Профиль floating | Binance Square

·

--

Статья

См. перевод

The Security Detail in Newton Protocol I Almost IgnoredI kept thinking about what response time can reveal. Most conversations around blockchain infrastructure treat latency as a performance problem. Faster execution, lower delays, and better throughput usually dominate the discussion. That's what I expected when I started reading Newton Protocol's documentation as well. Instead, I found a security discussion that had very little to do with speed. Newton treats part of timing as a cryptographic security problem. At first, I assumed this was a minor implementation detail. After spending more time reading through the documentation, I realized it touches on a much broader question: what information can an attacker learn simply by measuring how long a system takes to respond? That distinction changed how I looked at the protocol. Timing Can Leak More Than Performance Many people think encryption and digital signatures either work or they don't. Imagine trying to unlock a safe. If every incorrect combination causes the lock to hesitate slightly longer than another, someone recording thousands of attempts might eventually discover patterns without ever seeing the combination itself. Computers can create similar situations. If a cryptographic operation takes different amounts of time depending on secret key material, attackers may be able to collect thousands—or even millions—of timing measurement stical analysis to infer That is why implementation quality matters just as much as cryptographic design. Only after understanding this problem did Newton's approach make more sense to me. According to its security documentation, Newton relies on audited constant-time cryptographic implementations for several of the algorithms used throughout the protocol, including secp256k1, Ed25519, X25519, and HPKE. Passengers may choose different destinations, airlines, or boarding gates, but the identity verification process itself follows carefully controlled procedures designed not to reveal unnecessary information. Constant-time cryptography works in a similar way. Its objective is to reduce or eliminate execution differences that depend on sensitive cryptographic material. Instead of allowing secret keys to influence how long an operation takes, the implementation attempts to execute in a consistent manner regardless of the underlying secret. That creates a stronger security boundary around key operations without requiring Newton's authorization policies themselves to change. In a protocol built around policy-based authorization, signatures, and encrypted communication, that is a meaningful design choice. The more I read, the more one thought kept coming back. Does constant-time cryptography mean the entire protocol always responds in constant time? And I think that's an important distinction. Newton's documentation explains that overall latency is dominated by factors such as network round trips and policy evaluation. The underlying cryptographic operations typically complete within microsecond-to-low-millisecond ranges on ordinary hardware, while complete authorization workflows naturally vary depending on what they need to evaluate. In other words, two policy requests may legitimately take different amounts of time. That difference alone does not imply any cryptographic weakness. Two Different Security Questions This is where I think many discussions become confusing. There are really two separate questions. Can sensitive cryptographic operations leak secret key material through execution time? Newton addresses this by using audited constant-time implementations around its core cryptographic primitives. Can someone learn something from the overall behavior of an application simply by observing response times? That is a much broader application-level consideration. Different requests may involve different policy complexity, additional data retrieval, external coordination, or network communication. As a result, one authorization request may naturally complete faster than another. Those differences are not automatically security vulnerabilities. However, application developers should still think carefully about whether repeated latency patterns could unintentionally reveal workflow characteristics or operational behavior. That consideration exists well beyond Newton itself and applies to many distributed systems. This is one reason I believe authorization infrastructure deserves more attention than it currently receives. Institutional treasuries, DAO vaults, AI agents, custodians, and real-world asset platforms increasingly rely on automated decision-making before assets move. The security conversation cannot stop at digital signatures. It also needs to consider how those systems behave while making authorization decisions. Constant-time cryptography protects one important layer. There are several areas I'll continue watching: Whether policy evaluation remains efficient as rule complexity grows. How decentralized the operator network becomes over time. Whether developers find policy creation simple enough to encourage adoption. Real protocol usage instead of announcement-driven excitement. Whether enterprise users actually deploy policy-based authorization in production environments. Rather than focusing on price actions sese are the indicators I believe matter most: Growth in daily policy evaluations. Operator network participation. Enterprise integrations. Fee generation tied to real authorization activity. The biggest lesson I took away wasn't that Newton has "constant-time cryptography." It was understanding what that phrase actually means. Constant-time implementations aim to prevent sensitive cryptographic operations from revealing secret material through execution time. They do not promise that every network request, every policy evaluation, or every authorization workflow finishes in exactly the same amount of time. Those are different security questions, and confusing them can lead to incorrect conclusions. I find that distinction more interesting than any headline performance benchmark because it highlights the difference between protecting cryptographic secrets and understanding application behavior as a whole. I'm not saying this makes Newton the definitive solution for authorization infrastructure. I'm saying it's the kind of implementation detail that often receives less attention than it deserves. What do you think? Is protecting cryptographic operations from timing attacks enough, or should authorization systems also be designed with application-level timing patterns in mind? @NewtonProtocol $NEWT {spot}(NEWTUSDT) $TIMI $VANRY {spot}(VANRYUSDT) #NEWT

