@djb

They're also getting really testy about us "regular Joes" showing up and voting against publication of the deliberately-weak solo PQ recommendation.

You can practically feel their frustration - "We stuffed this list to pass this vote, and they're stuffing it against us!".

The blatant hypocrisy of the "not standards-track" thing bugged me too when it came through the list.

Anyone who follows me and cares about cryptography or their privacy: read djb's short blurb here:

https://nsa.2026.action.cr.yp.to/

There's action you can take to try to prevent the NSA's attempt to get the world to standardize on deliberately weakened cryptography in TLS - i.e. the thing that protects every important web connection on the planet. They have form for doing this in the past, and are trying again.

There are other links in the above page for more information.

#TLS #HTTP #HTTPS #cryptography #privacy

How did cryptography research start at COSIC? At our mini-symposium on COSIC Origins (1979–1997), Yvo Desmedt, Ingrid Verbauwhede, Bart Preneel, Joan Daemen & Vincent Rijmen shared their first steps and the realities of doing groundbreaking work before the digital era.
#AES #Rijndael #cryptography #KULeuven

Here's a fairly comprehensive list of "classical" pencil and paper hand ciphers if you want to practice or get familiar with any of them:

1. Massive list at ACA: https://www.cryptogram.org/resource-area/cipher-types/

2. Hill cipher: https://en.wikipedia.org/wiki/Hill_cipher

3. Solitaire cipher: https://en.wikipedia.org/wiki/Solitaire_(cipher)

4. Chaocipher: https://en.wikipedia.org/wiki/Chaocipher

5. ElsieFour: https://eprint.iacr.org/2017/339

Not that any should be used in place of modern cryptography, but useful for understanding confusion, difussion, and analysis.

#cryptography

The @w3c Verifiable Credentials #WorkingGroup has published the "Quantum-Resistant Cryptosuites v1.0" specification as First Public Working Draft #FPWD #timetogiveinput

▶️ https://www.w3.org/TR/vc-di-quantum-resistant-1.0/

The document brings post-quantum digital signatures to #VerifiableCredentials and other data payloads, helping organizations prepare for a future where today's elliptic curve #cryptography may no longer be sufficient.
#identity #PostQuantum

Feeback welcome: https://github.com/w3c/vc-di-quantum-resistant/issues

Apps for encryption, comms, Usenet, remailers ...

Ch1ffr3punk: https://github.com/Ch1ffr3punk

The owner is a denizen of the OG #Usenet scene.

#cypherpunk #cryptography #crypto #encryption #privacy #github #freesoftware

@cypherpunk@soc.octade.net @cryptography@soc.octade.net @usenet@soc.octade.net

"End-to-end encryption, in which data is encoded so that only users on either “end” of a conversation can decrypt their communications—and not the server that relays that information or any other interloper—has become the standard for modern privacy on the internet. But its very name suggests a kind of simple pipe with two openings. The metaphor, and often the encryption technology that has enabled that model, doesn't fit neatly onto the world of Slack, Discord, Google Docs, and the other multiuser, complex, collaborative software where people now live and work.

So one group of cryptographers has built what they describe as the foundation for a new generation of end-to-end encrypted apps, with a new metaphor: Instead of a mere pipe, they want to create “spaces” where users can hold group conversations, host information on a server, collectively make changes to it, invite in new collaborators or kick them out, all while maintaining the same strong encryption protections that prevent the server or network eavesdroppers from accessing their data.

