In this post I'll explain why quantum computers are useless to find hash function collisions, and how we can leverage this powerlessness to build post-quantum signature schemes. I'll then describe a quantum computing model that you can try at home, and one where hash function collisions are easy to find. Let me start with a few … Continue reading Defeating Quantum Algorithms with Hash Functions
BLAKE2X: Unlimited Hashing
BLAKE2 is one of the most popular hash functions today, it’s more secure than the legacy standard SHA-2, and it’s faster than the newer standard SHA-3. BLAKE2 is also used in the latest cryptocurrency Zcash, in the Argon2 password hashing scheme, and is available in popular libraries such as OpenSSL of libsodium. But BLAKE2 didn't cut … Continue reading BLAKE2X: Unlimited Hashing
E-Voting Crypto Protocols
“It's not the voting that's democracy; it's the counting.” —Tom Stoppard For cryptography researchers, e-voting isn’t about voting machine or online voting, but is a field of research in its own right. E-voting research is about designing e-voting protocols, the core mathematical components of end-to-end auditable voting systems, or voting systems where independent auditors … Continue reading E-Voting Crypto Protocols
Hunting for Vulnerabilities in Signal – Part 3
Previous posts (part1 and part2) by Markus Vervier (@marver) and myself (@veorq) were about the Java code base and the Android client, now we'll discuss two bugs potentially affecting users of libsignal-protocol-c, the C implementation of the Signal protocol. More precisely, we identified bugs in the example callback functions used in the unit tests of … Continue reading Hunting for Vulnerabilities in Signal – Part 3
Data Science for Doofuses: What Toolbox to Use
Call it machine learning, AI, advanced data analytics, or data mining. It all boils down to looking at datasets and finding patterns that tell you something you didn’t know. For example that your average revenue per customer is $192, that the number of intrusion attempts on your network correlates with your number of tweets, or … Continue reading Data Science for Doofuses: What Toolbox to Use
Black Hat talk on SGX
Greetings from Vegas! Luis and I just gave our Black Hat talk SGX Secure Enclaves in Practice: Security and Crypto Review. It's the first public report about Intel's Software Guard Extensions (SGX) based on actual SGX hardware and on Intel's software development toolchain for Windows and Linux. We showed some undocumented parts of SGX and we released … Continue reading Black Hat talk on SGX
DEFCON qualifiers write-up: Baby-re
In this simple challenge, we're given the binary of a remote service: $ file baby-re baby-re: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, not stripped This asks for 13 inputs, and then returns `Wrong`, unless we give it the right input. $ ./baby-re Var[0]: 1 Var[1]: … Continue reading DEFCON qualifiers write-up: Baby-re
