Posts
Thoughts on "Serious Cryptography" Second Edition
I have seen that Dr. Aumasson has published the Second Edition to "Serious Cryptography". If you read the first and second editions what did you make of the second edition? Any sections that you learned something valuable the previous edition lacked in? Would love to hear your thoughts.
Attack on 16-round DES
Hey all, Recently I was reading the OG paper from Shamir and Biham regarding the attack and I am lost about of the details: If we craft pairs that are special and supposed to fit the 13-round characteristic starting at round 2, we deal only with 2\^13 plaintexts with their …
U.S. officials urge Americans to use encrypted apps amid unprecedented cyberattack
Is the non-abelian hidden subgroup problem well understood by the cryptographic community?
I've mentioned it to people and they look at me like I have three heads or something. The setup involves group G, and a non-commuting subgroup H, where H≤G. This naturally aligns with random matrices as matrix multiplication is order dependent. Let's say we have public matrix A and hidden …
Calling All Cybersecurity Professionals: Test DontSpoof Vault and Help Perfect It!
Can we attack ACME HTTP-01 challenges at the data layer?
I insert myself between two internet routers, reading and injecting data layer packets. It helps if I am near a CA server. For each IP address, I make an HTTP-01 ACME challenge. For each IP address, a response from a CA will get routed through my cable. I add the …
Imagining Private Airspaces for Bluesky
Making CTR mode commiting
CTR mode and it's derivatives(like GCM) has an issue with key commitment. An attacker can convince a user to decrypt a given plaintext under multiple keys. For CTR mode, this is trivial since CTR mode provides no authentication at all. For modes that use a polynomial hash to provide authenticated …
Scheme for long lived auth
I'm working on a new product that will have mobile phone apps as some clients, but due to timeliness and usage patterns I want long term auth of some kind. A refresh once per quarter or so would be ideal. I could use JWT into this with a 3 month …
Can a digital signature on some data be replaced?
I am going to ask a rather stupid question for which I apologize in advance, but I'm sort of losing my head at this point. I am working on an encryption system where two parties are required to authenticate themselves to one another and subsequently perform a key exchange. The …