That cryptographer team, including contributors from Harvard, Microsoft Research, and former developers of the end-to-end encrypted messenger Signal, today release a “preview” of Encrypted Spaces, an early version of a set of open-source code libraries, which is part of an architecture they've designed to allow anyone to easily build a rigorously end-to-end encrypted app that nonetheless enables all of the complex collaboration features that users demand from software today."

https://www.wired.com/story/signal-alums-release-encrypted-spaces-a-new-system-for-building-private-collaboration-apps/

#Signal #Encryption #Privacy #Cryptography #CollaborativeSoftware #EncryptedSpaces

💥 ❤️ 📣 NEW RELEASE 📣 ❤️ 💥 #Shufflecake v0.6.0 is a *major refactor* with a *TON* of news! Full refactor of the codebase, automated installer, packetization-readiness, DKMS, list of opened volumes, bugfixes... There is really *too much to list*, make sure to check the CHANGELOG. *External contributions are now open again!*

https://codeberg.org/shufflecake/shufflecake-c/releases/tag/v0.6.0

#linux #foss #floss #opensource #libre #cypherpunk #security #cryptography #privacy

Don't use LLM for writing cryptographic code. You have been warned.

#cryptography #AI #LLM

In an E2EE system, how does Alice know what Bob's public key is?

#cryptography

Fun post pointed out by Werner Koch on the GPG "post-quantum defaults" thread:

https://www.metzdowd.com/pipermail/cryptography/2026-March/039449.html

"""
Quantum Cryptography, while intellectually neat, does not present a
practical attack that we need protection against at this time.
Kleptographic Standards on the other hand are very much a practical
attack that we need to protect against at this time.

When a standards body tells you that you should cast aside well-studied
cryptographic algorithms which have earned their trust through dozens of
years of examination, testing, and motivated attackers, for the sake of
protection against Quantum Crypto? The attack you should be protecting
against isn’t Quantum Crypto.
"""

#cryptography #QuantumCryptography #security

As someone with an interest in cryptography and, I guess as an extension, tradecraft (shout out to Minnesota Spy Club), I thought it was interesting that the Irish military intelligence agency (formerly "J2") decided to "decloak" in the Irish Times:

• https://www.irishtimes.com/podcasts/in-the-news/the-spy-service-protecting-ireland-inc/ [podcast]
• https://www.irishtimes.com/ireland/2026/04/04/the-spy-is-the-boring-guy-in-a-suit-inside-the-states-military-intelligence-service/ [interview]

It all seems reasonable enough but I don't know about the whole thing about protecting (among other things) "Irish business interests abroad." And then to tell us that they're working for "Ireland Inc.?" IDK. Not really the kind of public image that inspires confidence.

#Spooks #Cryptography #Tradecraft #Facebook #Meta #RegulatoryCapture #Corporatism

RE: https://mastodon.social/@lobsters/116365296621456308

OK, Cloudflare is following suit to accelerate their timeline to migrate to post-quantum resistant #cryptography

I'm seeing a real y2k-like problem coming towards the industry, organisations and 'the world'. Only difference is, that there's no distinct point in time as it was with y2k.

BTW, while we're at it, might also mention the #y2k38 problem to hit us.

Ain't gonna be stress free to get all ducks in a row.

@countdownY2K38

For all you encryption geeks out there, I just dropped a real-time client-based Double-ROT-13 cipher. Try it out in your browser now!

https://zeyus.neocities.org/dr13

#encryption #cipher #rot13 #cryptography

Alt...

A screenshot from the linked page (https://zeyus.neocities.org/dr13) It shows the text: Double ROT-13 Encryption ROT-13 is a special case of the Caesar cipher which was developed in ancient Rome, and used by Julius Caesar in the 1st century BC [https://en.wikipedia.org/wiki/ROT13] ROT-13 helped Julius Caesar keep his secrets, but in our modern times non-rulers also have access to basic math and sometimes a calculator, making ROT-13 a little less secure. So, why not make it twice as strong by using a Double ROT-13 algorithm! Try it out for yourself below: [TEXT INPUT WITH VALUE: "Top Secret Code"] ROT13: Gbc Frperg Pbqr Double ROT13: Top Secret Code

The Cryptographic Zombie: How Keybase Went from Privacy Darling to Zoom’s Cleanup Crew

