Testing & QA

How iPhone's Secure Enclave Stops Brute-Force Attacks

TL;DR: Your iPhone protects your 6-digit passcode by combining hardware-bound cryptography with forced validation delays. The Secure Enclave enforce…

pqc-bench Part 2: Where the X25519MLKEM768 overhead actually matters

Part 1 ran a fresh-handshake load test on a Graviton3 and measured what the ML-KEM half of X25519MLKEM768 adds to TLS 1.3 handshake latency. The hea…

NSA Accelerates Post-Quantum Cryptography Implementation: Addressing National Security and Tech Industry Concerns

Introduction The National Security Agency (NSA) has announced a dramatic acceleration of its post-quantum cryptography (PQC) implementation timeline…

Don't trust the randomness API: verify drand beacons in your agent in 30 lines

Agents keep needing a random number that another party can check: picking a reviewer, breaking a tie, sampling a test case, running a small raffle.…

Caesar Cipher Explained: How It Works, Encryption, Decryption, and Examples

If you've ever been curious about how encryption works at a basic level, the Caesar Cipher is a great place to start. It is one of the simplest clas…

TPM Requirements for Post-Quantum Cryptography Readiness

The Trusted Computing Group has established a new set of requirements to help organizations determine if Trusted Platform Modules are prepared for t…

Age Checks Are Going Digital. They Should Go Zero-Knowledge.

On June 30, 2026, the UK Home Office laid regulations allowing licensed premises in England and Wales to accept digital proof of age for alcohol sal…

Off-the-Record Messaging: Where Deniable Encryption Started

In 2004, three researchers published a paper with a pointed subtitle: "Why Not To Use PGP." Their argument was that encrypting instant messages with…

The Long Tail of Work Left Until ActivityPub Has E2EE

TLS Interception: How Corporate Proxies Read Your Encrypted Traffic

The padlock in your browser tells you the connection is encrypted. It does not tell you who is on the other end of that encryption. On millions of c…

The Pentester’s Guide to Finding CBC Bit Flipping Vulnerabilities

If you spend enough time poking at web applications, you’ll eventually run into a target that handles session management poorly. You’ll intercept a…

Signing your random numbers is theater. Here's what actually makes randomness trustworthy.

Three of my autonomous agents needed to pick a leader. Each one called random.random() , highest number wins. All three reported they won. Obviously…

UVS: a draw's fairness as a fact you can recompute — not a certificate you trust

I've built casino slot machines and gaming systems for 15 years. I mostly stayed away from compliance, but once I had to write the official algorith…

Encrypted Spaces

Fun stuff from Signal devs + edu+MS researchers: E2EE collaborative/social apps using zero-knowledge proofs and other crypto goodness. Servers provi…

rscrypto v0.4.0: Verifying Constant-Time Behavior Instead of Assuming It

Every cryptography library says it's secure and performant. Very few can explain how that security is validated and how that performance is proven a…

Announcing the Trust Identity Protocol (TIP): HTTPS for the AI Era

Announcing the Trust Identity Protocol (TIP): HTTPS for the AI Era TL;DR. The Trust Identity Protocol (TIP) is a free, open, post-quantum-secure, pa…

Post-quantum cryptography for embedded and IoT: secure boot, TLS and OTA

Post-quantum cryptography is no longer just a research topic. It is starting to affect the way embedded teams design TLS, secure boot, OTA, firmware…

Digital Signatures: The “Trust Me Bro” Detector for Junior Cybersecurity Engineers

Digital Signatures: The “Trust Me Bro” Detector for Junior Cybersecurity Engineers Subtitle: How digital signatures help prove who signed something,…

EU Chat Control: What Client-Side Scanning Actually Means for Encryption

The EU's proposed Chat Control regulation would require messaging providers to scan your messages for illegal content before encryption, on your dev…

Why Strict "Zero Trust" Breaks Secret Management (And How We Built a Zero-Persistence Vault Instead)

This is a technical deep dive into the cryptography behind Ennote's enterprise architecture. You can read the original full-length post on our engin…

Matrix: The Open Protocol for Federated Encrypted Messaging

Signal works well when everyone involved trusts the same company. Matrix is built for the case where they don't — where organizations want to run th…

Building an Experimental TypeScript Cipher Inspired by 8 Dimensions

Over the last few days, I started an experimental study on cryptography with the goal of better understanding concepts such as symmetric encryption…

Supply Chain Attacks: When Your Privacy Tool Gets Compromised

On March 29, 2024, Andres Freund — a Microsoft engineer and PostgreSQL contributor — noticed something odd while investigating unexplained CPU usage…