frereit

5 ms·

1.
by frereit 1y ago
> January 9, 2025 – Kubernetes proposed a fix for CVE-2025-1097. > January 10, 2025 – Wiz Research reported a bypass for the proposed fix for CVE-2025-1097. > January 12, 2025 – Kubernetes proposed a fix for CVE-2025-1974. > Jan
2.
by frereit 2y ago
Would this patent cover just the encoding alone? The first sentence says: > A method, apparatus, and system relating to embedding hidden content within a Unicode message and using the hidden content to perform a particular computer actio
3.
by frereit 2y ago
I agree. Personally, I'd prefer let span = 5.days() + 8.hours() + 1.minutes();
4.
by frereit 2y ago
Cool! I built something very similar but for Windows a while back: https://syscalls.win
5.
by frereit 2y ago
> But it strangely leaves open the possibility, without saying either way, that a longer iv, with r(i)>96 random bits might allow generating more iv's. As you point out, it will depend on the properties of GHASH (and potentially
6.
by frereit 2y ago
Well, the nonce is (usually) public information. It is shared along with the ciphertext, so that the other party can use the same nonce to validate and decrypt the ciphertext. So it is trivial to detect which two messages share a nonce, if
7.
by frereit 2y ago
Correct. However, some implementations actually incorrectly refer to the nonce as an "IV" (initialization vector), where it's not so obvious. Also, it's not entirely clear just how bad a reuse actually is. For example, i
8.
by frereit 2y ago
Yes, I am, but unfortunately I do not think I can provide any answers here. A quick internet search reveals some CVEs for nonce reuse. If I had to, based on absolutely nothing but a gut feeling, guess, I'd think this may appear more fr
9.
AES-GCM and breaking it on nonce reuse(frereit.de)
5 points by frereit 2y ago|0 comments
10.
by frereit 2y ago
Website seems down. Archive: https://web.archive.org/web/20240527041229/https://joannenov...
11.
by frereit 2y ago
I'm honestly surprised at the relatively positive reception to this. While there isn't any problem with the code shown, the same effect couldn've probably been achieved with a few well thought out shortcuts in any IDE (delete
12.
by frereit 3y ago
This article does not mention the release of the SteamDeck at all. I wonder if this could have had an impackt on Linux usage large enough to see in trends like these or if it's just a drop in the bucket.
13.
by frereit 3y ago
This is my first ever blog post. It's about Bootstring, the encoding algorithm behind Punycode domain names. I wanted to cover both encoding and decoding in a single post, but I spent so much time on this already I decided to publish t