soc.octade.net is a Fediverse instance that uses the ActivityPub protocol. In other words, users at this host can communicate with people that use software like Mastodon, Pleroma, Friendica, etc. all around the world.
This server runs the snac software and there is no automatic sign-up process.
Syfer Sangraal : Holy Grail of Cryptography in the Arc of the Combinant
https://doi.org/10.5281/zenodo.22158384
Embark on the quest for the Syfer Sangraal system, or the holy grail of cryptography hidden in the arc of the combinant. The Holy Grail of Cryptography is a single, simple algorithm that performs all necessary functions of computational cryptography with provable security sans assumptions in the model. One system to roll them all is the holy grail of cryptography. One algorithm to perform every kind of cryptographic function is the new wine within the Syfer Sangraal system.
#cryptography #cryptology #ciphers #holygrail #SyferSangraal #preprint
This is currently the root of a big argument in #cryptography circles --- is it okay to use floating-point arithmetic? If not, what should be the alternative? @pqshield https://pqshield.com/falcon-without-floating-point/
I had a dream that there was some major cryptography issue with TLS, and the PoC was a Pokémon Red TAS that ran arbitrary code to start a battle with Tigger (the Winnie the Pooh character) who would then crack your TLS keys using a Z80 implementation of the algorithm. And it was called "the Tigger Attack" and several other cryptosystems were found to be "Tiggerable" over the next few weeks.
[demo] https://files.octade.net/
I drafted a prototype for a PHP server application that automatically hashes and signs files and presents visitors with verification archives containing digital signatures for offline verification. The site allows readers to view, download, hash, and verify signatures of files. Since I occasionally like to publish puzzles and bits of cryptology, I just had to make this to scratch the old itch.
The neat thing about this design is that the current version has zero JavaScript. It uses CSS3 hacks with anchors and URL probing to emulate JavaScript and AJAX functionalities for modal dialogs to present server-side JSON data as HTML text.
When I upload files or documents to the server, the interface automatically presents them to the user in a grid. So now all I have to do is upload files and documents and the server generates the site.
The reader can then click buttons to hash, sign, view, verify, and download files.
GnuPG and OpenSSL Signatures are generated automatically on user demand. The site visitors can download these signatures and the public keys to verify files.
What should I add / change in the application and its interface?
What accessibility components might be warranted?
Should the application parse and present EXIF data, or is that too much?
#PHP #CSS3 #HTML5 #WebDesign #UX #cryptology #cryptography #crypto #signatures #OpenSSL #GnuPG #GPG #PGP #encryption #papers #preprints #documents #SelfHosted #WebLord #WebMaster #WebSerf #NoJS #Apache #CyberSecurity
GAAS - Git as a Storage
Im sure im not the first consider this approach, but i would like to share a demo for clarity and transparancy. No need to debug, its far from finished and there is much to do.
Im working on a P2P messaging app and generally up until recently i thought in such a system, if a peer is offline, you cant send a message... It wouldnt be "decentralized" if there was some central queue of messages.
It took embarassingly long, but then it hit me... git... just regular git is a decentralized database. Github/Forgejo isnt decentralized, but git can have multiple remotes that can act as redundencies.
In my setup i need the ability for others to be abe to read and only i should be able to write to it. That functionality is out-of-the-box in git.
Git is also pretty standardized so there are many providers if users want to move away from Github.
The storage requirements for my project are fairly small. Typically small text messages. The data itself thats publicly readable would be encrypted (aiming to keep aligned to Kerkhoffs principles).
Code: https://github.com/positive-intentions/git
Demo: https://positive-intentions.github.io/git/demo/gui/git/storage
There is much more to improve and consider there for things like encrypting the data at rest.
I have concerns around if providers like GitHub, Codeberg and Gitlab might see the way my app works as fundamentally violating their terms-of-service. I'll have to consider providing a backend service for this which I've generally tried to avoid.
IMPORTANT DISCLAIMER: This is open source for transparency, testing and demo purposes only. it is still a work in progress and far from finished. You should not use it on any sensitive repositories. There WILL BE breaking changes. Use responsibly.
#Git #Decentralized #OpenSource #Cryptography #Privacy #SoftwareArchitecture #DistributedSystems
Trezor Says ShipMonk Breach Exposed 13,689 Customers
https://www.cyberkendra.com/2026/08/trezor-says-shipmonk-breach-exposed.html
#Trezor #Crypto #cryptography #hacked #databreach
Built Privamorph: a self-hosted app that encrypts data client-side (Microsoft SEAL, BFV/CKKS) — the server only ever sees ciphertexts + public keys.
