cryptography
36 posts tagged cryptography.
-
Never Decrypted: Reading the Row Without Revealing Which Row
Private information retrieval lets a server answer your query without ever learning which row you asked for -- the 1995-to-2026 mechanism and its honest cost.
-
A Valid Proof of a False Thing: How Zero-Knowledge Proofs Actually Break
Zero-knowledge proofs rarely break at the math. They break in the circuit, the trusted setup, and the Fiat-Shamir transcript -- here is exactly how, and why.
-
Never Decrypted: How Fully Homomorphic Encryption Computes on Ciphertext It Cannot Read
Fully homomorphic encryption computes on data it cannot read. Inside: the mechanism, the noise budget that governs it, bootstrapping, and the honest 2026 cost.
-
Never Decrypted: Proving You Ran the Computation Without Revealing It
A prover hands you a few-kilobyte receipt that a program or AI model ran correctly on inputs you never see. How zero-knowledge proofs, zkVMs, and zkML work.
-
No Cipher Fell: How Secure Multiparty Computation Would Break
MPC has no security level, only security relative to an adversary model. How it breaks at the honest-majority line and the selective abort, no cipher touched.
-
The Trusted Party Nobody Has to Be: Secure Multiparty Computation and Threshold Cryptography, Where No One Holds the Secret
Secure multiparty computation and threshold cryptography let distrusting parties compute on private data and sign with a key no single party ever holds.
-
The Anonymity That Actually Holds: What Zcash and Monero Prove, and How Each Proof Breaks
A mechanism-level teardown of on-chain anonymity: how Zcash's zk-SNARK proof and Monero's ring-signature ambiguity work, and the exact break inside each.
-
Q-Day Has Not Happened. The Incident Already Has: Harvest Now, Decrypt Later
No quantum computer can break RSA in 2026, yet long-lived secrets encrypted today may already be lost. Harvest now, decrypt later is a deployment failure.
-
How AES Breaks in Real Life: The Attacks That Never Touched the Cipher
AES-the-cipher has never been broken in the field -- its deployments have. KRACK, repeated GCM nonces, and cache timing broke the wrapper, never the block.
-
How RSA Breaks in Real Life: ROCA, Bleichenbacher's Ghosts, FREAK, and the Keys That Shared a Prime
No one has ever factored a strong, deployed RSA key -- yet ROCA, Bleichenbacher's oracle, DROWN, and FREAK broke real RSA anyway. The break was never the factoring.
-
How the Hash Functions Broke in Real Life: MD5, Flame, SHATTERED, and the Long Death of SHA-1
MD5 and SHA-1 were genuinely, mathematically broken -- yet every real breach still needed a second failure: a deployment still trusting the dead hash.
-
The Log Was Never the Weak Part: How Discrete-Log Cryptography Actually Breaks
For a well-chosen group the discrete log is optimally hard. Every faster break exploits the group's structure, not the log -- only Shor survives a clean one.
-
One Event, Three Assumptions, Five Answers: A Field Guide to the Post-Quantum Toolkit
A field guide to the five NIST post-quantum primitives -- ML-KEM, ML-DSA, SLH-DSA, FN-DSA, HQC: math intuition, exact sizes, failures, and decision rules.
-
The Server Helped, and Never Saw: A Field Guide to Oblivious Pseudorandom Functions
How a server applies its secret key to your secret input without ever seeing it: OPRF, VOPRF, and POPRF (RFC 9497), the engine of OPAQUE and Privacy Pass.
-
The Math Held; The Interface Leaked: A Field Guide to Digital Signatures
ECDLP and RSA held; the nonce, the canonical form, and the verifier broke instead. A field guide to ECDSA, EdDSA, RSA-PSS, determinism, and malleability.
-
One Secret Is Not One Key: The Discipline of Key Derivation with HKDF
A raw DH or ML-KEM shared secret is key material, not a key. How HKDF extract-then-expand, key separation, and the TLS 1.3 key schedule get it right.
-
RSA Is a Trapdoor, Not a Cryptosystem: OAEP, PSS, and the 25-Year Padding-Oracle Lineage
Textbook RSA is a trapdoor, not a cryptosystem. A field guide to OAEP, PSS, PKCS#1 v1.5, and the Bleichenbacher-ROBOT-Marvin padding-oracle lineage, done right.
-
The Fingerprint Two Files Shared: A Field Guide to Cryptographic Hashes
A field guide to cryptographic hashes: the one promise behind SHA-2, SHA-3, and BLAKE3, why MD5 and SHA-1 died, and how to choose one that keeps its promise.
-
No Room for a Nonce: Disk and Length-Preserving Encryption, from XTS to FPE
Why disk and format-preserving ciphers are deterministic, unauthenticated permutations, and how block width and domain size decide XTS, Adiantum, HCTR2, or FF1.
