CodesInChaos @CodesInChaos

C# programmer and cryptography enthusiast stackoverflow.com/users/445517/c… Frankfurt, Germany Joined September 2012

Tweets

626
Followers

657
Following

31
Likes

89

Chris Evans @scarybeasts

8 years ago

OMG. Does Intel have broken speculative execution? "AMD ... does not allow memory references, including speculative references, that access higher privileged data when running in a lesser privileged mode when that access would result in a page fault." lkml.org/lkml/2017/12/2…

9 148 223 0 1

Adam Langley @agl__

8 years ago

Intent To Deprecate And Remove: Public Key Pinning (in Chromium) groups.google.com/a/chromium.org…

4 94 103 0 0

CodesInChaos @CodesInChaos

8 years ago

Is there a known technique for finding fixed points in the full SHA-256 compression function? crypto.stackexchange.com/q/48580/180

1 9 21 0 0

CodesInChaos @CodesInChaos

10 years ago

We clearly need sth. like Certificate Transparency for software updates. Doesn't prevent malicious updates, but helps with detecting them.

2 2 7 0 0

hashcat @hashcat

10 years ago

hashcat and oclHashcat have gone open source: hashcat.net/forum/thread-4…

9 322 167 0 0

FakeIACR @FakeIACR

10 years ago

A new mode of operation suggested in UK: Encrypt-then-serve-time. Security arguments are far from being convincing.

0 21 13 0 0

CodesInChaos @CodesInChaos

10 years ago

@fugueish @ErrataRob If size_t is smaller than int, wouldn't the multiplication promote to int, causing UB via signed int overflow?

0 0 0 0 0

CodesInChaos @CodesInChaos

10 years ago

.@veorq My SHA512 impl. tests 3 update calls with various sizes and compares against result of single update. github.com/CodesInChaos/C…

2 2 1 0 0

Matthijs R. Koot @mrkoot

10 years ago

Thursday, an OpenSSL patch will be released for 1.0.1 and 1.0.2 that fixes a "high" severity security bug mta.openssl.org/pipermail/open… via HN

0 3 3 0 0

CodesInChaos @CodesInChaos

10 years ago

Have You Ever Tried to Sell a Diamond? (the Atlantic article from 1982) theatlantic.com/magazine/archi… @byrneseyeview @zooko

1 0 1 0 0

Jim Manico from Manicode Security @manicode

11 years ago

Twitter CSRF bypass, fixed and published. hackerone.com/reports/14883 Freaking AWESOME research and discovery. (mindblown)

0 51 52 0 0

CodesInChaos @CodesInChaos

11 years ago

Awesome new vulnerability website: backronym.fail (vulnerability itself is boring, just ssl strip against mysql) #BACKRONYM

0 0 8 0 0

CodesInChaos @CodesInChaos

11 years ago

.@PatientDoctor Only cool if you think sending cheap to compute and effectively unsalted password hashes to a third party is a good idea.

0 0 1 0 0

hanno @hanno

11 years ago

My contribution to 1 year Heartbleed: Experiment how Heartbleed could've been found with fuzzing blog.hboeck.de/archives/868-H… /cc @lcamtuf

5 53 51 0 0

CodesInChaos @CodesInChaos

11 years ago

.@mrkoot Be strict in what you accept, but include well defined extension points. Flat list of key-value pairs is usually good for extension

0 0 0 0 0

CodesInChaos @CodesInChaos

11 years ago

The 4 round biases given in section 4 of the paper match my results. Perhaps I'll add ChaCha and NORX later. @veorq @sevenps

0 0 0 0 0

CodesInChaos @CodesInChaos

11 years ago

Wrote a program to find biases in (round reduced) Salsa20. Code: github.com/CodesInChaos/S… Results: github.com/CodesInChaos/S… @sevenps @veorq

2 8 5 0 0

CodesInChaos @CodesInChaos

11 years ago

.@dakami @solardiz Somebody built an HMAC based stream cipher that breaks down for long keys due to this property. crypto.stackexchange.com/q/5740/180