Opening a live test instance before 1.0. The write-up is the threat model + where it honestly breaks (I pentested my own build first).
Come break it 🧪
📝 https://gist.github.com/WCIS-JMI/635361d3d5c589307b40ea4d4c4f550d
🎯 https://test.wcis.fr (dummy data)
🔒 reports: https://vdp.wcis.fr
Black-box, coordinated disclosure. #infosec #appsec #cryptography
Looks like lattice based cryptography gets to survive another day:
https://eprint.iacr.org/2026/1693
The authors credit ChatGPT with generalizing their main theorem and with producing a lean formalization, which is also pretty neat.
After that, we saw Sawa & Suzaki's "Analysis of Encryption Key Zeroization from System-wide Perspective" expose lingering #AES keys in memory via FPGA-based live forensics. (https://www.acsac.org/2025/program/final/s491.html) 3/5
#Cryptography #OSSecurity #MemoryForensics
Meet KEMchatka: an experimental, serverless P2P terminal chat over Tor hidden services.
No accounts, no port forwarding, zero disk logging.
Features hybrid post-quantum encryption: X25519 + ML-KEM-1024 (FIPS 203) combined via HKDF-SHA512 to defeat "harvest now, decrypt later" attacks. Simple out-of-band setup.
When privacy is under threat, build tools that protect it.
https://github.com/bashcore/kemchatka
#PostQuantum #Tor #Python #CyberSecurity #Privacy #OpenSource #Cryptography
I was listening to The Rest is Classified podcast about #Turing and Bletchley Park and I wondered why the machine was called a bombe. So I found the origin in the Polish "bomba" but still no explanation of what the word means or why the Polish had used it for their earlier machine. Bomba just means bomb. Apparently the U.S. Army had claimed that when a solution was found, a part of the machine would come free and fall to the bottom of the case, making a loud noise, but this story was false. So I don't know why this word made sense for a cryptographic machine. #cryptography
Yomiuri and Asahi gain cryptographic IDs as fake clones of their sites spread: Dentsu is signing its own Japanese ad buys with the same credential, and OP-CIP wants 50 organizations running it by early 2027. Will browser makers follow? https://ppc.land/yomiuri-and-asahi-gain-cryptographic-ids-as-fake-clones-of-their-sites-spread/ #Cryptography #DigitalSecurity #AdTech #BrowserSafety #WebAuthenticity
Unpatched #HP #ThinPro flaw allows bypass of disk #encryption protections
https://cyberinsider.com/unpatched-hp-thinpro-flaw-allows-bypass-of-disk-encryption-protections/
We're a day-one auditor for Signal's new Automatic Key Verification, which lets your Signal app confirm it got your contact's real key.
The feature only holds if everyone sees the same key directory. As an external auditor, we check the directory everyone gets against our own.
We built our auditing software from scratch, open-sourced it, and run it as a public good. Github link in the blog.
Do mini PCIe hardware security modules or standalone cryptographically strong pRNGs exist? If they do, where can I get one? NetBSD is complaining about low entropy (laptop from 2011) & suggests I keysmash, use an entropy file, or get a USB pRNG. I would prefer to have all of my USB ports free.
I have no idea where to find such a thing & I can't even find USB HSMs besides the one that YubiCo sells. The closest thing I have found is a bunch of TPM2 chips with SPI headers on them & I don't think I have any free SPI connectors in the laptop. For now I'll use an entropy file but I would rather do something better like using a proper RNG device.
I think people watching these tags might know more than I can find with a search engine. Thank you.
A new paper by Daniel Simon might indicate lattice based crypto (#MLKEM etc) breaks with quantum computers
A malicious host can attack your AWS Nitro Enclave through its connection to KMS.
It can't see inside the enclave, but it can swap encrypted data keys in storage, feed the enclave arbitrary plaintext, force the wrong CMK, replay attestations, and more. We wrote down the fixes in the blog: https://blog.trailofbits.com/2026/08/05/a-few-notes-on-aws-nitro-enclaves-kms-integration/
Did they think the human cryptographers were doing research BY HAND!?!
AI is just a better tool for some things, folks. There are reams of Python libraries designed to assist in cryptography research. This is just the next tool in the belt.
#Anthropic #AI Model Finds Flaws in Tough-to-Crack #Encryption Algorithms
https://www.nytimes.com/2026/07/28/us/politics/anthropic-ai-encryption-security-aes.html
Decentralized browser-based P2P E2EE messaging.
The key detail that sets this apart from other messaging apps is the browser-based client-side cryptography philosophy.
