tag: Cryptography · 27 items
- Engineer — Learn: The paper exposes a fundamental flaw in sample-and-scale DP noise protocols, achieving near-100% membership-inference success against Orchard and DP-BREM+; engineers building federated analytics or DP aggregation pipelines should audit whether their noise-sampling implementation uses the vulnerable scaling approach.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Lightweight pure-Python Ed25519/scrypt signing tool useful for evaluating air-gapped key ceremony workflows or bootstrapping offline signing without heavyweight dependencies.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: A lightweight, air-gapped Ed25519 signing playground worth evaluating if you need offline artifact signing or key ceremony tooling; no urgent action required.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Academic prototype of a new cryptographic primitive enabling t-of-n custody on Lightning channels without protocol changes; relevant only if running Lightning infrastructure, but the nested threshold multi-signature design concept may inform distributed key management thinking more broadly.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: The paper demonstrates that standard TLS primitives in OpenSSL and BoringSSL can be composed into an authentication bypass — a novel vulnerability class worth understanding for future TLS configuration and library choices. No CVE, no patch, and no KEV/EPSS signals mean no immediate action on running systems today.
- SOC/IR — Learn: The research shows how TLS handshake state can be weaponized without triggering conventional signature-based detection, which has long-term implications for anomalous handshake detection; however, no IOCs, no active exploitation, and no ATT&CK mappings make this a future reference rather than a hunt trigger now.
- Leader — Skip
- Engineer — Learn: Novel architecture for passkey export/import without plaintext key exposure — worth reading if you’re designing FIDO2 recovery flows, but this is a prototype proposal with no standard status yet and no action required on running systems.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Academic analysis showing that practical graph encryption schemes leak structural metadata enabling query recovery; relevant if evaluating encrypted graph databases for sensitive workloads, but no currently deployed product or patch is implicated.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Useful methodology for teams validating ML-KEM library choices (noble/post-quantum, liboqs, Go stdlib) against NIST ACVP corpora; no running-system changes required today, but informs how to structure PQC migration testing.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: This research tightens the security proof for noise flooding in approximate FHE schemes, showing the correct parameter bound is sqrt(qn)/2γ rather than linear in q. Relevant if you deploy or evaluate FHE libraries, but no immediate patching or configuration action needed.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: For teams evaluating post-quantum signature schemes, this demonstrates SQIsign signing is now more practical — useful context when comparing PQC algorithm tradeoffs for future library or protocol adoption, but no action needed on running systems today.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: BBS signatures underlie privacy-preserving authentication systems being standardized by W3C and IRTF; this paper closes a tightness gap in their security proof, which may affect future scheme selection (BBS vs BBS+) when implementing such systems — no change to running systems required today.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Useful background for engineers tracking isogeny-based PQC alternatives post-SIDH break; POKE-based KEM shows significant performance gains over terSIDH and CSIDH, but no NIST standardization yet — no migration action warranted today.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: This paper provides a cross-ecosystem taxonomy of canonicalization failures (transaction malleability, hash-chain malleability, etc.) and a practical review procedure for identifying this class of defect in cryptographic code. Worth reading before designing or auditing any system where a hash, signature, or replay-protection scheme depends on serialized representations.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Act: Audit any use of CryptoJS.lib.WordArray.random() in your codebase — it provides insufficient entropy for cryptographic key generation; replace with Web Crypto API’s crypto.getRandomValues() immediately and review whether any generated secrets need rotation.
- SOC/IR — Learn: Active drains are targeting end-user crypto wallets rather than enterprise estates; no enterprise-relevant IOCs or ATT&CK-mappable TTPs are present, but the weak-RNG exploitation pattern is worth tracking for future detection design.