Once the ultimate geek flex for cypherpunks, Keybase promised to make PGP cryptography accessible to mere mortals. Today, it hovers in the digital ether as a "zombie" app. Here is the story of how a revolutionary open-sour

https://schulz.dk/2026/04/06/the-cryptographic-zombie-how-keybase-went-from-privacy-darling-to-zooms-cleanup-crew/

#Misc #Privacy #Security #cryptography #nostalgia #security

A very nice explanation on why #cryptography of one-time pad as used by the famous spy “number stations” still has some advantages over the modern digital methods

https://www.abc.net.au/listen/programs/sundayextra/numbers-stations/106479364

#DOI https://doi.org/10.5281/zenodo.18448042

A pangram is a sentence or phrase that contains each letter of an alphabet or character set at least once. A perfect pangram is an anagram of the alphabet which contains each letter exactly once.

Pangram hash generates a perfect pangram hash digest consisting of a anagram permutation of a character set. Each character in the output is unique and non-repeating.

#Hashing #Cryptography #Anagrams #Papers #Preprints

- a neat hack for the properly paranoid -

Your computer is likely generating random noise on your sound card. On some systems you can harvest this noise as true random entropy. This entropy can be diffused and whitened for use in cryptography.

https://www.metzdowd.com/pipermail/cryptography/2026-March/039388.html

#Random #Entropy #Cryptography #Crypto #Hardware #Hacks #Sound #Audio #Chaos

@cypherpunk@soc.octade.net @cryptography@soc.octade.net @crypto@infosec.pub @cryptography@fed.dyne.org @cryptography@lemmy.ml

Alt...

Source code screenshot for harvesting entropy from a sound card. Follow the link to read the source code text.

https://soc.octade.net/cypherpunk/

A fediverse group for discussing topics and tools related to #cypherpunks.

#groups #fedigroups #fediverse #retro #cypherpunk #crypto #cryptography #encryption

@cryptography@soc.octade.net @cypherpunk@soc.octade.net

Alt...

Glowing green-lined skull on black background with digital circuit board lines and one eye a glowing bitcoin symbol and the other eye a glowing hashtag with the tagline 'CYPHERPUNK REVOLT'.

Al Gore Invented the Internet.
Joe Biden invented PGP encryption.
Cypherpunks write code.

Joe Biden gifted humanity with PGP encryption (in a roundabout way). Phil Zimmermann created PGP in response to a anti-privacy bill clause proposed by Senator Joe Biden.

https://www.americanscientist.org/article/cypherpunks-write-code

"In 1990, the FBI launched an over-the-top crackdown on computer hackers, known as Operation Sundevil. This was swiftly followed, in early 1991, by a proposed piece of U.S. Senate legislation that would force electronic communications service providers to hand over people’s personal data. (The key clause, S.266, was pushed by the then chairman of the U.S. Senate Judiciary Committee, Senator Joe Biden.)"

"On learning of Biden’s S.266 clause, Zimmermann feverishly set out to complete the project, almost losing his house in the process. When he finished his software in 1991, he published it all online, free for anyone who wanted to use it. He called it “Pretty Good Privacy,” or PGP for short, and within weeks it had been downloaded and shared by thousands of people around the world. “Before PGP, there was no way for two ordinary people to communicate over long distances without the risk of interception,” said Zimmermann in a later interview. “Not by phone, not by FedEx, not by fax.” It remains the most widely used form of email encryption to this day."

https://www.congress.gov/bill/102nd-congress/senate-bill/266

"SEC. 2201. COOPERATION OF TELECOMMUNICATIONS PROVIDERS WITH LAW ENFORCEMENT. It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law."

#Biden #JoeBiden #PGP #Cypherpunks #Cypherpunk #PhilZimmermann #Privacy #Cybersecurity #Cryptography #GPG #Email #Senate #Law #Government #Panopticon #Hackers #Hacking #Security #Encryption

Cryptography as a tool of power
https://negativepid.blog/cryptography-as-a-tool-of-power/

#cryptography #history #IT #tech #privacy #Internet #tech #IT #science #STEM #computing #AI #quantumComputing #quantumPhysics #inventions #innovation #negativepid

#DOI https://doi.org/10.5281/zenodo.18448042

A pangram is a sentence or phrase that contains each letter of an alphabet or character set at least once. A perfect pangram is an anagram of the alphabet which contains each letter exactly once.