No need to install anything. Your ID is crypto-random and so the app doesnt need to rely on any central registration system like phone numbers. Your ID is unguessable and to connect to someone, you have to explicitly share it.
WebRTC has other nuances like being to route through a shared network for secure/faster transfer.
I hope this project has reached a level i can share the following details. I've made a genuine effort towards documentation and transparancy. I dont think it'll ever be enough and so im still concerned it isnt ready to share. While im using AI throughout. This is not a vibecoded project. There is attention throughout for unit tests and formal-verification. With your feedback, id like to make improvements for clarity throughout.
This version of the app demonstrates a fairly unique approach using a browser-based, local-only and webrtc approach. I know it's impossible for any system to be the "world's most secure", but that isnt a reason to not try. By rigorously implementing an exhaustive list of security features and practices, the aim is to get as close as possible.
* [Enkrypted.Chat](https://enkrypted.chat/)
This is intended to demonstrate client-side managed secure cryptography.
* [Introducing Enkrypted Chat](https://positive-intentions.com/blog/introducing-enkrypted-chat)
* [Whitepaper (work-in-progress)](https://positive-intentions.com/docs/technical/whitepaper/complete-whitepaper)
* [Protocol Spec (work-in-progress)](https://positive-intentions.com/docs/technical/whitepaper/complete-protocol-spec)
* [Roadmap](https://positive-intentions.com/docs/technical/p2p-messaging-technical-breakdown/)
I know ive tried to compress a lot of my journey into one post. The project above is going to be tricky to understand. Feel free to reach out for clarity on any of the details.
IMPORTANT: While this is aiming to provide a secure experience, It is [not audited or reviewed](https://www.reddit.com/r/CyberSecurityAdvice/comments/1su8lir/security_audit_feedback_from_radically_open/). **Shared for testing, feedback and demo purposes only.** Please use responsibly.
#Privacy #OnlinePrivacy #DataPrivacy #Infosec #CyberSecurity #OpSec #DigitalRights #AntiSurveillance #DataOwnership #E2EE #P2P #PeerToPeer #WebRTC #LocalFirst #LocalOnly #NoCloud #NoRegistration #PWA #SignalProtocol #PostQuantum #Cryptography #SecureMessaging #PrivateChat #EncryptedChat #Decentralized #OpenSource #SelfHosted #BetaTesting #FeedbackWelcome #TechDemo #ProofOfConcept #BuildInPublic #IndieDev #DevCommunity
boostedIf you were wondering about Anthropic's announcement about breaking potential cryptographic systems and worried about it, @matthew_d_green has an excellent article with analysis that should lay your fears at rest. At least for now.
Some thoughts about Anthropic’s new cryptanalysis results
https://blog.cryptographyengineering.com/2026/07/29/some-notes-about-anthropics-new-results/
@cryptography it would be a great idea to use #aes 256 for the #encryption for this task, but the problem is that aes (even in a secure authentication mode such as #gcm ) is static. this would revive the static problem. sure, more secure than the current key generation setup, but it's still static. and that means the NVDARemote server still has to have the key in order to work correctly.
any compromise of the NVDARemote server itself means that your key will be exposed. forget the compromise vector, even a rogue server administrator (something a cupple of NVDARemote servers are known for doing) can see the static key, hence why i want to use #public #key #cryptography for this project.
@cryptography of course, it could also use #pqc post #quantum #cryptography to generate the #keypare , like ml-kem , dilithium, etc.
i would need to look more into how this would work with not just #nvda , but generally computers. i do know some manufacturers are starting to come with quantum cryptographic chips, like the sealsq chips but other than that, software can handle it too i guess. i'd have to look at microsofts crypto stack and see if i can make something work on that front, that is, if i even can do that...
at some point, i'd love to work on an implementation of the #screenreader of NVDA #nvda #remote / #nvdaremote where rather than using a 6-digit key that can be guessed, it uses #asymmetric #cryptography that genrates #encryption #keys using an algorithm like #rsa / #ecc (eliptic curve cryptography) in order to secure the connections. how it would work is you setup your connection. then, you'll get an encryption key for your session unique to that session. then, you give the user of the computer you want to control or who you want to control your computer the key. once both sides disconnect, the key automatically / automagically expires. it would be like a public / private keypare, where the key is stored on the server terminating the remote session (E.G. nv.seedy.cc, poweredge-r720.featherback-firefighter.ts.net) while the private key is stored on the machines connected to it. and optionally, a passfraze for the key to protect access even if that person has the key, sourt of like how #ssh public/private keypares work.
