Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
mastodon.world is one of the many independent Mastodon servers you can use to participate in the fediverse.
Generic Mastodon server for anyone to use.

Administered by:

Server stats:

11K
active users

mastodon.world: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.3.7

#cryptography

22 posts20 participants1 post today
Public
F. Maury ⏚

Hey cryptographers,

this application is using the same symmetric secret to encrypt cookie values using AES-CBC: github.com/transloadit/uppy/is

This will eventually wear-out the secret.

I suggested deriving a different encryption key from the "secret" for every distinct document (i.e. a cookie value).

Would it be "safe" to derive the key using the IV as the "info" parameter in HKDF?

In "pseudocode", this would read like:

```
aes_key = hkdf(salt=[0]*32, ikm=secret, info=iv, length=32)
encrypt(aes_key, iv, plaintext)
```

The idea of using the IV is to not add anything new to the cookie value. My understanding is that the info parameter is not supposed to be confidential, but how secure is it if it is attacker controlled? I don't see any attacks, but I am no specialist either...

#cryptography#help#opensource
Public
2rZiKKbOU3nTafniR2qMMSE0gwZ
Cryptojacking Goes Open Source: Hijacked Python Packages Fuel Hidden Cryptocurrency Mining It’s...

https://www.rivitmedia.com/technews/cryptojacking-goes-open-source-hijacked-python-packages-fuel-hidden-cryptocurrency-mining/

#Tech #News #code #injection #malware #crypto #malware #cryptography #malware #cryptojacking #cybersecurity

Event Attributes
Cryptojacking Goes Open Source: Hijacked Python Packages Fuel Hidden Cryptocurrency Mining
Rivitmedia · Cryptojacking Goes Open Source: Hijacked Python Packages Fuel Hidden Cryptocurrency Mining - www.rivitmedia.comIt’s the oldest trick in the hacker playbook: hide your crime in plain sight. But now, that tactic has reached new levels of stealth as cybercriminals infect open-source Python packages with cryptojacking malware—quietly siphoning computing power from developers worldwide to mine cryptocurrency.ContentsThe Malware MasqueradeWhy Developers Are the Perfect VictimsIndustry Response and Countermeasures Security firm Fortinet recently uncovered […]
Public
Reverse-Engineering
Modem Cloning for Fun (but NOT for profit!) Recently, I stumbled upon an old cable modem sitting ...

https://yifan.lu/2017/04/02/modem-cloning-for-fun-but-not-for-profit/

#Devices #hacking #hardware #spi #cryptography #docsis #bpi #des #firmware #mips

Event Attributes
Yifan Lu · Modem Cloning for Fun (but NOT for profit!)Recently, I stumbled upon an old cable modem sitting next to the dumpster. An neighbor just moved out and they threw away boxes of old junk. I was excited because the modem is much better than the one I currently use and has fancy features like built in 5GHz WiFi and DOCSIS 3.0 support. When I called my Internet service provider to activate it though, they told me that the modem was tied to another account likely because the neighbors did not deactivate the device before throwing it away. The technician doesn’t have access to their account so I would have to either wait for it to be inactive or somehow find them and somehow convince them to help me set up the modem they threw away.
Public
Max Maass :donor:

I love the fact that I am working in an industry where people write stuff like „If you’re using a standard AEAD mode in such a setup (wherein multiple keys are used), and you aren’t including key-commitment in your protocol design, you’re almost certainly prone to Invisible Salamanders.“

It sounds like we‘re magicians. „Be careful with your spells, apprentice! One wrong syllable and you might be afflicted with a plague of invisible salamanders until the next full moon.“

#Cryptography
ExploreLive feeds
About