Skip to main content
Iota

Questions tagged [security]

Ask Question

For questions relating to the security of IoTA and how to mitigate these issues or avoid them altogether.

92 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
4 votes
1 answer
144 views

How is a Seed stored in an IOTA wallet? Can I gain my Seed back if I lose it?
Nemoced's user avatar
  • 477
1 vote
2 answers
237 views

Previously, I have had no problem opening Trinity on my Mac and after providing my password, it opened correctly. I updated after the recent closure and again, all was satisfactory. I have not used ...
Roger's user avatar
  • 11
0 votes
1 answer
59 views

I am trying to publish my data on IOTA Tangle using MAM. For this, I have designed a web form where I have to enter my seed and press the publish button. The actual data is fetched from firebase ...
degr8sid's user avatar
  • 91
1 vote
1 answer
34 views

I was going through the iota tangle documentation and features and found one of the feature mentioned as Quantum Immune , so basically looking for resources to understand the quantum immune property ...
Aditya Singh's user avatar
  • 111
1 vote
2 answers
109 views

I am Muhammad, working with my way to use IOTA to fetch data from IDS/IPS. IOTA uses 2 transactions as input if I am not wrong. I want to send data of IDS to IOTA. I am using Grafana and mysql to ...
Muhammad Bilal's user avatar
  • 31
1 vote
1 answer
126 views

Having just come upon IOTA, I am struck by the combination of bold vision and something that looks like a definite no-no. First of all, the IoT is the absolute dream come true for eavesdropping and a ...
user avatar
3 votes
1 answer
81 views

Is storing IOTA in Ledger Nano S completely secure? I am asking because IOTA doesn't use elliptic-curve cryptography. Does storing and using IOTA in Ledger Nano S may make it easier for an attacker ...
Greg Zuber's user avatar
  • 131
1 vote
0 answers
37 views

I am setting up a website where users buy and sell IOTA with USD. I've gotten some general safety tips about keeping your seed secure but I wanted to know what I could do to be safe from hackers, ...
blah's user avatar
  • 11
1 vote
1 answer
68 views

per the white paper In order to identify nodes, it is necessary to introduce global node identities. Tothis end, we envision using common public key cryptography to sign certain dataand to ...
Qim Hortons's user avatar
  • 41
1 vote
1 answer
58 views

I have an open source offline airgapped encrypted device for signing transactions. Seeds are stored on this device. Signed transactions are passed to an online machine as a parade of qr-codes for ...
John Shearing's user avatar
  • 205
2 votes
1 answer
57 views

I have made an open source airgapped device for signing bundles offline. A main purpose is to address the possiblity that the components we use to make our devices are already compromised before ...
John Shearing's user avatar
  • 205
2 votes
1 answer
173 views

The solutions to attacks proposed by IOTA white paper seems unclear, in particular, in case of double-spending, it remains unclear what stops a computationally powerful adversary from conducting a ...
Questioner's user avatar
  • 552
3 votes
0 answers
113 views

Here I am referring to MAM in restricted mode, where side key is used to encrypt the message. One time pad is known for perfect secrecy. Since MAM uses the one-time pad, is MAM encrypted message has ...
Infinity's user avatar
  • 263
2 votes
0 answers
32 views

I am discovering Iota and I am trying to find out if I it can be applied to securely send command between iot device, being 100% sure the command has been received. My concern is about the network, ...
iliès's user avatar
  • 21
3 votes
1 answer
99 views

If I send multiple zero value transactions from address A, containing several messages to broker a deal, is it safe to (re)use that address later on for a payment (to settle the deal)?
mike's user avatar
  • 251
3 votes
1 answer
133 views

According to Come-From-Beyond in the emails send to DCI: The Coordinator is used as an extra protection measure. Particularly, it stores all transactions that reach it, this allows us to recover ...
user avatar
-1 votes
1 answer
48 views

I assume that referencing a Milestone is not sufficient for a vendor (exchange). That is, they must be making sure that both a Milestone is referenced AND that some time or cumulative weight threshold ...
user avatar
0 votes
0 answers
60 views

The coordinator is currently vital to the operation of the Iota network. There are both security (leaking the seed used to generate milestones) and availability (it must be able to issue milestones) ...
Cybergibbons's user avatar
  • 305
2 votes
0 answers
110 views

The coordinator is currently vital to the operation of the Iota network. There are both security (leaking the seed used to generate milestones) and availability (it must be able to issue milestones) ...
Cybergibbons's user avatar
  • 305
1 vote
1 answer
126 views

The coordinator issues milestones that the Iota network use as a root of trust when validating transactions. These milestones are signed, which in turn means that keys exist for signing the milestones....
Cybergibbons's user avatar
  • 305
2 votes
2 answers
50 views

If I am running a full node, what can an adversary determine from sniffing the traffic to and from my node, or is it all encrypted?
Cybergibbons's user avatar
  • 305
2 votes
0 answers
70 views

Iota is intended to be deployed on IoT devices. A problem with IoT devices is that they are placed in insecure locations, allowing attackers to gain physical access and perform advance/prolonged ...
Cybergibbons's user avatar
  • 305
2 votes
1 answer
111 views

In an interesting exchange between Come-From-Beyond (CFB) and a Nxt developer, the question is asked: DEV. So when can a transaction be considered irreversable? CFB. Never, look at formula #14 in ...
user avatar
2 votes
2 answers
284 views

As per the recently released The Stability and the Security of the Tangle, a 2018 ICUBE - University of Strasbourg "study of the stability and the security of the distributed data structure at ...
user avatar
2 votes
3 answers
140 views

