4 ms·

http://stanford.edu/~nadal/A-Decentralized-Data-Synchronization-Protocol.pdf http://stanford.edu/~nadal/A-Decentralized-Data-Synchronizat...

wslh 8y ago
Where are the independent security reviews? Also, I don't see past references where you based your new idea. Please take into account that I am respecting you for your work but this field involves more than a claim. If you look, for example, to simmetric encryption algorithms history, there were a lot of proposals and people involved in trying to crack them. Many of them sounded great but were break by professional cryptographers. The blockchain scene is full of proposals but there are very few security reviews.
- marknadal 8y ago
  Go have anybody you want look at the code, it is open source. My friends like Dominic Tarr (of Secure Scuttlebutt), security teams at MIT (Christian and Dmitri), and others have consulted with me about it. If you are willing to contribute donations to pay a firm, please do!
- marknadal 8y ago
  You edited your post after I replied. We're not writing our own cryptography, lol, we're using existing libraries based around OpenSSL using industry accepted and standardized algorithms and curves (ECDSA 256, AES 256, ECDH 256, PBKDF, etc.) So yes, please email me the moment those get broken/cracked and we'll upgrade to whatever new standards are available.
  - somenewacc 8y ago
    I hope you understand that you can use secure primitives (such as ECDSA and AES) to build insecure protocols.
    - marknadal 8y ago
      And I hope you understand we've spent over a year with a large open source community collectively working on reviewing the implementation, discussing it with colleagues around the world from MIT and Navy personnel and more, working to make it secure, and even now still improving it. Do you have any vulnerability to report? Please send it in. Security is an always evolving process.
wgjordan 8y ago
So no industry/academic peer review yet. The link is to a self-published whitepaper, and the 'stanford.edu' affiliation is through a visiting postdoc at the Graduate School of Education (nothing CS related).
- marknadal 8y ago
  The usual complaint is "what about your blockchain crypto economic incentives?" for that, we turned to a PhD in psychology for behavioral economics. So yes, her PhD is in psychology, and she's a visiting research scientist at Stanford's School of Education. Meanwhile, I work on the computer science side, although am not an academic (although I interact with plenty of academics, MIT, Berkeley, Stanford, and some European schools). The tech talk I linked to explains how the algorithms work (CRDTs), you don't need to be an academic to understand how it works. The system has been used on Navy warships, as well. If you'd like to talk to the Sergeant Major who deployed the system in production in the industry, shoot me an email and I'll happily connect you. :)

wslh 8y ago

Where are the independent security reviews? Also, I don't see past references where you based your new idea. Please take into account that I am respecting you for your work but this field involves more than a claim. If you look, for example, to simmetric encryption algorithms history, there were a lot of proposals and people involved in trying to crack them. Many of them sounded great but were break by professional cryptographers. The blockchain scene is full of proposals but there are very few security reviews.

marknadal 8y ago
Go have anybody you want look at the code, it is open source. My friends like Dominic Tarr (of Secure Scuttlebutt), security teams at MIT (Christian and Dmitri), and others have consulted with me about it. If you are willing to contribute donations to pay a firm, please do!
marknadal 8y ago
You edited your post after I replied. We're not writing our own cryptography, lol, we're using existing libraries based around OpenSSL using industry accepted and standardized algorithms and curves (ECDSA 256, AES 256, ECDH 256, PBKDF, etc.) So yes, please email me the moment those get broken/cracked and we'll upgrade to whatever new standards are available.
- somenewacc 8y ago
  I hope you understand that you can use secure primitives (such as ECDSA and AES) to build insecure protocols.
  - marknadal 8y ago
    And I hope you understand we've spent over a year with a large open source community collectively working on reviewing the implementation, discussing it with colleagues around the world from MIT and Navy personnel and more, working to make it secure, and even now still improving it. Do you have any vulnerability to report? Please send it in. Security is an always evolving process.

wgjordan 8y ago

So no industry/academic peer review yet. The link is to a self-published whitepaper, and the 'stanford.edu' affiliation is through a visiting postdoc at the Graduate School of Education (nothing CS related).

marknadal 8y ago
The usual complaint is "what about your blockchain crypto economic incentives?" for that, we turned to a PhD in psychology for behavioral economics. So yes, her PhD is in psychology, and she's a visiting research scientist at Stanford's School of Education. Meanwhile, I work on the computer science side, although am not an academic (although I interact with plenty of academics, MIT, Berkeley, Stanford, and some European schools). The tech talk I linked to explains how the algorithms work (CRDTs), you don't need to be an academic to understand how it works. The system has been used on Navy warships, as well. If you'd like to talk to the Sergeant Major who deployed the system in production in the industry, shoot me an email and I'll happily connect you. :)