CiPHPerCoder

5 ms·

1.
Post-Quantum Cryptography for the PHP Community(paragonie.com)
3 points by CiPHPerCoder 5mo ago|0 comments
2.
Building Cryptographic Agility into Sigstore(blog.trailofbits.com)
3 points by CiPHPerCoder 8mo ago|1 comments
3.
by CiPHPerCoder 9mo ago
> However, donating money to an open collective is prohibitively hard for most big companies. You are absolutely correct. However, that's the mechanism that Frank has made available, and that's what the comment I was replying t
4.
by CiPHPerCoder 9mo ago
> Did you also check all of the libraries that implement the check differently to libsodium? Yes, but it was a breadth-first search sourced from the ianix webpage, so I certainly missed some details somewhere. I'll continue to searc
5.
by CiPHPerCoder 9mo ago
I found several libraries that simply didn't implement the check, but none that implemented in incorrectly in the same way as the vulnerability discussed above. If you didn't receive an email from me, either your implementation is
6.
by CiPHPerCoder 9mo ago
From the article: If libsodium is useful to you, please keep in mind that it is maintained by one person, for free, in time I could spend with my family or on other projects. The best way to help the project would be to consider sponsor
7.
by CiPHPerCoder 9mo ago
This also affected the PHP library, sodium_compat. https://github.com/FriendsOfPHP/security-advisories/pull/756 I'm planning to spend my evening checking every other Ed25519 implementation I can find to
8.
How we avoided side-channels in our new post-quantum Go cryptography libraries(blog.trailofbits.com)
5 points by CiPHPerCoder 10mo ago|0 comments
9.
by CiPHPerCoder 11mo ago
Most people don't make their spam public, but I did when I ran this bounty program: https://hackerone.com/paragonie/hacktivity?type=team The policy was immediate full disclosure, until people decided to flood us w
10.
A WordPress Hard Fork Could Be Made Painless for Plugin/Theme Developers(scottarc.blog)
5 points by CiPHPerCoder 2y ago|0 comments
11.
by CiPHPerCoder 2y ago
It's just an Ed25519 signature of a file. The closest thing we have to runtime code-signing are Phar signatures. https://www.php.net/manual/en/phar.fileformat.signature.php
12.
by CiPHPerCoder 2y ago
While I appreciate the sentiment, I don't know that a hard fork is necessarily the right answer. https://scottarc.blog/2024/10/14/trust-rules-everything-arou...
13.
by CiPHPerCoder 2y ago
I'd been staying out of this conflict, partly because I'm not really in the know on WP Engine's behavior behind-the-scenes and, as weird as Mullenweg's plays have been, I don't like to comment on things I'm n
14.
by CiPHPerCoder 2y ago
> There is not any reason to NOT run hybrid cryptography schemes right now, when the use case allows for it. This is reasonable, but runs contrary to the stance taken by CNSA 2.0.
15.
by CiPHPerCoder 2y ago
> All the criticism of cryptographic agility that I have seen has involved an attacker negotiating a downgrade to a broken protocol. Consider this an additional data point, then: https://paragonie.com/blog/2019/
16.
Attacking NIST SP 800-108 (Loss of Key Control Security)(scottarc.blog)
42 points by CiPHPerCoder 2y ago|3 comments
17.
by CiPHPerCoder 2y ago
Thanks for the feedback. I'll add a note after that section to make sure it's referenced appropriately. And especially thanks for taking the time to share your experiences and observations with me. That's how I improve as a w
18.
Attacking NIST SP 800-108 (Loss of Key Control Security)(scottarc.blog)
1 points by CiPHPerCoder 2y ago|0 comments
19.
by CiPHPerCoder 2y ago
> A lot of posters here are fixating too much on the "stolen hard disk" picture which I think the article addressed by declaring it out of scope. So the real points aren't getting through. This is a crypto nerd blog pos
20.
by CiPHPerCoder 2y ago
Sure, that's why I addressed the government in the immediate statement that followed the thing you quoted.
21.
by CiPHPerCoder 2y ago
Okay, this sounds vaguely like a problem that may be solved by "HPKE where the secret key is reconstructed from a threshold secret sharing scheme" (>=2 of N shares needed, 1 held by the service and 1 held by the employee's
22.
by CiPHPerCoder 2y ago
> So I'm not so sure what's the point of encryption at rest in AWS except just to tick off a compliance and regulatory checklist. > The private key is with them anyway, just don't encrypt and save few milliwatts of powe
23.
by CiPHPerCoder 2y ago
> The author is confusing "it costs us nothing (now that encryption can be done in hardware and is integrated into most desktop operating systems) and protects in some scenarios, so yeah, we just decided to mandate it always be done
24.
by CiPHPerCoder 2y ago
If you're using a secure disk encryption technology, and you manage to clear the keys from the TPM or overwrite the header containing the KDF salts and other metadata, that should render the device data unrecoverable.
25.
by CiPHPerCoder 2y ago
> I find it very hard to believe Amazon's or Google's servers do not already have full disk encryption. I am confident that they do. Even better, they can be configured to use your KMS key rather than the service key, and you c
26.
by CiPHPerCoder 2y ago
> Doing things that outwardly appear to improve security but have de minimus or less effect on actual security. Right. And that's exactly the situation the article describes. The accusation of "security theater" was only l
27.
by CiPHPerCoder 2y ago
This is an interesting and important point that you raised. > if you're storing the data on AWS and generating your keys on AWS and managing your keys with AWS ... you're doing it wrong. This is a reasonable thing to do if you&
28.
by CiPHPerCoder 2y ago
> What's the best practice in managing user data keys so that data is available only when there's an authenticated user around? What does it mean for an authenticated user to be "around"? If you want a human to manual
29.
by CiPHPerCoder 2y ago
> Obvious limitations is that you can't use the fields for sorting in queries (ORDER BY), and depending if deterministic encryption is not enabled, you can't use it in filters (WHERE) either. Same applies for any T-SQL logic on
30.
by CiPHPerCoder 2y ago
The thing that's security theater isn't encrypting at rest in general. The thing that's security theater is encrypting insecurely, or failing to authenticate your access patterns, such that an attacker with privileged acces

More ›