- Leader — Skip
- Engineer — Learn: Novel matrix-multiplication masking protocol enabling private transformer inference on untrusted servers, backed by LWE/LPN hardness assumptions; no action needed today, but worth tracking if evaluating secure enclaves or confidential computing architectures for AI workloads.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Novel research showing ZK verification of LLM inference can be satisfied by ghost weights that collapse effective computation, letting a provider overclaim model size while proofs remain valid. Engineers building or relying on ZK-ML attestation for supply-chain trust should revisit those assumptions before treating ZK proofs as effort guarantees.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Academic benchmarking of the BGN SWHE scheme may inform future architecture decisions for privacy-preserving analytics pipelines, but no current system changes are needed.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: RNG flaws in embedded firmware serve as a cautionary case for any cryptographic key generation in custom hardware or firmware — review how your systems seed entropy, but this vulnerability is in consumer hardware wallets, not enterprise infrastructure.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: A 2021 firmware error routed Coldcard seed generation to a deterministic software PRNG instead of a hardware source, enabling full wallet recovery at scale — a textbook cautionary example for any engineer implementing cryptographic key generation. If your organization holds BTC in Coldcard devices, treat this as Act and audit key provenance immediately.
- SOC/IR — Skip
- Leader — Learn: A $70M theft traced to a firmware-level entropy flaw in a widely trusted hardware security device illustrates that hardware vendor supply chain risk extends to firmware quality; useful context if your organization holds crypto assets or relies on hardware security modules, but unlikely to require immediate board action for most enterprises.
- Engineer — Learn: HAWK-256 is not widely deployed and is not a NIST-selected PQC standard, so no immediate patching is required; the 7-round AES result is purely academic (production AES-128 uses 10 rounds). Worth tracking as AI-assisted cryptanalysis matures and you evaluate PQC algorithm choices for future implementations.
- SOC/IR — Skip
- Leader — Learn: AI-assisted cryptanalysis successfully broke a post-quantum signature candidate—useful background for board-level PQC migration discussions, but HAWK-256 has no significant production deployment, so no risk register update or vendor inquiry is needed today.
- Engineer — Learn: Researchers show that ZKP-based model certification can be exploited by carefully crafting training data to produce models that pass audits but fail in deployment — a design-level concern if your team evaluates or builds on cryptographic ML audit frameworks.
- SOC/IR — Skip
- Leader — Learn: If your organization relies on third-party cryptographic model certification for compliance in regulated domains like healthcare or finance, this research signals that such certificates may not guarantee real-world model behavior — worth flagging to AI/ML risk owners when evaluating audit assurances from vendors.
- Engineer — Learn: Research-stage framework for privacy-preserving ML inference using partial homomorphic encryption; no production deployment target yet, but relevant for teams evaluating MLaaS privacy architectures.
- SOC/IR — Skip
- Leader — Learn: Emerging approach to MLaaS model-and-data confidentiality could inform vendor risk questions around proprietary model exposure; no near-term action required.
- Engineer — Learn: Academic research on FHE compiler optimization with no immediate deployment impact; worth tracking if evaluating FHE for privacy-preserving computation in future system design.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Cloudflare’s 2029 PQC roadmap signals the industry timeline for deprecating classical key exchange; useful context for planning when to prioritize PQC migration in your own TLS and key management stack, but no action required today.
- SOC/IR — Skip
- Leader — Plan: A major infrastructure provider’s 2029 PQC deadline is a useful benchmark for your own cryptographic agility roadmap; use it to set a planning horizon and ask whether your encryption-dependent vendors have comparable commitments.
- Engineer — Learn: Useful reference if you write Rust code handling secrets or cryptographic material; evaluate for adoption in services that need guaranteed zeroization and mlock-protected buffers.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Learn: Solid research demonstrating that ESP32 WDEV output is pseudorandom when RF is disabled yet passes statistical tests — a reminder that output testing is insufficient for source-state validation. Worth reviewing if your team ships ESP32-based IoT products; no patch or CVE to act on yet.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: If your Go codebase depends on github.com/cloudflare/circl and uses the FourQ elliptic curve (key exchange or signatures), audit that usage and schedule an upgrade; EPSS is 0.00 and no KEV listing, but a public PoC exists and cryptographic correctness flaws can enable key-recovery or signature-forgery scenarios.
- SOC/IR — Skip
- Leader — Skip
- Signals: CVE-2025-8556 — CISA KEV: not listed, EPSS 0.00, public PoC on GitHub