Pangram hash generates a perfect pangram hash digest consisting of a anagram permutation of a character set. Each character in the output is unique and non-repeating.

#Hashing #Cryptography #Anagrams #Papers #Preprints

@cryptography@soc.octade.net @crypto@infosec.pub @cryptography@fed.dyne.org

I see some people still using ancient PGP keys. GnuPG offers Linux repositories for updating to the latest versions of GnuPG with new expert features for key generation. Recent versions support both Kyber1024 and Goldilocks448 keys (and more).

Once installed run: :~$ gpg --full-generate-key --expert

New GnuPG Repositories for Debian, Ubuntu, and Devuan: Stable and Development Branches Available

https://www.gnupg.org/blog/20250827-new-repository.html

#PGP #GPG #PQC #GnuPG #Encryption #Cryptography #Privacy #Signatures #Kyber #Goldilocks #ED448 #Keys #PublicKey

"Despite advancements in secure messaging, PGP (Pretty Good Privacy) encryption—developed in the 1990s—remains a gold standard for privacy. Unlike modern apps reliant on centralized servers or phone numbers, PGP ensures end-to-end encryption without third-party dependencies. This article explores PGP’s enduring relevance, key management best practices, and how it compares to contemporary solutions like Signal."

#PGP #GPG #Encryption #Messaging #Cryptography

Not in The Prophecies: Practical Attacks on Nostr

https://eprint.iacr.org/2025/1459

#NOSTR #cryptography #social

[for your address book]

https://soc.octade.net/cryptography/

A Fediverse group for sharing and discussing #ciphers, #codes #cryptography and #encryption and related applications and #research.

#crypto #cypher #cypherpunks #confidentiality #privacy #groups #fedigroups #fediverse

Alt...

Artistic image of a sheet of paper with binary ones and zeroes and a reddish padlock in the upper right-hand corner..

Hexlish Alphabet for English, Constructed Languages and Cryptography: Automatic, Structural Compression with a Phonetic Hexadecimal Alphabet

DOI : https://doi.org/10.5281/zenodo.13139469

Hexlish is a legible, sixteen-letter alphabet for writing the English language and for encoding text as legible base 16 or compressed binary. Texts composed using the alphabet are automatically compressed by exactly fifty percent when converted from Hexlish characters into binary characters. Although technically lossy, this syntactic compression enables recovery of the correct English letters via syntactic reconstruction. The implementer can predict the size of the compressed binary file and the size of the text that will result from decompression. Generally it is intuitive to recognize English alphabet analogues to Hexlish words. This makes Hexlish a legible alternative to the standard hexadecimal alphabet.

#Hexlish #Conlang #Alphabets #English #Hexadecimal #Encoding #Cryptography #Ciphers #Crypto #Encryption #Compression #Papers #Preprints #Orthography #Language #Linguistics #Writing #Glyphs #Alphabetology #Technology

Alt...

Hexlish Alphabet logo. The word HEXLISH in rainbow colors on a black background with a hexagonal dot above the letter I. Beneat the logo in yellow reads the phrase, "English Text Compression & Encoding."

Building secure peer-to-peer messaging apps is tough, and it's even tougher to get people to switch from what they already use. I've noticed that a great user interface and an intuitive design often matter more to people than terms like cryptography or end-to-end encryption.

That's why I've started building a UI library to tackle this head-on! It's a work in progress, but the goal is to create a more welcoming and seamless experience for new users.

Check out the UI library here: https://ui.positive-intentions.com

And you can see a live demo of the UI in action here: https://glitr.positive-intentions.com

I'd love to hear your thoughts and feedback as I continue to shape it!

