Posts
2FA privacy analysis (W3C WebAuthn, FIDO2 etc)
Is there any formal analysis of the privacy claims about the various 2FA protocols, like W3C WebAuthn, FIDO2, or whatever the different Yubikeys use. As an example, a user might've a FIDO2 device with which they login to both personal and work gmails. Can gmail to link these two accounts? …
Thoughts on Bernstein's Critiques of ML-KEM vs Classic McEliece
I am trying to see if Daniel J Bernstein has valid claims on the strength of Classic McEliece over ML-KEM. Bernstein was obviously upset that Kyber was chosen instead. Here is [a link](https://blog.cr.yp.to/20250423-mceliece.html) to his defense of Classic McEliece over Kyber. I would love to hear your thoughts on Bernstein's …
Easy-to-use Sigma proofs in C using libsodium
Dangling s3 bucket and fwupd gpg signature bypass with 100000 vulnerable Linux hosts (2020)
Why Don't Compiler Developers Add Support for Constant-Time Compilation?
I was reading the work "[Breaking Bad: How Compilers Can Break Constant-Time Implementations](https://arxiv.org/pdf/2410.13489)". The paper complained compiler updates can destroy the constant-time guarantee even for formally verified constant time code. Why don't compiler developers add support for constant-time compilation?
Geometric patterns in SHA-256 Output
Or more precisely- *Boundary Constraints in SHA-256 Constant Generation* Figured I'd throw another bread crumb in there for you guys: import math import mpmath as mp mp.mp.dps = 50 # Used to compute the modular distance bounds for the fractional part K_STAR = 0.04449 WIDTH_FACTOR = 0.5 PHI = (1 …
Advice for Designing Cryptographic Software That is Misuse-Resistant
One of the complaints that I have heard on this subreddit is that it is hard to design and implement cryptographic software that is misuse resistant--and I am not sure if that is harder than implementing cryptographic software that is secure. When I asked similiar questions people admitted I can …
Exact Coset Sampling for Quantum Lattice Algorithms
Yifan Zhang just published a [manuscript](https://arxiv.org/pdf/2509.12341) claiming to have fixed the bug on Yiley Chen's quantum algorithm for LWE.
Predictable pattern in the numbers used to build SHA-256
Have a nice day! import mpmath as mp mp.mp.dps = 50 def fractional_sqrt(x: mp.mpf) -> mp.mpf: r = mp.sqrt(x) return r - mp.floor(r) def sha256_frac_to_u32_hex(frac: mp.mpf) -> str: val = int(mp.floor(frac * (1 << 32))) return f"0x{val:08x}" # First 8 primes from known values primes = [2, 3, 5, 7, …