Programming

How iPhone's Secure Enclave Stops Brute-Force Attacks

TL;DR: Your iPhone protects your 6-digit passcode by combining hardware-bound cryptography with forced validation delays. The Secure Enclave enforce…

pqc-bench Part 2: Where the X25519MLKEM768 overhead actually matters

Part 1 ran a fresh-handshake load test on a Graviton3 and measured what the ML-KEM half of X25519MLKEM768 adds to TLS 1.3 handshake latency. The hea…

Post-Quantum Cryptography Migration- A Practical Starting Point for Developers

Most production stacks are running RSA and ECC in a dozen places the developer didn't consciously choose — a cloud provider default, an npm package,…

NSA Accelerates Post-Quantum Cryptography Implementation: Addressing National Security and Tech Industry Concerns

Introduction The National Security Agency (NSA) has announced a dramatic acceleration of its post-quantum cryptography (PQC) implementation timeline…

Cryptotremor: finding out when your encryption actually stops working

Every security team has the same question this October and almost nobody has the answer: when does the encryption in front of us actually stop worki…

SequenceHash: multihashing for the rest of us

Key rotation as a scheduled operation

Key rotation as a scheduled operation Rotation appears in every policy document and fails in most implementations for the same reason: the key exist…

Building a Sovereign Cryptography Suite in .NET: 11 Engines, Multi-Jurisdictional Hashes, and Anti-Keylogger Shields

1. 🚀 Introduction & Background In modern software engineering, data security is often treated as a solved problem through a mono-cultural lens.…

Eliminate replay attacks: Payload hashing & TTL validation in Fabric.

Eliminate replay attacks: Payload hashing & TTL validation in Fabric. Day 06 of the wFabricSecurity Open-Source Engineering Series. In financial…

Rotate without breaking: Automated key rotation with rotate_key().

Key rotation shouldn't mean taking your services offline for a database migration. With wauth's rotate_key(), every secret in your vault is re-encry…

Tamper-proof distributed nodes: SHA-256 source code integrity verification.

Day 03 of the wFabricSecurity Open-Source Engineering Series. How do you know the worker submitting transactions to your blockchain hasn't been modi…

Don't trust the randomness API: verify drand beacons in your agent in 30 lines

Agents keep needing a random number that another party can check: picking a reviewer, breaking a tie, sampling a test case, running a small raffle.…

Forging 1024-bit RSA signatures in nearly SNFS time

Alternate title: Nearly SNFS-Speed Signature Forgery Sans Factoring N (NSNFSSSFSFN) Abstract. The security of RSA is generally understood to be base…

Using SHA256 to Build Trustworthy Data Portals in Brazil

Data portals in emerging markets face a specific credibility problem: how do you prove that the data you display was not silently altered after publ…

Encryption Isn't Enough — You Also Need to Know If Someone Tampered With Your Data

Most people think encryption's job is to keep data secret. That's only half the job — and the half it doesn't cover is exactly where a lot of otherw…

Caesar Cipher Explained: How It Works, Encryption, Decryption, and Examples

If you've ever been curious about how encryption works at a basic level, the Caesar Cipher is a great place to start. It is one of the simplest clas…

PicoCTF Easy1 Writeup — Recover an XOR Key with Crib Dragging

The flag is XOR-encrypted with a short repeating key. Since we know every picoCTF flag starts with picoCTF{ , we XOR that known text ("crib") with t…

The gpg.fail aftermath: On responsible disclosure, GPG, and the state of security in 2026 [32:37]

In 2025, I [the speaker] found and disclosed a bunch of vulnerabilities in GPG, the most used PGP implementation, and held a talk at 39c3 about it.…

PicoCTF Substitution0 Writeup — Break a Substitution Cipher with Frequency Analysis

Unlike Caesar, each letter is replaced by a different letter according to an arbitrary mapping (not a simple shift). We solve it by comparing the le…

Everything is a Trust Decision

A machine checked proof of the exhaustive boundaries of trust. I'll let the text carry the rest. Comments

PicoCTF Mod 26 Writeup — Brute-Force a Caesar Cipher

The Caesar cipher has exactly 26 possible shifts (modulo the 26 letters of the alphabet). A Python script that tests all 26 shifts and looks for pic…

Everyone agrees on the risk. They disagree on the price.

Published 2026-09-06 Every regulatory claim here was read from the primary document on that date, and each is cited in the policy sources . Guidance…

The One Line of Code That Stops Rainbow Table Attacks

Someone steals a database of password hashes. Instead of cracking each one individually, they check it against a rainbow table — a massive precomput…

Sealing a file so nobody can argue you touched it

An argument about a digital file is almost never lost over what the file says. It is lost one question earlier: How do we know that is the file you…

They steal your database and cannot crack a single password

Picture the worst Monday: someone walked off with a dump of your users table. Emails, names, and the password column. The good news is that you do n…

Hybrid encryption: why combine classical and post-quantum cryptography

When a new cryptographic algorithm appears, a tension shows up: classical algorithms such as X25519 or Ed25519 have resisted attacks for years, but…

Quipu: post-quantum encryption in pure Rust, with a Python wheel

Protecting data that must stay secret ten years from now is a problem for today : an adversary can capture your encrypted traffic now and decrypt it…

What is post-quantum cryptography, and why migrate now?

The cryptography protecting your data today — keys, HTTPS, signatures — rests on mathematical problems that current computers cannot solve in any re…

How to Verify a JWT Signature Without a Library

Every JWT library does the same handful of steps under the hood: decode, reconstruct the signing input, verify. Most developers never see this part,…

TPM Requirements for Post-Quantum Cryptography Readiness

The Trusted Computing Group has established a new set of requirements to help organizations determine if Trusted Platform Modules are prepared for t…