CVE-2023-48795 describes a prefix truncation attack on the SSH (Secure Shell) protocol. The vulnerability is called Terrapin. Why Terrapin? Terrapin is a small North American turtle (shell, get it?). Reminds me of my Alma Mater, the University of Maryland, College Park. The college football team is called Maryland Terrapins, as diamondback terrapins are endemic to… Continue reading Prefix truncation MITM attack on SSH protocol — Terrapin
ChatGPT 3.5 vs Bard — LLVM
I asked Bard "Explain LLVM". Bard said (in part) Imagine you have a program written in Python, but you want it to run on a device that only understands C instructions. LLVM can help you build a bridge! It provides the front-end tools to convert your Python code into an intermediate representation (IR) that’s like… Continue reading ChatGPT 3.5 vs Bard — LLVM
Crypto strength — pre and post quantum
Security is only as good as the weakest link. Example: You have installed a very strong lock on your front door. A potential intruder will look at the strong lock and go to the back of the house and find a weaker lock to pick. Also, one should be able to quantify what a "very… Continue reading Crypto strength — pre and post quantum
Are your communications secure? — https, root-ca, pfs, doh, dnssec, esni, rpki, blah, blah
A good friend of mine called me with this question: You work in computer security, right? I want to login to this website called xyz.com. Can anyone intercept my communications? I ask: 1) Are you using https://xyz.com, and not http? He replies: Yes I ask: 2) Are you logging in from a browsing center using… Continue reading Are your communications secure? — https, root-ca, pfs, doh, dnssec, esni, rpki, blah, blah
Doing crypto right is not easy
Rolling your own crypto is a bad idea — we should leave this to experts though even they get it wrong quite frequently. In general, one can safely use standard crypto algorithms and ciphers provided you follow the requirements carefully. Many require cryptographically strong random numbers — if this property is not satisfied, attackers can… Continue reading Doing crypto right is not easy
Web Assembly in a browser and beyond — Crypto Example
Web Assembly is a low level portable binary format (bytecode) for a stack-based virtual machine is a W3C web standard, that runs in a sandbox, on all major browsers runs nearly as fast as native machine code, and enables high performance applications on the Web language, hardware and platform independent (unlike Java applets and Flash)… Continue reading Web Assembly in a browser and beyond — Crypto Example
2017 Security Recap
Cryptographers and Security Researchers have a penchant for coming up with colorful acronyms and names which describe, in brief, the vulnerability or exposure. Some are them are BEAST, CRIME, ShellShock, SLOTH, POODLE, Lucky 13, Sweet32, Smurf, Petya, BlackNurse, FREAK, DROWN, BREACH, LOGJAM, HeartBleed, CloudBleed, TicketBleed, Fireball, CLOAK and DAGGER, WANNACRY, SambaCry, HIDDEN COBRA, BroadPwn, Blueborne,… Continue reading 2017 Security Recap
First SHA-1 collision, birthday paradox, should you rehash your will?
One of the most important properties of a cryptographic hash function is that of “Strong collision-resistance“, that is, it should be "computationally infeasible" to find distinct inputs x1, x2 such that hash(x1) = hash(x2). For the SHA-1 hash function, which generates a 160 bit hash, to have strong collision resistance, only a brute force attack… Continue reading First SHA-1 collision, birthday paradox, should you rehash your will?
Cross Platform (Android, iOS) app in F# with Reactive Extensions
If you love functional programming and want to write native cross-platform mobile apps (Android, iOS and even Windows Phone) and you know F#, you are set. The company that made this happen was Xamarin. For more info on Xamarin, read my blog article titled Monkey business — write once, deploy on iOS, Android and Windows… Continue reading Cross Platform (Android, iOS) app in F# with Reactive Extensions
LTE Crypto — safe, stateful computations in purely functional language Haskell
Snow3G is one of the two algorithms (the other being AES) algorithms used in LTE (4G) mobile network. The specifications for LTE come from the standards body called 3GPP and include the specification and reference implementation in C for the Snow 3G algorithm. There is an algorithm for confidentiality (encryption/decryption), and an algorithm for integrity.… Continue reading LTE Crypto — safe, stateful computations in purely functional language Haskell