selects parameter w > = 2, which is number of bits to be ...
-2
votes
1answer
56 views

Is it really safe? [duplicate]

How likely is it that someone will discover my seed? either by brute force or by trying to generate a new one.
2
votes
0answers
40 views

Security implications of storing seed on Trezor password manager

I'm wondering about using Trezor password manager to store an IOTA seed and whether there are any security implications I should be aware of? Many thanks!
6
votes
1answer
153 views

How is address reuse prevented in the current wallet implementation?

When trying to send to a foreign address, I got the following error recently: How does my wallet know, that this address has already been used for sending? It's quite an old address, so I assume I ...
3
votes
1answer
71 views

Are there any security considerations regarding running full node?

I have been thinking about setting up a dedicated full node to support the Iota network. In this case would be running some variant of Linux on a dedicated server that would at least meet the ...
4
votes
1answer
104 views

On average, what % of my private key is compromised on the first address re-use, and what exponential effect does it have on security?

Each time we use an address, 50% of your private key is revealed at random. When 50% of the private key is revealed, a computer would have to do 2^256 computations to crack it, similar to the SHA-...
3
votes
1answer
84 views

Is this an official source of the IOTA wallet?

https://github.com/iotaledger/wallet/releases/tag/v2.5.7 Is this release from iota I have got v2.5.6 before I download just wanted to make sure this is right wallet and it’s not a scam Thanks
3
votes
1answer
275 views

How to send data payload and funds in a secure/immutable way?

For me, one of the main use cases for IOTA regarding IOT was to be able to send data and funds in an atomic, immutable way. E.g. sending a bundle including parameters, transferred in the ...
5
votes
2answers
485 views

Can one send a zero value transaction from any address to any address?

Since zero value transactions do not require a signature, I assume one can send 0 value tx from any address, even if he does not own the corresponding seed. Is this assumption correct?
4
votes
2answers
240 views

Exchange Winternitz one-time signatures

Are there any Winternitz alternatives out there which on the one hand make quantum computer attacks hard and on the other hand don't mess with the ability to reuse an address? Or are these properties ...
7
votes
1answer
803 views

Why is the normalized hash considered insecure when containing the char 'M'

Looking at the code of the iota.lib.js' bundle creation mechanism, a normalized hash is computed and then checked for inclusion of 13 /* = M */. If one is found, the obsoleteTag is incremented, and ...
2
votes
0answers
91 views

Iota donation address and security [duplicate]

I see more and more content creators publishing an IOTA address for getting donations. How does that relate to the security advice not use an address for more than one transaction?
5
votes
1answer
580 views

How does Curl-P's copy protection feature work?

I've read in a few articles that the Curl-P hashing function was designed with known practical collisions, intended as a "copy protection" feature. I'm still having trouble wrapping my head around ...
2
votes
2answers
217 views

How to get iota out of an address that has already been used twice?

Is it possible to get IOTAs safely out of an address from which two or more transactions were made already? With safely I mean that there is no chance to get hacked if the third or later transaction ...
2
votes
1answer
72 views

crypto documentation for iota?

Is there a documentation about the crypto-primitives and the crypto protocols, that are used by iota and how they are implemented? And if so, where ;-)
5
votes
0answers
185 views

MAM message encryption

According to the documentation message encryption is done in following way Each message is encrypted with a one-time pad that consists of the channel ID and the index of the key used to sign the ...
2
votes
1answer
159 views

Roadmap: How to avoid address reuse with automatic snapshots?

It is well known that an address that was used to send IOTA (i.e. a transaction was signed with that addresses private key) should not be used a second time because security weakens exponentially with ...
6
votes
1answer
728 views

Do I Have to Change My Seed after Multiple Transactions?