#PeerToPeer #SecureMessaging #P2P #UIUX #WebDevelopment #MaterialUI #ModuleFederation #DesignSystem #Cryptography #UI

Why on earth was the #ActivityPub protocol even let out the door without a well-specified and mandatory graceful, non-destructive key rotation scheme?

Yes I know the privacy issues. Those are not valid reasons to not have such a mechanism; it's a valid reason to not enable or use one.

What we're stuck with now is a ton of instances with absurdly long, legacy-algorithm keys (RSA-4096) with no way to replace them with shorter/better keys without effectively losing everything ever posted on the instance.

The protocol is only 7 years old! EC crypto was well-established at the time, and should have been the default.

And what happens once everyone has to replace the keys, because RSA is broken by quantum computers (I know, probably 100 years to go)? The #Fediverse will be a wasteland, with no instances trusting anything from any other instance, so all #Federation breaks down.

Sorry if I got some details wrong about what the protocol says. If I get flamed to death for being wrong, then I'll consider that a Good Thing(TM). I've been trying to find a way to rotate/replace keys for a while and all my searching turns up is either 1) confirmation that most people don't know or care about cryptography, or 2) https://socialhub.activitypub.rocks/t/key-rotation-notification/562 - which really isn't helpful.

If it is possible to gracefully rotate the key(s) of an instance/user, there really has to exist some documentation that explains clearly how to implement this in a server and how to exercise it as a server operator.

#Cryptography #Rant #Mastodon

NEWSCARD Publish and fetch permanent named records via Network News

Newscard creates a decentralized, encrypted, named record paste bin.

[git repo] https://codeberg.org/OCTADE/newscard (use most recent version only)

With a single command, name the card, snarf the file and encrypt it.

With another command, push the encrypted file to the public network.

With another short command, snarf a file from the network.

Only users knowing the name [key] of the record will be able to decrypt it.

If a strong passphrase is used to name the file, it will be very secure.

This is useful for quickly snarfing, encrypting, and publishing a text file:

$~: card enc [passphrase] [file]
$~: card put [passphrase]

It is useful for retrieving a text file with just a key:

$~: card get [passphrase]
$~: card show [passphrase]

If and when you want the general public to access the record just share the keyword.

Newscard uses nine (9) (NINE) layers of encryption with OpenSSL chacha20 cipher.

Newscard generates 9 each of: cipher keys, salts, key iteration parameters.

It would be nice if something like this were added to the ActivityPub protocol, such that keyword[@]host.url would do the same thing. Then secret text records could be stored securely for later retrieval or revelation.

#NewsCard #Pastebin #Usenet #NNTP #NetworkNews #Encryption #Cryptography #Messaging #Anonymity #Protocols #OpenSource #FreeSoftware #BlackHackJack #Censorship #Retro #InfoSec #Ciphers #Codes #FOSS

@infostorm@a.gup.pe @crypto@a.gup.pe @infosec@a.gup.pe @selfhosting@a.gup.pe

Alt...

Playing card of the Jack of Clubs. The Jack is a moustached man in a black top hat and suit in a oval center cameo. The colors are inverted so that everything on the face is black except the lines which are white, like a charcoal cutout picture., giving it a retro digital appearance mixed with retro handicraft vibes.

phunnee!

https://github.com/706f6c6c7578/minicrypt

#cryptography

So, hear me out:

If instead of the current Hash+Salt based modality of password management, and given the relative lack of quantum complexity in how that all works for authentication, I have a proposition.

For any given password length N, N! hashes are taken for the password such that any substring starting with the first character and any arbitrary following sequential characters (D) to the length of the string (c0->cD) where D < N. This would require a quantum actor to deal with an element quantum mechanics is explicitly bad at dealing with: Certainty.