-
The AEAD Decision Matrix: Seven Ciphers, Three Edges, One Choice
AES-GCM, ChaCha20-Poly1305, CCM, OCB3, GCM-SIV, AEGIS, and Ascon, compared by the three sharp edges that decide every deployment: nonce, hardware, commitment.
-
One Number, Used Twice: How a Repeated Nonce Hands Over Your Private Key -- and How Determinism Takes It Back
A repeated ECDSA nonce leaks your private key with grade-school algebra; a reused AES-GCM IV forges ciphertext. Why -- and how determinism fixes both.
-
The Ciphertext Was Unbreakable. The Attacker Rewrote It Anyway: A Field Guide to Block Cipher Modes
Every block cipher mode -- ECB, CBC, CFB, OFB, CTR -- answers only confidentiality, never integrity. A field guide to why, the famous breaks, and the AEAD fix.
-
They Read Your Plaintext Without Breaking Your Cipher: A Field Guide to Padding Oracles
A padding oracle reads your plaintext without touching your key. Why CBC, Vaudenay, Lucky13, and POODLE are one bug -- and why Encrypt-then-MAC ends it.
-
A Perfect Signature for a Certificate That Should Never Have Existed: A Field Guide to X.509 and PKI
How the Web PKI turns a certificate into a trust decision -- path validation, revocation, and Certificate Transparency -- and every famous way that trust broke.
-
The Signature Was Valid. The Message Was Forged: A Field Guide to Serialization and Canonicalization Attacks
Why the bytes you sign matter more than the algorithm: hash length extension, ASN.1/DER forgery, JWT alg confusion, and XML signature wrapping -- and the fix.
-
Predictable or Repeated: The Only Two Ways Cryptographic Randomness Betrays You
Every key, nonce, IV, and salt fails in one of two ways: predictable when it must be unpredictable, or repeated when it must be unique. A field guide.
-
Secure Against Whom? The Security Definitions Every Protocol Designer Needs
A protocol designer's field guide to IND-CPA, IND-CCA2, EUF-CMA, AEAD, and the random oracle model, and why the wrong adversary model sinks real protocols.
-
A Key Is Only as Unguessable as the Dice That Made It: Inside the Windows CSPRNG
Every software secret Windows makes is drawn from one CSPRNG. Trace the entropy, the SP 800-90A CTR_DRBG, ProcessPrng, and where the OS stops rolling the dice.
-
Rotating Every Cipher: SChannel and the Twenty-Year Algorithm-Agility Story of Windows TLS
How one Windows DLL rotated every TLS primitive from RC4 to ML-KEM without breaking IIS, RDP, SQL Server, or .NET SslStream -- and why Vista's 2007 CNG was the inflection point.
-
The Connection That Refused to Downgrade: Twenty-Five Years of SMB Cryptography, Finally Default-On
How SMB 3.1.1 pre-authentication integrity, AES-256-GCM, and SMB-over-QUIC closed a 25-year attack tradition, and which attacks still survive in 2026.
-
CNG Architecture: BCrypt, NCrypt, KSPs, and How Windows Picks Its Algorithms
A guided tour of the Cryptography API: Next Generation -- the two-tier API, the Key Storage Provider model, the FIPS toggle, and how PQC slots in.
-
Direct Anonymous Attestation: The Zero-Knowledge Proof Already in Every TPM
TPM 2.0 names a zero-knowledge group-signature primitive in its spec. A billion chips ship it. Almost nobody verifies it. The story of why DAA won every standardization fight and lost every deployment one.
-
Edge's Two Password Cryptographies: A Beautiful PSI on the Wire, and Plaintext RAM by Design
Microsoft Edge ships a homomorphic-encryption PSI for breach checking and decrypts every saved password into process RAM at launch. Both designs are deliberate. They defend different threat models.
-
Fuzzy Extractors and the One Inequality That Explains Why Windows Hello Doesn't Use One
Fuzzy extractors turn noisy biometrics into stable cryptographic keys. A single 2004 inequality explains why Windows Hello deliberately does not use one.
-
Post-Quantum Cryptography on Windows: The Thirty-Year Migration That Just Arrived
How NIST FIPS 203/204/205 reaches the Windows platform via SymCrypt, CNG, Schannel, and .NET 10 -- the algorithm internals, the wire format, the migration timeline, and the honest accounting.
-
BitLocker on Windows: Architecture, Attacks, and the Limits of Full-Disk Encryption
How BitLocker evolved from an optional enterprise feature to encryption-by-default, its cryptographic architecture, every known attack, and what FDE still cannot protect against.