Your Daily Crypto News on Steemit September 8, 2017

• Quebec financial market authority supports regulated ICO!
• Isle of Man is open for ICOs!
• MIT experts finding serious Bug in IOTA!

---

The Canadian Financial Market Authority of the Quebec Autorité des marchés financiers (AMF) promotes the token sale of Impak Finance, a platform for the support of non-profit companies, and has given the token the status of a security. In addition, Impak Finance is to cooperate more closely with the regulatory authority in the future.

The AMF pursues the strategy of better understanding the blockchain and the underlying technology and making possible applications usable. The Canadian government is thus tackling the challenge of conventional financial market regulation through blockchain-based new use cases, rather than responding to the new and unknown, for example, with complete bans, such as China.

Impak Coin, the token to emerge from the planned ICO, will be the first regulated ICO project in Canada. The ICO is likely to be subject to certain rules, which will save Impak from having to meet the requirements of traditional securities issuers. The AMF will act as a regulator for the token.

Impak Finance will be part of the AMF sandbox, the regulator's ideas workshop. The concept of the sandbox was created by the Canadian stock exchange supervision. The sandbox is intended to promote Fintech projects, which do not exactly correspond to the legal framework, a categorization also applies to ICOs. Therefore, the cooperation between AMF and Impak Finance can be seen as a logical consequence of this development, especially as Impak Coin has been recognized as a securities by the Financial Market Authority.

Paul Allard, President of Impak said:

Impak Finances ICO project can also be viewed as a test run for the general crypto sector.

The involvement of Impak Finances in the sandbox is also very important for the AMF as it allows the agency to better understand and adapt to the business model of Fintech companies and the differences with traditional financial service providers. The common token sale creates a precedent for financial market supervision, which can be invoked in the event of later regulatory activities.

Canada's financial sector thus recognizes the potential of blockchain and tries to make it useful for itself. The regulatory authority is thus showing an alternative path compared to many other regulators worldwide.

---

According to an official, the island in the west of England wants to be more open to ICOs and to introduce a tolerant legal framework.

On the Isle of Man live about 85,000 people. The island is owned by the British Crown, but has been largely autonomous since 1855. While in the larger countries, especially in the bordering United Kingdom, regulations for ICOs are lacking, smaller countries in particular are taking advantage of the opportunity - so we have often heard of Singapore.

But the Isle of Man is not just a novelty, as Dublin reported in the past as a growing blockchain hub and a hub between America and Europe.

The department head for FinTech and Digital Development in the Department of Economic Development at the Isle of Man explained that the ICO industry is being viewed with enthusiasm.

In the past, the Isle of Man has been praised for its legal settlement with crypto currencies. The co-founder of Diacle, Adam Vaziri, stated in a statement: "The Isle of Man has the first jurisdiction for which we have a lot of respect. The Isle of Man developed a regulatory framework for crypto companies that allowed Diacle to implement the first fully compliant ICO. "

The clear structure against these new technologies brings immense advantages and even for the blockchain ecosystem itself. Ross Wilson from the Bitcoin exchange Coincorner stated:

The Isle of Man is the first jurisdiction that has introduced a billboard specifically to promote ICOs, as Bitcoin.com reported. This week, news from China have announced the temporary hiring of ICOs. The US, Canada, Singapore and Hong Kong appear to be more openly concerned with ICO attitudes.

---

IOTA is a crypto currencies that has been very well developed in recent months. One reason for this is the so-called "Tangle" design. Some scientists at the Digital Currency Initiative at the famous Massachusetts Institute of Technology (MIT) have now looked more closely at the currency. The result is not necessarily flattering for developers, investors and industry partners.

The crypto currency, which can be arbitrarily scalable thanks to the Tangle technology and manages without charges, has already been tested by numerous companies - such as Foxconn, Bosch, Innogy, Cicso, Microsoft and others. There are partnerships with universities, an IoT Summercamp in Frankfurt, where IOTA plays a significant role, and more. Developed by Dominik Schierer, a 21-year-old Austrian who lives in Berlin, seems to be on an unstoppable high-altitude flight. This is also reflected in the price. With a market capitalization of almost $ 2 billion, IOTA is in the top 10 of all cryptos.

Now there is the first setback for IOTA. Four IT scientists from the Digital Currency Initiative of the Massachusetts Institute of Technology (MIT) have intensively dealt with IOTA last month. The director of the group, Neha Narula, explains in a blog post that we have found a serious bug: "In the code repository on GitHub, we have discovered a serious weakness - the IOTA developers have written their own hash function, Curl, and it collisions. After we developed an attack, we could collide with common hardware in a matter of minutes and falsify signatures for IOTA payments. "

The scientists have reported the bug to the developers, and they have fixed it. Is all good now?

