Posts
cr.yp.to: 2025.09.30: Surreptitious surveillance
Should EU ID require designated verifier credentials?
I've linked the discussion section for the EU ID repository, but seemingly designated verifier credentials appear [only once in passing](https://github.com/eu-digital-identity-wallet/eudi-doc-architecture-and-reference-framework/issues/200). Should all online proofs of PII be designated verifier? Aka nobody but the "relaying-party" can actualy validate anything about the credential. Or would this be too constraining?
Government targets UK Apple users in new demand for data
2FA privacy analysis (W3C WebAuthn, FIDO2 etc)
Is there any formal analysis of the privacy claims about the various 2FA protocols, like W3C WebAuthn, FIDO2, or whatever the different Yubikeys use. As an example, a user might've a FIDO2 device with which they login to both personal and work gmails. Can gmail to link these two accounts? …
Thoughts on Bernstein's Critiques of ML-KEM vs Classic McEliece
I am trying to see if Daniel J Bernstein has valid claims on the strength of Classic McEliece over ML-KEM. Bernstein was obviously upset that Kyber was chosen instead. Here is [a link](https://blog.cr.yp.to/20250423-mceliece.html) to his defense of Classic McEliece over Kyber. I would love to hear your thoughts on Bernstein's …
Easy-to-use Sigma proofs in C using libsodium
Dangling s3 bucket and fwupd gpg signature bypass with 100000 vulnerable Linux hosts (2020)
Why Don't Compiler Developers Add Support for Constant-Time Compilation?
I was reading the work "[Breaking Bad: How Compilers Can Break Constant-Time Implementations](https://arxiv.org/pdf/2410.13489)". The paper complained compiler updates can destroy the constant-time guarantee even for formally verified constant time code. Why don't compiler developers add support for constant-time compilation?
Geometric patterns in SHA-256 Output
Or more precisely- *Boundary Constraints in SHA-256 Constant Generation* Figured I'd throw another bread crumb in there for you guys: import math import mpmath as mp mp.mp.dps = 50 # Used to compute the modular distance bounds for the fractional part K_STAR = 0.04449 WIDTH_FACTOR = 0.5 PHI = (1 …
Advice for Designing Cryptographic Software That is Misuse-Resistant
One of the complaints that I have heard on this subreddit is that it is hard to design and implement cryptographic software that is misuse resistant--and I am not sure if that is harder than implementing cryptographic software that is secure. When I asked similiar questions people admitted I can …