Hot answers tagged

12

Kerl uses SHA-3 Keccak at its core, which is a binary hashing algorithm. This means that the trinary 'trits' which IOTA normally operates on are converted to bits before being absorbed by Keccak, whose output is converted back from bits to trits after being squeezed out. This extra radix conversion step is clearly suboptimal in terms of performance, so IOTA'...


8

There was a bug in the wallet software related to absence of https://github.com/Come-from-Beyond/ISS/commit/de1a279450558848a81858fd57b023719eb9a0d3. "M" should be avoided to prevent leakage of the corresponding (and following) private key fragments.


7

When you apply naïve Winternitz signature scheme on a (non-normalized) hash, the amount of private key data you leak is not uniform - a hash of e. g. 999⋯9 would result in all (or none, depending on how you implement it) of the key being leaked. As a consequence, even after one signature there is a varying chance that brute forcing another hash (that leaks ...


6

The POW in IOTA protocol isn't better or worse than the POW in Bitcoin. It is different in it's purpose. If you re-read the docs carefully you will see that the docs don't claims that the POW in IOTA is better than the POW in Bitcoin. It just says that the POW in Bitcoin is very expensive, while the POW in IOTA is relatively cheap. From the doc : IOTA ...


5

In one byte: you can encode up to 2 8 values (i.e. 256 values). When a transaction hash is encoded in a byte[243] , only 3 values within the 256 possibilities are effectively used in each byte. This representation encodes one trit per byte. When a transaction hash is encoded in a byte[49] : 243 values within the 256 possibilities are used in each byte. ...


4

Winternitz signature scheme requires to have the checksum for the signature to be secure. Bundle normalization is an alternative way of keeping the signature secure while reducing its "strength" a little. Usage of the checksum was impossible because the final structure of the transactions wasn't supposed to contain it. In the final design the normalization ...


3

Strictly speaking : branch and trunk transaction can be the same. Let's think about transaction validating the genesis: there was only only one transaction on the tangle... so impossible to pick 2 distinct tips. (same reflection is also valid for a tangle with very low load: in this situation, there is almost always no more than one single tip on the tangle.....


2

Curl-P is not use for signing transaction, therefore collisions in Curl-P is not relevant. For question 1: Eve can try to do it, but the probability to achieve this in reasonable time is extremely low. For question 2: Any bit change in signed data (the amount, the address,...) completely change the signature. It is not easier to brut-force an almost ...


2

I assume that the empty array is a typo here, as the following code will always assume that hashes contains at least one element (either an empty string or a previous transaction hash). On the other hand it probably does not matter since both undefined and empty string are falsey in JavaScript. The idea of the hashes variable is that you cache here the hash ...


2

It should be impossible. To successfully accomplish the POW, you must find a nonce (i.e. a random number) to append to the transaction data so that the hash of the whole data (transaction data + nonce) ends with at least N zero trits (the hash in trytes will end with '9' tryte) (N=14 on main net). The hash function is designed in such a way that it is a ...


1

First of all, the IoT is the absolute dream come true for eavesdropping and a complete loss of a person's privacy and anonymity. Fine dining anyone? An open ecosystem which IOTA offers makes it a lot harder to pull something like this off, if only it's a big improvement over proprietary closed source IoT where things can be hidden. All IOTA software is ...


1

I don't know what's the probability for this to occurs, but I guess that this something that some users try to produce since the early stages of the tangle, and AFAIK was never detected. Anyway, let's imagine that such collision and synchronous propagation occurs... I think that a distinction should be made between 2 different situations. JOE's ...


1

81 trits => 3^81 ~ 4.43×10^38 combinations 162 trits => 3^162 ~ 1.96×10^77 combinations 243 trits => 3^243 ~ 8.72×10^115 combinations Normally security level 1 would be enough (average of about 2.2×10^38 combinations to forge a signature). The difference comes when you reuse the key (which you should not do). Then security level 2 is a lot safer than 1 (...


Only top voted, non community-wiki answers of a minimum length are eligible