Posts
Quasipolynomial Cryptanalysis of the McEliece Cryptosystem (or: PIR Meets McEliece)
I built a visual tool to explain entropy and randomness in cryptography
After reading about cases where weak entropy led to unsafe keys and people losing funds (recent bitcoin COLDCARD attack) , I decided to learn more about entropy and how it is generated. There are different ways to generate entropy, like TRNGs, PRNGs, rolling dice, or flipping coins. But for me, …
Some thoughts about Anthropic’s new cryptanalysis results (from Prof Matthew Green)
A Polynomial-Time Quantum Algorithm for the Dihedral Coset Problem (July 31, 2026)
This is seems noteworthy. It's from Simon. Correct me if I'm wrong but the approximation factor of `sqrt(n)polylog(n)` means that current lattice cryptosystems would be in danger and not PQ-algorithms anymore.
ll Bloom: recovering wallet seeds generated by CryptoJS’s historical MWC PRNG
Coinspect recently disclosed **Ill Bloom**, a vulnerability affecting recovery phrases generated using the historical `CryptoJS.lib.WordArray.random()` implementation. The affected CryptoJS 3.x code used a Multiply-With-Carry construction seeded with values derived from `Math.random()` The technical disclosure, including the PRNG reconstruction and affected-version analysis, is here: [https://illbloom.org/](https://illbloom.org/)
What does djb want to say here?
Coldcard/firmware @ ae88593552
I built a read-once secret sharing tool where the words in the share code ARE the key — three external audits later, here's the design. Tear it apart.
I got tired of watching SSH keys and API tokens sit in Slack/Teams/Whatsapp history forever, and I wasn't happy with the trust model of the existing tools (onetimesecret only does E2E if you set a passphrase; most others are links-only). So I built my own and had it audited three …
Discovering cryptographic weaknesses with Claude
This blogpost from Anthropic describes using the Claude Mythos AI tool to find an attack on HAWK. The attack is not practical at proposed production key strengths, but it improves the best known attacks by quite a lot, and might doom HAWK’s chances in the PQC Signatures On-ramp. They also …
Machine-checked that Kyber's reference-C forward NTT matches FIPS 203, and why the smaller modulus made it easier than Dilithium
I've been verifying post-quantum reference implementations against their FIPS specs with a `SAW → Cryptol → Isabelle` pipeline. Just finished ML-KEM-512 (Kyber) forward NTT on the unmodified PQClean `clean` C: SAW proves the C bit-exact to a Cryptol model, Isabelle proves that model equals the FIPS 203 transform (the incomplete …