According to this answer, "our seed is as the combined username and password that grants access to our bank account. If anyone obtains our seed, they can login and access our funds." Despite ...
Questioner's user avatar
  • 552
2 votes
0 answers
101 views

It is known generally that Tangle is susceptible to 34% attack(of total computing power) that gives a 100% successful attack. The example given on page 19 of white paper says that an upper limit to ...
Casey Yeow's user avatar
  • 150
1 vote
1 answer
56 views

A bundle has 4 transactions: The output; address and amount of IOTA recipient gets. The input; address, and amount of IOTA sender gives, and half of their signature. The other half of the sender's ...
Tsangares's user avatar
  • 809
6 votes
1 answer
534 views

What prevents someone from using a Precomputed POW Spam Attack against the network? A theoretical attack could use pre-made transactions to be released before their network expiry dates. Rounds of ...
user avatar
2 votes
2 answers
190 views

Sending the sideKey and channel-id is important for new subscribers to read my stream. How can I securely transmit them over the network? Shouldn´t be the key exchange algorithm also quantum proof?
Dude's user avatar
  • 121
3 votes
1 answer
1k views

IOTA uses Winternitz one time signature scheme (W-OTS). Page no 45 W-OTS uses one-way function f and cryptographic hash function g. W-OTS selects parameter w > = 2, which is number of bits to be ...
Infinity's user avatar
  • 263
-2 votes
1 answer
67 views

How likely is it that someone will discover my seed? either by brute force or by trying to generate a new one.
Iago Blum's user avatar
  • 9
2 votes
0 answers
55 views

I'm wondering about using Trezor password manager to store an IOTA seed and whether there are any security implications I should be aware of? Many thanks!
iotaevangelist's user avatar
  • 21
8 votes
1 answer
210 views

When trying to send to a foreign address, I got the following error recently: How does my wallet know, that this address has already been used for sending? It's quite an old address, so I assume I don'...
janowitz's user avatar
  • 321
4 votes
1 answer
89 views

I have been thinking about setting up a dedicated full node to support the Iota network. In this case would be running some variant of Linux on a dedicated server that would at least meet the ...
Ronnie's user avatar
  • 143
5 votes
1 answer
129 views

Each time we use an address, 50% of your private key is revealed at random. When 50% of the private key is revealed, a computer would have to do 2^256 computations to crack it, similar to the SHA-...
aboose's user avatar
  • 3,135
4 votes
1 answer
104 views

https://github.com/iotaledger/wallet/releases/tag/v2.5.7 Is this release from iota I have got v2.5.6 before I download just wanted to make sure this is right wallet and it’s not a scam Thanks
Rishab 's user avatar
  • 127
5 votes
1 answer
342 views

For me, one of the main use cases for IOTA regarding IOT was to be able to send data and funds in an atomic, immutable way. E.g. sending a bundle including parameters, transferred in the ...
Akkumulator's user avatar
  • 1,468
7 votes
2 answers
892 views

Since zero value transactions do not require a signature, I assume one can send 0 value tx from any address, even if he does not own the corresponding seed. Is this assumption correct?
Akkumulator's user avatar
  • 1,468
6 votes
2 answers
351 views

Are there any Winternitz alternatives out there which on the one hand make quantum computer attacks hard and on the other hand don't mess with the ability to reuse an address? Or are these properties ...
Jupiter Jones's user avatar
  • 63
10 votes
1 answer
993 views

Looking at the code of the iota.lib.js' bundle creation mechanism, a normalized hash is computed and then checked for inclusion of 13 /* = M */. If one is found, the obsoleteTag is incremented, and ...
Akkumulator's user avatar
  • 1,468
3 votes
0 answers
122 views

I see more and more content creators publishing an IOTA address for getting donations. How does that relate to the security advice not use an address for more than one transaction?
Jan Viehweger's user avatar
  • 131
6 votes
1 answer
855 views

I've read in a few articles that the Curl-P hashing function was designed with known practical collisions, intended as a "copy protection" feature. I'm still having trouble wrapping my head around ...
todofixthis's user avatar
  • 1,320
4 votes
2 answers
673 views

Is it possible to get IOTAs safely out of an address from which two or more transactions were made already? With safely I mean that there is no chance to get hacked if the third or later transaction ...
mio's user avatar
  • 175
3 votes
2 answers
119 views

Is there a documentation about the crypto-primitives and the crypto protocols, that are used by iota and how they are implemented? And if so, where ;-)
Wolfgang Egger's user avatar
  • 415
5 votes
0 answers
250 views

According to the documentation message encryption is done in following way Each message is encrypted with a one-time pad that consists of the channel ID and the index of the key used to sign the ...
Infinity's user avatar
  • 263
3 votes
1 answer
199 views

It is well known that an address that was used to send IOTA (i.e. a transaction was signed with that addresses private key) should not be used a second time because security weakens exponentially with ...
BernB's user avatar
  • 39
7 votes
1 answer
805 views

Is it recommended to change the seed and transfer the funds after creating a higher, specific amount of Receive addresses and doing multiple (20+), completed transactions (no double-spending of course)...
ZiiZou's user avatar
  • 115
2 votes
5 answers
442 views

Which is the best seed generator and is there an official one Thanks
Rishab 's user avatar
  • 127
3 votes
1 answer
224 views

What Mechanism was used to Claim the at risk addresses? (from the September and October events) How Is it possible to move anothers address into an amalgamated foundation address?
KelpieOnPond's user avatar
  • 173
7 votes
2 answers
358 views

If an address was used more than once to spend, as was the case in the September claim, are addresses that were weakened for violating the Winternitz, One Time Signiture architecture of the tangle, ...
KelpieOnPond's user avatar
  • 173

1
2