#cryptography

The article discusses remote attestation, a security mechanism that allows a remote system to verify the integrity of another system's hardware and software state. It explains how attestation uses cryptographic signatures and trusted platform modules to detect tampering or unauthorized changes. The piece covers applications in cloud computing, IoT devices, and confidential computing environments.

This paper presents a framework for robust secret storage in distributed networks, focusing on ensuring data confidentiality and availability even when some nodes fail or are compromised. The proposed scheme uses secret sharing and error-correcting codes to store secrets across network nodes efficiently.

Proton's claim that its crypto is "Transparent and OPAQUE" is misleading: while it uses the OPAQUE protocol for authentication, its encryption system lacks full transparency and verifiability compared to the OPAQUE standard.

Zk.golf is a collaborative platform where developers compete to optimize ZK circuit constraints, using peer-reviewed techniques to reduce circuit sizes. It fosters a fearless, gamified environment for learning and sharing optimization strategies across different proving systems.

The article compares Argon2 and Bcrypt password hashing algorithms, explaining their differences in security, memory usage, and resistance to GPU and ASIC attacks. It concludes that Argon2 is generally more secure and modern than Bcrypt, but Bcrypt remains a strong choice for many applications.

Teekit is an open-source stack for building end-to-end verifiable applications using Trusted Execution Environments (TEEs), enabling developers to create trustless systems with hardware-level security guarantees.

The article alleges that the NSA attempted to weaken the standardization process of ML-KEM (a post-quantum cryptography algorithm) by proposing changes that would reduce its security. The author argues these efforts were aimed at making the cryptographic standard easier for the NSA to compromise.

The article explores the MD5 hash algorithm's avalanche effect by testing how small input changes drastically alter the output hash. It demonstrates that even a single character difference in input produces a completely different hash, highlighting MD5's sensitivity to input changes despite its well-known cryptographic weaknesses.

Power House is an open-source toolkit written in Rust and Python that enables the creation and verification of verifiable computation artifacts, helping developers build trust in software outputs through cryptographic proofs.

This paper proposes a system for age verification that preserves user privacy by not revealing identity. It uses cryptographic techniques like zero-knowledge proofs and digital signatures to allow a user to prove they are over a certain age without disclosing their exact birthdate or other personal information.

The article analyzes Meta's implementation of digital signatures for content provenance, arguing that their approach has critical flaws. It claims Meta's system fails to maintain cryptographic integrity of signatures when content is resized or re-encoded, rendering the signatures unstable and unreliable for verifying the authenticity of images and videos across platforms.

The article explains how to properly format ciphertext for clarity and consistency, covering common conventions such as using base64 encoding, adding prefixes to indicate encryption type, and applying delimiters or line breaks for readability in cryptographic outputs.

Markovian is a protocol that provides keyless, Bitcoin-anchored provenance for AI agent outputs. It enables verification that an output was produced by a specific AI agent at a specific time, without requiring cryptographic keys, by anchoring proofs directly to the Bitcoin blockchain.

This paper analyzes side-channel vulnerabilities in hardware implementations of ML-KEM verification, a key component of post-quantum cryptography, and proposes protections to mitigate these security risks.

RFC 9980 defines a framework for integrating post-quantum cryptography into OpenPGP, specifying new algorithms, key formats, and protocol extensions to protect against future quantum-computer-based attacks. It updates the OpenPGP message format to support quantum-resistant cryptographic schemes.

Microsoft Research introduces Vega, a new system using zero-knowledge proofs to enhance digital identity verification without exposing underlying private data. Designed for the AI era, Vega allows users to prove attributes like age or credentials securely, addressing growing concerns around privacy and trust in digital interactions.

Trail of Bits has contributed post-quantum cryptography (PQC) support to CPython's hashlib and ssl modules, enabling Python developers to experiment with quantum-resistant algorithms like ML-KEM (FIPS 203) and ML-DSA (FIPS 204). The implementation uses the liboqs library and is scheduled for inclusion in Python 3.15, though it remains experimental and not ready for production use.

The article proposes a rethinking of trust models in decentralized blockchain systems, introducing a collaborative trust framework that aims to achieve verifiable decentralization. It addresses limitations in current consensus mechanisms and trust assumptions, offering a formal approach to ensure trustworthiness without central coordination.

A pure Bash 3.2 implementation of the SHA-256 hash algorithm, called basha256.sh, has been shared on GitHub. The script provides a way to compute SHA-256 hashes without relying on external tools or utilities.

Vitalik Buterin introduces obfuscation as a powerful cryptographic primitive that could theoretically enable any computation to be hidden while still being executable, describing it as the "final boss" of cryptography. The post explains the concept, its potential applications, and the challenges involved in achieving practical obfuscation, noting significant theoretical progress.

Vitalik Buterin explores obfuscation as a powerful cryptographic tool that could enable universal program secrecy, comparing it to a "final boss" of cryptography. He discusses its theoretical foundations, practical challenges, and potential applications like fully homomorphic encryption and secure software distribution.

A person claims to have used AI to beat one of the best published quantum circuits for breaking ECDSA, a cryptographic algorithm used in Bitcoin and other systems.

The article explains that a cryptographic hash verifies only the content of data (the bytes), not its origin or authenticity. Hashing alone cannot prove who created or sent the data, as it only ensures data integrity. Additional methods like digital signatures are needed to verify the source.

Alan Mathison Turing (1912–1954) was a pioneering British mathematician, logician, and computer scientist. He formalized the concepts of algorithm and computation with the Turing machine, played a key role in breaking Nazi codes during WWII, and laid foundational work for artificial intelligence. The IT History Society honors his transformative contributions to computing and technology.

The Cypherpunk Library is a curated digital collection of texts, essays, manifestos, and resources central to the cypherpunk movement, covering topics like cryptography, privacy, digital rights, and decentralized systems.

The article argues Proton's authentication uses SRP, not truly transparent or OPAQUE cryptography, despite marketing claims. It explains that SRP reveals a password verifier to the server, unlike OPAQUE which fully hides the password from the server.

The article explores the transition to post-quantum cryptography, explaining how quantum computers threaten current public-key algorithms and detailing the practical challenges of deploying new quantum-resistant certificate standards like ML-KEM and ML-DSA.

Daniel J. Bernstein (djb) discusses efforts to weaken post-quantum TLS in this live presentation.

Using modulo (%) to reduce a random number to a smaller range can introduce bias if the range does not evenly divide the original range. Common methods like `rand() % N` often produce non-uniform results, especially with small N or poor PRNGs. Techniques like rejection sampling or floating-point conversion are recommended to preserve randomness quality.

The article details Alan Turing's development of the Delilah, a secure voice encryption system created after World War II. Though technically successful, the device was nearly forgotten because the British government lost interest in portable voice encryption after the war. The piece highlights Turing's innovative work beyond his famous codebreaking at Bletchley Park.