Researchers Made IOTA’s Curl Collision Attack Reproducible

A paper dated May 27, 2018 gave independent, reproducible support to the security case against Curl, the custom hash function formerly used in IOTA’s transaction-signing process. Harvard College students Michael Colavita and Garrett Tanzer said they reproduced and formalized earlier work by researchers associated with Boston University and MIT’s Digital Currency Initiative, then released a multithreaded implementation of the central collision attack.

The development did not disclose an unpatched vulnerability in the live IOTA signing system. IOTA had replaced Curl in that role during August 2017. Its importance was instead methodological: an attack previously described without its full cryptanalytic procedure could now be inspected through a detailed paper, example collisions and public code.

What the researchers demonstrated

A cryptographic collision occurs when two different inputs generate the same hash output. Collision resistance is essential when a signature scheme signs a message’s hash, because two messages sharing that hash can undermine the assurance that a signature belongs only to the intended message.

Colavita and Tanzer analyzed Curl as a ternary sponge construction operating on a 729-trit state, divided into a 243-trit rate and 486-trit capacity. They described a differential attack that constrained how differences propagated through Curl’s transformation rounds. Their paper reported producing novel fixed-length collisions in several minutes on commodity hardware.

They also constructed a full-state collision. By appending the same 243-trit suffix after carefully selected prefixes, the researchers said they could eliminate the remaining difference in the internal state and generate an arbitrary number of colliding extensions. Their reported search for one such prefix took approximately one hour on commodity hardware.

The accompanying repository supplied C source code, build instructions and example message pairs with identical Curl digests. Harvard cryptography professor Boaz Barak’s course page characterized the project as reproducing the earlier result and supplying a complete description and publicly available implementation.

These were researcher-reported performance windows, not an independent Coinburn benchmark. Actual runtime depended on hardware and thread count, and this reconstruction did not execute the historical code.

The vulnerability predated the paper

The chronology limits what May 27 represented. Ethan Heilman, Neha Narula, Thaddeus Dryja and Madars Virza had disclosed Curl weaknesses to IOTA’s developers beginning July 14, 2017. Their September 7 report described same-length collisions and an offline chosen-message signature-forgery attack against the former IOTA signing construction.

That report also documented mitigation before public disclosure. IOTA stopped using Curl for hashing transaction bundles in its signature process through an August 7 protocol update, with the relevant fixes identified as IOTA Reference Implementation version 1.3 and wallet version 2.4.0. The May 27 paper itself called Curl deprecated.

IOTA’s contemporaneous response disputed the attacks’ practical relevance to the cryptocurrency. The foundation argued that exploitation required unusual user behavior and difficult network conditions, and said it had moved signing to Keccak-384, wrapped as Kerl, on August 8, 2017. It maintained that no user funds had been at risk before the change while accepting the work as valid academic criticism of the public Curl design.

The defensible May 27 conclusion is therefore narrower than a claim that IOTA was newly hacked. Researchers independently showed that Curl lacked expected cryptographic properties and made their collision method reproducible. The event-day evidence does not establish exploitation of the live network, theft, or a new vulnerability in Kerl.

Later context

In March 2019, an expanded research group associated with MIT’s Digital Currency Initiative published a fuller analysis of Curl-P and the former IOTA signature scheme. That later work corroborated the significance of the cryptanalysis but was not information available on May 27, 2018 and does not change the event-day limits.