The Joy of Cryptography

Two popular AES libraries (aes-js and pyaes) provide dangerous default IVs that lead to key/IV reuse vulnerabilities affecting thousands of projects. One maintainer dismissed the issue, while strongSwan’s maintainer exemplified proper security response by comprehensively fixing the vulnerability in their VPN management tool.

Every formally verified system embeds a verification boundary: the interface between code with machine-checked proofs and code that is trusted without them. We study what happens when this boundary is...

We identified and addressed a typosquatting issue promptly, but the incident reinforced why authenticity and provenance matter deeply in security reporting.

Healthcare is a right, protected by evidence, compassion, and core Canadian values.

Listen to Hallucinate (2025 Version) by Taylor Hornby #np on #SoundCloud

Listen to The Brightest Light by Taylor Hornby #np on #SoundCloud

Converting to/from base-256 (raw "binary" octets) and base-N is easy to do in constant-time if N is a power of 2. See: RFC 4648 for power-of-2 codecs. 58 isn't a power of 2, which makes implementing ...

Phrack staff website.

The Zcash Foundation is committed to transparency and openness with the Zcash community and our other stakeholders. Today, we are releasing our Q2 2025 report, which provides an overview of the work…

Listen to Excursion by Taylor Hornby #np on #SoundCloud

In a recent blog post, I laid out the argument that, if you have securely implemented end-to-end encryption in your software, then the jurisdiction where your ciphertext is stored is almost irrelevant. Where jurisdiction does come into play, unfortunately, is where your software is developed and whether or not the local government will employ rubber-hose cryptanalysis to backdoor your software.