Instead of relying on the relatively low quantum complexity of the hashes, we extrapolate into another dimension and create an ordering of hashes that becomes a tangible certainty. Instead of having to find all of the hashes in a field (Low quantum complexity, High computational complexity), the operator must find a specific order from those hashes in the field (Extremely high quantum complexity, Moderate computational complexity).

It would also reduce the urgency of collision discoveries in hashing algorithms too.

Just a thought.

#cryptography #cybersecurity #informationsecurity #passwords #hashingalgorithms #hash #notThatKindofHash

NEWSCARD Publish and fetch permanent named records via Network News

Newscard creates a decentralized, encrypted, named record paste bin.

[git repo] https://codeberg.org/OCTADE/newscard (use most recent version only)

With a single command, name the card, snarf the file and encrypt it.

With another command, push the encrypted file to the public network.

With another short command, snarf a file from the network.

Only users knowing the name [key] of the record will be able to decrypt it.

If a strong passphrase is used to name the file, it will be very secure.

This is useful for quickly snarfing, encrypting, and publishing a text file:

$~: card enc [passphrase] [file]
$~: card put [passphrase]

It is useful for retrieving a text file with just a key:

$~: card get [passphrase]
$~: card show [passphrase]

If and when you want the general public to access the record just share the keyword.

Newscard uses nine (9) (NINE) layers of encryption with OpenSSL chacha20 cipher.

Newscard generates 9 each of: cipher keys, salts, key iteration parameters.

It would be nice if something like this were added to the ActivityPub protocol, such that keyword[@]host.url would do the same thing. Then secret text records could be stored securely for later retrieval or revelation.

#NewsCard #Pastebin #Usenet #NNTP #NetworkNews #Encryption #Cryptography #Messaging #Anonymity #Protocols #OpenSource #FreeSoftware #BlackHackJack #Censorship #Retro #InfoSec #Ciphers #Codes #FOSS

@infostorm@a.gup.pe @crypto@a.gup.pe @infosec@a.gup.pe

Alt...

Playing card of the Jack of Clubs. The Jack is a moustached man in a black top hat and suit in a oval center cameo. The colors are inverted so that everything on the face is black except the lines which are white, like a charcoal cutout picture., giving it a retro digital appearance mixed with retro handicraft vibes.

NEWSCARD Publish and fetch permanent named records via Network News

Newscard creates a decentralized, encrypted, named record paste bin.

[git repo] https://codeberg.org/OCTADE/newscard (use most recent version only)

With a single command, name the card, snarf the file and encrypt it.

With another command, push the encrypted file to the public network.

With another short command, snarf a file from the network.

Only users knowing the name [key] of the record will be able to decrypt it.

If a strong passphrase is used to name the file, it will be very secure.

This is useful for quickly snarfing, encrypting, and publishing a text file:

$~: card enc [passphrase] [file]
$~: card put [passphrase]

It is useful for retrieving a text file with just a key:

$~: card get [passphrase]
$~: card show [passphrase]

If and when you want the general public to access the record just share the keyword.

Newscard uses nine (9) (NINE) layers of encryption with OpenSSL chacha20 cipher.

Newscard generates 9 each of: cipher keys, salts, key iteration parameters.

It would be nice if something like this were added to the ActivityPub protocol, such that keyword[@]host.url would do the same thing. Then secret text records could be stored securely for later retrieval or revelation.

#NewsCard #Pastebin #Usenet #NNTP #NetworkNews #Encryption #Cryptography #Messaging #Anonymity #Protocols #OpenSource #FreeSoftware #BlackHackJack #Censorship #Retro #InfoSec #Ciphers #Codes #FOSS

@infostorm@a.gup.pe @usenet@lemmy.world @crypto@a.gup.pe @infosec@a.gup.pe

Alt...

Playing card of the Jack of Clubs. The Jack is a moustached man in a black top hat and suit in a oval center cameo. The colors are inverted so that everything on the face is black except the lines which are white, like a charcoal cutout picture., giving it a retro digital appearance mixed with retro handicraft vibes.