Opsec Cyber Cryptography Archives - Page 9 of 17

Category Archives: Cryptography

S3 Ep89: Sextortion, blockchain blunder, and an OpenSSL bugfix [Podcast + Transcript]

June 30 2022 By Paul Ducklin in Cryptography, Law & order, Podcast, Security, Vulnerability

Latest episode - listen and read now! Use our advice to advise your own friends and family... let's all do our bit to stand up to scammers!

OpenSSL issues a bugfix for the previous bugfix

June 24 2022 By Paul Ducklin in Cryptography, Security, Vulnerability

Fortunately, it's not a major bugfix, which means it's easy to patch and can teach us all some useful lessons.

On the Subversion of NIST by the NSA

June 23 2022 By Bruce Schneier in Cryptography, nsa, Security

Nadiya Kostyuk and Susan Landau wrote an interesting paper: “Dueling Over DUAL_EC_DRBG: The Consequences of Corrupting a Cryptographic Standardization Process“:

Abstract: In recent decades, the U.S. National Institute of...
Read more

Hidden Anti-Cryptography Provisions in Internet Anti-Trust Bills

June 21 2022 By Bruce Schneier in Cryptography, Security

Two bills attempting to reduce the power of Internet monopolies are currently being debated in Congress: S. 2992, the American Innovation and Choice Online Act; and S. 2710,...

Hertzbleed: A New Side-Channel Attack

June 20 2022 By Bruce Schneier in Cryptography, Security

Hertzbleed is a new side-channel attack that works against a variety of microprocressors. Deducing cryptographic keys by analyzing power consumption has long been an attack, but it’s not generally...

Cryptanalysis of ENCSecurity’s Encryption Implementation

June 13 2022 By Bruce Schneier in cryptanalysis, Cryptography, Security

ENCSecurity markets a file encryption system, and it’s used by SanDisk, Sony, Lexar, and probably others. Despite it using AES as its algorithm, its implementation is flawed in multiple...

He sold cracked passwords for a living – now he’s serving 4 years in prison

May 13 2022 By Paul Ducklin in Cryptography, Cybercrime, Law & order, Security

Crooks don't need a password for every user on your network to break in and wreak havoc. One could be enough...

Java Cryptography Implementation Mistake Allows Digital-Signature Forgeries

April 22 2022 By Bruce Schneier in Cryptography, Security

Interesting implementation mistake:

The vulnerability, which Oracle patched on Tuesday, affects the company’s implementation of the Elliptic Curve Digital Signature Algorithm in Java versions 15 and above....
Read more