No, Narula says. Not at all. The bug rather shows that IOTA in particular and crypto currencies generally have some major problems.

Hash functions are mathematical one-way functions: They take a certain input and turn it into a certain output. The special thing is that all outputs have the same length, the same input always leads to the same output, and it is impossible to close the output from the input. If you want to understand it practically, simply try the Hashgenerator.de.

Hash functions are used, for example, to avoid storing passwords. Good online platforms only store the hash of a password. If the user then enters the password, the hash is calculated and compared with the hash in the database. If both are the same, the user may enter his account. Bitcoin uses hashes in different places. Most importantly, the mining is where miners try different inputs to get a certain result by means of hash function.

For IOTA, however, the hash function was used to hash before signing. When the researchers examined the code of IOTA, they noticed that the Hash function used by IOTA can be broken by a well-known technique of differential cryptanalysis. It is possible to form so-called collisions: to find two inputs which form the same output. This will remove one of the most important features of hash functions.

If this was the case with Bitcoin's SHA-256 algorithm, Miner could produce faster Bitcoins. If this were to happen in the algorithms used to protect online accounts, the security of passwords would be significantly reduced. In the case of IOTA, on the other hand, it was possible "to produce two payments which are different, but are hacked to the same value and thus have the same signature. A hostile player could use this technique to destroy, or even steal, the assets of users. "

The MIT researchers have had the opportunity to destroy assets in the range of one to two billion dollars. The weakness was already fixed, as I said. More than herself, however, it is a problem that she was there at all.

Security expert Bruce Schneier wrote:

Not only did the IOTA developers have been insufficiently tested for the security of the system - they have also violated a basic rule of cryptography: "Never use your own cryptography." Each expert is exclusively known, understood, researched and tested crypto Algorithms when building a system. Developing your own algorithm, rather than using the existing, years-tested algorithms, is similarly clever as building your own operating system. For example, SHA-3, the successor to SHA-2, was tested from 2006 to 2015 by a variety of mathematicians and cryptologists. To make this as well in the very beginning is to show a certain megalomania and ignorance against the advantages of working.

Neha Narula said:

In IOTA, Neha Narula recognizes a few more problem zones, which should also be a huge red flag for investors.

We could not investigate part of IOTA because the code is not open source: the trusted coordinators. The IOTA developers run the trusted coordinator, which signs the last valid state of the system. For the efficiency of the system this is certainly practical. But, honestly: not open source? A central authority that you must trust? Real crypto investors have long been gone in these two sentences, Neha Narula said.

Crypto currencies are open source, decentralized and do not need trust. This is a major part of their value. That IOTA breaks these rules is alarming. It also does not really help the developers to remove the trusted coordinator once.

But it goes even further. There are other red flags. Unlike other programs running on our laptops or phones, IOTA uses ternary instead of binary. As all current computers calculate binary, IOTA converts the operations into their software into the ternary. This is less efficient, but more complex. This complexity prevents IOTA from taking advantage of the existing security analysis tool because they have been designed to work with binary systems. This also makes the code harder to read and understand.

Furthermore, the developers have still found out that an IOTA transaction is 10 kilobytes large. Compared to Bitcoin's standard transactions, which require only 220 bytes, this is gigantic. This is a tremendous waste of bandwidth, memory, and computer capacity, which does not stand well in a currency like IOTA, running on the tiny machine rabbits of the Internet of Things.

The problem is not only that these bugs and weaknesses are there. Everyone has the right to experiment and write the software they want. The problem is rather, Neha Narula says, "developers and investors do not examine these systems carefully." Many investors rely on "signalling": if enough well-known institutions such as universities and big companies invest or advise, that the project will have a hand and a foot.

Especially with crypto currencies there is a lot of trust in technology in the game - and with it also trust that there are people, who examine the open-source technology competently and critically. This trust does not always seem justified.

The problem is that some of these technologies have serious weaknesses, and that big companies and well-known individuals do not fulfill their due diligence and invest sufficient resources and time to evaluate projects with which they enter into a partnership. The crypto currency has a market capitalization of nearly $ 2 billion and partnerships with some of the largest technology groups in the world. You might think they know what they're doing, right?

Obviously not.

Note: There is an official response from IOTA developers to the MIT Group's post. In this, the developers explain, among other things, that the collision attack is extremely unlikely and that transactions are usually not 10, but "only" 1.6kb.

---

I wish you all a lovely Friday!!!
Best regards