Is it recommended to change the seed and transfer the funds after creating a higher, specific amount of Receive addresses and doing multiple (20+), completed transactions (no double-spending of course)...
1
vote
5answers
333 views

Seed generator best and safe? [duplicate]

Which is the best seed generator and is there an official one Thanks
2
votes
1answer
210 views

Mechanism used to Claim at risk addresses

What Mechanism was used to Claim the at risk addresses? (from the September and October events) How Is it possible to move anothers address into an amalgamated foundation address?
6
votes
2answers
304 views

Address re-use and snapshot

If an address was used more than once to spend, as was the case in the September claim, are addresses that were weakened for violating the Winternitz, One Time Signiture architecture of the tangle, ...
1
vote
1answer
94 views

How to restrict access to certain API commands so that only certain clients can call them?

If wallets use the API port and therefore access to certain functions needs to be restricted, how can a script of mine use the full API without those restrictions? For example https://iotasupport.com/...
9
votes
0answers
198 views

How would IOTA handle a spam attack that is NOT attempting to successfully double spend, but merely make the network unusable? [duplicate]

So it seems like all of the security solutions mentioned so far are focused on preventing double spend attacks. But what about attacks that aren't motivated by actually successfully double spending?...
0
votes
1answer
30 views

Is it more secure to use VPN client? [closed]

As I am always afraid of keylogger and viruses "seeing" me tipping in the seed into my wallet I wonder if it may be more secure if I use a VPN tunnel to go into the internet.
5
votes
2answers
80 views

Good practice how to choose ports

I've setup a full node and while doing so was wondering about the following: 1. Would it be safer not to use the same prominent ports as everybody else does (e.g. 14600, 14700, 14265). If instead the ...
4
votes
3answers
253 views

Should full nodes be public?

Since part of the security comes from it being hard to find enough nodes to peer with to influence the selected transactions, should full nodes be mostly hidden? Will a IOTA attack consist of botnets ...
1
vote
1answer
109 views

Could a sensor be hacked to steal the money in its wallet?

If there is a sensor with a wallet and someone steals the sensor. Wouldn't it be easy for him to hack the sensor and find the seed?
7
votes
1answer
109 views

Is it safe to expose the API to the public? [duplicate]

I just got a full node up and running, following the guide on here http://iota.partners/. I have a firewall on, so all ports are blocked except for UDP 14600 and TCP 15600. In my iota.ini file I have ...
1
vote
2answers
67 views

Sending seeds to someone securely

If I want to send a seed to someone. How would you do it securely? Is it maybe even possible through the tangle? For example I have a seed with 50Miota and I want to give it away to a friend who ...
2
votes
2answers
51 views

How can I trust a wallet?

as there will be many IOTA wallets in the future. How do I know which one I can trust. I think it would be easy to implement a code that sends your seed to someone else, right?
1
vote
2answers
100 views

Will a specialized chip make IOTA more secure

There are rumors and hints coming directly from the IOTA team about some specialized chip based on the ternary logic being developed somewhat secretly. Because Curl hash function uses ternary logic ...
4
votes
1answer
269 views

What does it mean that “the tangle is network-bound instead of hash-power-bound like blockchain”?

Can someone explain me in a very simple way what should an attacker do to double spend in IOTA? In the whitepaper I read that a double spend transaction should outweigh the legitimate subtangle. ...
6
votes
1answer
196 views

How are addresses calculated from the seed?

I was wondering how addresses are calculated from the seed. Specifically, I thought it was using the hash of the seed plus a nonce to create the address. But I would appreciate if someone could shed a ...
6
votes
1answer
269 views

Can someone explain very simplified how the Winternitz OTS/Lamport OTS works?

I read the Wiki example, but I am still confused to be honest. Could someone provide a really simple example?
4
votes
2answers
71 views

How much of my security is improved using other levels of security when generating the seed?

I had a hard time answering this question because I do not know how much security levels improve security in quantitative terms. Is this right? e.g. (Hashspace increment) 81 trits => 27^81 ^1 (low ...
1
vote
1answer
36 views

How to copy and paste Seed from passwordmanager to light wallet [duplicate]

To confuse a keylogger I don't copy and paste the whole seed into the light wallet, but only part of it and the next part I write by myself before copy and past the next part and so on. Or I write ...