@cryptography
Rhizome Function Anagram Random Generator
preprint | https://zenodo.org/records/21551292
doi | https://orcid.org/0009-0009-5144-3278
Herein are described principles and a scheme of random number generation styled as, pangrandomonium, or ‘pangrand’. Pangrand is a anagrammatic random number generator that uses rhizome functions as chaotic indexing and shuffling instructions to reorder and sum perfect pangrams. Brief descriptions are given for the principles of pangram summing and rhizome indexing functions, Source code of the random number generator is included herewith. The source code is attached to the PDF file.
Sections:
1. Pangrams (Holoalphabetic arrays) ;
2. Rhizome Functions ;
3. Rhizome Hardness Problems ;
4. Random Generator Methods ;
5. Errata ;
6. Source Code.
#Preprints #Random #Cryptography #RNG #Pangrams #Anagrams #Pascal #Papers #RhizomeFunction #AcademicMastodon #Cryptology #Math #NumberTheory #Papers #Academia #ComputerScience #CompSci #AcademicChatter #OpenScience
WEBINAR 28 JUL 15:00 UTC - INTC - Transitioning to Quantum-Safe cryptography
Third talk in the INTC Quantum Series: an overview of the post-quantum encryption and digital signature primitives standardized by NIST, the algorithms still in the pipeline, and the challenges of migrating more complex protocols to quantum-safe. With Dr. Vadim Lyubashevsky, Principal Research Scientist, IBM Research Zurich.
— Hal Finney (Protecting privacy with electronic cash, 1993)
Rhizome Function Anagram Random Generator
preprint | https://zenodo.org/records/21551292
doi | https://orcid.org/0009-0009-5144-3278
Herein are described principles and a scheme of random number generation styled as, pangrandomonium, or ‘pangrand’. Pangrand is a anagrammatic random number generator that uses rhizome functions as chaotic indexing and shuffling instructions to reorder and sum perfect pangrams. Brief descriptions are given for the principles of pangram summing and rhizome indexing functions, Source code of the random number generator is included herewith. The source code is attached to the PDF file.
Sections:
1. Pangrams (Holoalphabetic arrays) ;
2. Rhizome Functions ;
3. Rhizome Hardness Problems ;
4. Random Generator Methods ;
5. Errata ;
6. Source Code.
#Preprints #Random #Cryptography #RNG #Pangrams #Anagrams #Pascal #Papers #RhizomeFunction
@cryptography@soc.octade.net
@cypherpunk@soc.octade.net
@papers@soc.octade.net
@crypto@infosec.pub
@cryptography@fed.dyne.org
@cryptography@lemmy.ml
This finally got me to go try to understand Merlin-Arthur proofs, which are an important tool in public-key #cryptography (The first trick is to remember the difference between Merlin-Arthur and Arthur-Merlin!) @QuantaMagazine
https://www.quantamagazine.org/researchers-reveal-the-power-of-quantum-proofs-20260706/
“You go to war with the algorithms you have, not the ones you wish you had.” — Eric Rescorla
https://blog.cloudflare.com/ml-dsa-will-have-to-do/ #PQC #cryptography
Shufflecake talk at CAW 2026 last May - video now available online!
https://clip.place/w/d7Anz5jbsMCZo1HBg8JkES
https://www.youtube.com/watch?v=21LjKFBIwwY
#shufflecake #caw #eurocrypt #eurocrypt2026 #cryptography #crypto #truecrypt #veracrypt #security #Privacy #infosec #hacktivism #censorship
We have better #security and #performance standards than most online banking sites, offering #0-RTT + #QUIC + #Post-Quantum #Cryptography. #tls #ssl #mastodon #instance
Good summary of where we are on signatures using post-quantum #cryptography from @cloudflare . Not sure the wish list is realistic --- I think we're probably still going to have to choose from a selection much like what's listed here! https://blog.cloudflare.com/ml-dsa-will-have-to-do/
Happy Birthday Adi Shamir! Shamir received the 2002 #ACMTuringAward w/ Leonard Adleman and Ron Rivest for making public-key #cryptography useful in practice. Their method is still used in almost all internet-based commercial transactions: https://amturing.acm.org/award_winners/shamir_2327856.cfm
I'd like to share the latest version of my project.
It's a a decentralised P2P messaging app. The aim is of course privacy and security.