The Security Detail in Newton Protocol I Almost Ignored

I kept thinking about what response time can reveal.
Most conversations around blockchain infrastructure treat latency as a performance problem. Faster execution, lower delays, and better throughput usually dominate the discussion. That's what I expected when I started reading Newton Protocol's documentation as well.
Instead, I found a security discussion that had very little to do with speed.
Newton treats part of timing as a cryptographic security problem.
At first, I assumed this was a minor implementation detail. After spending more time reading through the documentation, I realized it touches on a much broader question: what information can an attacker learn simply by measuring how long a system takes to respond?
That distinction changed how I looked at the protocol.
Timing Can Leak More Than Performance
Many people think encryption and digital signatures either work or they don't.
Imagine trying to unlock a safe. If every incorrect combination causes the lock to hesitate slightly longer than another, someone recording thousands of attempts might eventually discover patterns without ever seeing the combination itself.
Computers can create similar situations.
If a cryptographic operation takes different amounts of time depending on secret key material, attackers may be able to collect thousands—or even millions—of timing measurement stical analysis to infer
That is why implementation quality matters just as much as cryptographic design.
Only after understanding this problem did Newton's approach make more sense to me.
According to its security documentation, Newton relies on audited constant-time cryptographic implementations for several of the algorithms used throughout the protocol, including secp256k1, Ed25519, X25519, and HPKE.
Passengers may choose different destinations, airlines, or boarding gates, but the identity verification process itself follows carefully controlled procedures designed not to reveal unnecessary information.
Constant-time cryptography works in a similar way.
Its objective is to reduce or eliminate execution differences that depend on sensitive cryptographic material.
Instead of allowing secret keys to influence how long an operation takes, the implementation attempts to execute in a consistent manner regardless of the underlying secret.
That creates a stronger security boundary around key operations without requiring Newton's authorization policies themselves to change.
In a protocol built around policy-based authorization, signatures, and encrypted communication, that is a meaningful design choice.
The more I read, the more one thought kept coming back.
Does constant-time cryptography mean the entire protocol always responds in constant time?
And I think that's an important distinction.
Newton's documentation explains that overall latency is dominated by factors such as network round trips and policy evaluation. The underlying cryptographic operations typically complete within microsecond-to-low-millisecond ranges on ordinary hardware, while complete authorization workflows naturally vary depending on what they need to evaluate.
In other words, two policy requests may legitimately take different amounts of time.
That difference alone does not imply any cryptographic weakness.
Two Different Security Questions
This is where I think many discussions become confusing.
There are really two separate questions.
Can sensitive cryptographic operations leak secret key material through execution time?
Newton addresses this by using audited constant-time implementations around its core cryptographic primitives.
Can someone learn something from the overall behavior of an application simply by observing response times?
That is a much broader application-level consideration.
Different requests may involve different policy complexity, additional data retrieval, external coordination, or network communication.
As a result, one authorization request may naturally complete faster than another.
Those differences are not automatically security vulnerabilities.
However, application developers should still think carefully about whether repeated latency patterns could unintentionally reveal workflow characteristics or operational behavior.
That consideration exists well beyond Newton itself and applies to many distributed systems.
This is one reason I believe authorization infrastructure deserves more attention than it currently receives.
Institutional treasuries, DAO vaults, AI agents, custodians, and real-world asset platforms increasingly rely on automated decision-making before assets move.
The security conversation cannot stop at digital signatures.
It also needs to consider how those systems behave while making authorization decisions.
Constant-time cryptography protects one important layer.
There are several areas I'll continue watching:
Whether policy evaluation remains efficient as rule complexity grows.
How decentralized the operator network becomes over time.
Whether developers find policy creation simple enough to encourage adoption.
Real protocol usage instead of announcement-driven excitement.
Whether enterprise users actually deploy policy-based authorization in production environments.
Rather than focusing on price actions sese are the indicators I believe matter most:
Growth in daily policy evaluations.
Operator network participation.
Enterprise integrations.
Fee generation tied to real authorization activity.
The biggest lesson I took away wasn't that Newton has "constant-time cryptography."
It was understanding what that phrase actually means.
Constant-time implementations aim to prevent sensitive cryptographic operations from revealing secret material through execution time.
They do not promise that every network request, every policy evaluation, or every authorization workflow finishes in exactly the same amount of time.
Those are different security questions, and confusing them can lead to incorrect conclusions.
I find that distinction more interesting than any headline performance benchmark because it highlights the difference between protecting cryptographic secrets and understanding application behavior as a whole.
I'm not saying this makes Newton the definitive solution for authorization infrastructure.
I'm saying it's the kind of implementation detail that often receives less attention than it deserves.
What do you think? Is protecting cryptographic operations from timing attacks enough, or should authorization systems also be designed with application-level timing patterns in mind?
@NewtonProtocol
$NEWT
$TIMI
$VANRY
#NEWT

floating

The Security Detail in Newton Protocol I Almost Ignored

Newton Protocol не строит сеть ИИ. Он переписывает правила цифрового доверия

Я не ожидал, что безопасность изменит моё мнение о крипто

Когда одного адреса Policy недостаточно: та деталь интеграции Newton, которая изменила то, как я читаю Authorization

Newton Protocol и иллюзия «надёжной доходности»

Более сильное вступление, которое сразу привлекает внимание, оставаясь при этом аналитичным

Может ли протокол Newton превратить «качество разрешений» в новый класс активов для ончейн-финансов?

В тренде