It demonstrates a fairly unique approach by using browser-based local-only storage with webrtc.
https://www.reddit.com/r/positive_intentions/comments/1tq1u62/introducing_enkrypted_chat
---
#Privacy #OnlinePrivacy #DataPrivacy #Infosec #CyberSecurity #OpSec #DigitalRights #AntiSurveillance #DataOwnership #E2EE #P2P #PeerToPeer #WebRTC #LocalFirst #LocalOnly #NoCloud #NoRegistration #PWA #SignalProtocol #PostQuantum #Cryptography #SecureMessaging #PrivateChat #EncryptedChat #Decentralized #OpenSource #SelfHosted #BetaTesting #FeedbackWelcome #TechDemo #ProofOfConcept #BuildInPublic #IndieDev #DevCommunity
Forward, and don’t forget! A Cypherpunk’s manifesto
In 1993, a mathematician named Eric Hughes sat down and wrote a declaration of his own.
It was not about a king. It was about privacy, and the machines that were quietly ending it. He called it A Cypherpunk's Manifesto. The core idea was simple and radical: if you want privacy in a digital world, no one is going to grant it to you. You have to build it yourself.
His most famous line is three words long. "Cypherpunks write code." Not petition. Not protest. Not wait for permission. Build the thing that makes the freedom real, then give it away so no one can take it back.
Fifteen years later, Satoshi did exactly that. Bitcoin was not a demand that governments fix the money. It was working code that fixed it, released into the open where no one could recall it.
Here is the lesson that outlived the manifesto. Rights you have to ask for can be revoked. Rights you build into running code are yours to keep.
Independence was never granted. It gets written. Sometimes in ink, sometimes in software.
via https://primal.net/e/nevent1qqs8w3e4lsu8llpfkmsu5ey0kpye9lfn8t4d0pl80v7au48aaf4e78glyhzc3
--------Manifesto here-------->>>>>
https://word.undead-network.de/2026/07/06/forward-and-dont-forget-a-cypherpunks-manifesto/
#anon #anonymous #Cryptography #Cypherpunk #EricHughes #FOSS #freedom #manifesto #oss #resits
The NSA supports publishing a standards RFC (while claiming it is not a standard) that would result in the widespread deployment of less-safe cryptography [1] for TLS/HTTPS.
What a shocker.
https://mailarchive.ietf.org/arch/msg/tls/7suuAUuE_nNC1HXGKrIaMtPCrm4
[1] They are pushing, hard, for a standards document that serves, effectively, as a recommendation for the use of the new ML-KEM "post-quantum" cryptography primitive by itself, rather than the more secure ECCDH *plus* ML-KEM which provides the ECC backstop (currently used almost universally) if the ML-KEM implementation is found to contain bugs or if the algorithm itself is found to have weaknesses not known at the present moment. Keep in mind that such weaknesses have regularly been found in algorithms 10, 20 *years* after widespread deployment, and bugs are far from unknown.
They're also getting really testy about us "regular Joes" showing up and voting against publication of the deliberately-weak solo PQ recommendation.
You can practically feel their frustration - "We stuffed this list to pass this vote, and they're stuffing it against us!".
The blatant hypocrisy of the "not standards-track" thing bugged me too when it came through the list.
Anyone who follows me and cares about cryptography or their privacy: read djb's short blurb here:
https://nsa.2026.action.cr.yp.to/
There's action you can take to try to prevent the NSA's attempt to get the world to standardize on deliberately weakened cryptography in TLS - i.e. the thing that protects every important web connection on the planet. They have form for doing this in the past, and are trying again.
There are other links in the above page for more information.
How did cryptography research start at COSIC? At our mini-symposium on COSIC Origins (1979–1997), Yvo Desmedt, Ingrid Verbauwhede, Bart Preneel, Joan Daemen & Vincent Rijmen shared their first steps and the realities of doing groundbreaking work before the digital era.
#AES #Rijndael #cryptography #KULeuven
Alan #Turing Was World War II’s Greatest Codebreaker. His Private Papers Reveal A Secret Project.
https://www.popularmechanics.com/science/a71535854/turing-speech-encryption-device/
The day quantum computers break the first cryptographic key I'm gonna go full rampage and publicly name and shame all the snarky folks who identify themselves with the "QC/is/bullshit" gender. I am taking notes on my list, mind you. Your name is there as well.
Revenge is best served at 0.02 Kelvin.
#crypto #cryptography #infosec #quantum #quantumcomputing #qc #drama #humor
The @w3c Verifiable Credentials #WorkingGroup has published the "Quantum-Resistant Cryptosuites v1.0" specification as First Public Working Draft #FPWD #timetogiveinput
▶️ https://www.w3.org/TR/vc-di-quantum-resistant-1.0/
The document brings post-quantum digital signatures to #VerifiableCredentials and other data payloads, helping organizations prepare for a future where today's elliptic curve #cryptography may no longer be sufficient.
#identity #PostQuantum
Feeback welcome: https://github.com/w3c/vc-di-quantum-resistant/issues