Matthew Green

Cryptography Engineering [0] is a great book that covers key topics in cryptography with a focus on best practices for implementors and system/protocol designers. Matthew Green's blog, A Few Thoughts on Cryptographic Engineering [1], has a wealth of interesting posts that are often aimed at explaining cryptography to a "technical but non-cryptographer" audience, and tend to be motivated by recent events in security/cryptography news. [0]: https://www.amazon.com/Cryptography-Engineering-Principles-Practical-A… [1]: https://blog.cryptographyengineering.com/

Prof. Green has a great blog: http://blog.cryptographyengineering.com/

Same here. It may be basic and crappy, but if you want to read an unsuccessful blog with no attempt at monetization or ads or even visitor counting, mine[1] is where you should feel right at home. But I guess the author means a platform, not loose websites without a collective 'new' feed. I remember looking for one when wanting to make a new blog and I haven't found a platform that felt right, at least back then (probably ~2015). Heck, I couldn't even find software to install: everything is either super heavy stuff that requires caching or at least a beefy CPU to survive the HN homepage (with custom software, HN can be survived on an ancient Atom CPU even if you use PHP (also pre-PHP7) and do multiple SQL queries per pageload) or some static generators that I wasn't looking for. Edit: While we're at it, another blog I read is Robert Heaton's one[2], and I'm subscribed to a few others but they don't seem to post anymore since I stopped getting email notifications. I remember Coding Horror[3] was also nice to read but he posts very infrequently now (for those who don't know, that's by the co-founder of Stack Overflow). Finally, Cryptography Engineering[4] might be nice if you're into that sort of thing. But I suppose those can all be mostly considered successful in that they all have a following. [1] https://lucgommans.nl/blog [2] https://robertheaton.com [3] https://blog.codinghorror.com [4] https://blog.cryptographyengineering.com

Matthew Green talks about this in his blog on the subject: https://blog.cryptographyengineering.com/2026/03/02/anonymous-credenti… The two methods that seem feasible are making it hard to copy (putting it in the secure element in your phone, for example, which I don't love) or doing tokens that can only be used a limited number of times per day, like in : https://eprint.iacr.org/2006/454

This shadow device would have it's own keys to read messages sent to your iCloud account. To my knowledge, there's nothing in the security model to prevent this. Matthew Green has some great posts about iMessage security. This one describes the key lookup issue: https://blog.cryptographyengineering.com/2015/09/09/lets-talk-about-im… Looking at the linked Apple Platform Security, it seems like the Apple Identity Service is still used as a public key directory.

Excellent article about Telegram's encryption from Matt Green (cryptographer, for those who haven't heard of him): https://blog.cryptographyengineering.com/2024/08/25/telegram-is-not-re…

This is great, thanks! Do you mean an explainer for ZK proofs? I found this primer by Matthew Green very helpful in understanding the basics: https://blog.cryptographyengineering.com/2014/11/27/zero-knowledge-pro…

Great work! I really enjoyed the interactivity. Actually I already was aware of the concept of zero-knowledge proof from the wonderful article by ZCash(which is a privacy-oriented cryptocurrency) core developer Matthew Green, worth to check it out: https://blog.cryptographyengineering.com/2014/11/27/zero-knowledge-pro… My two cents of the ZKP illustration is that directly using hashes are more likely to convince "computer-friendly" people to introduce the commitment scheme.

Edit: The comment below is incorrect. I'm leaving it for transparency, but I misread where the padding is being applied. I could be missing something here, but I think this is vulnerable to DO'1985, a/k/a Desmedt-Odlyzko: https://github.com/rpgp/rpgp/blob/8e67756ebce780c91b8c2ffc7db1f6230f8a… In particular, in the presence of an insufficiently wide hash, the absence of padding here means that RSA signature validation is not secure under EUF-CMA. Matt Green has a great post on why and when EUF-CMA matters[1]. (This isn't necessarily this implementation's fault, since PGP seemingly (!) encourages the stripping of padding from signatures. But I can't find another source for whether this is actually encouraged by OpenPGP, or whether implementations just widely allow it.) [1]: https://blog.cryptographyengineering.com/euf-cma-and-suf-cma/

> That's the Menezes and Koblitz argument from the "Enigma" paper […] PDF: > In August 2015 the U.S. National Security Agency (NSA) released a major policy statement on the need for post-quantum cryp- tography (PQC). This announcement will be a great stimulus to the development, standardization, and commercialization of new quantum- safe algorithms. However, certain peculiarities in the wording and tim- ing of the statement have puzzled many people and given rise to much speculation concerning the NSA, elliptic curve cryptography (ECC), and quantum-safe cryptography. Our purpose is to attempt to evaluate some of the theories that have been proposed. * https://eprint.iacr.org/2015/1018.pdf Then-coverage: * https://blog.cryptographyengineering.com/2015/10/22/a-riddle-wrapped-i…

Here are a few prominent cryptographers in the 'cryptocurrency' scene with 'deep knowledge': Matthew Green from John Hopkins University [0] Zhenfei Zhang of Ethereum, Mina, Algorand blockchains who co-created the NIST post-quantum cryptography standard for digital signatures called Falcon [1] Nadim Kobeissi creator of cryptocat now created Capsule Social [2] Silvio Micali, Turing Award Winner for his work on Zero-Knowledge Proofs [3] So, I'm afraid that there are some credible people like those above who have a significant and documented background in cryptography who are also working in the cryptocurrency industry. [0] https://blog.cryptographyengineering.com/ [1] https://falcon-sign.info/ [2] https://nadim.computer/ [3] http://people.csail.mit.edu/silvio/

I found this blog post a great explanation: https://blog.cryptographyengineering.com/2014/11/27/zero-knowledge-pro… The cave parable always confused me. This blog-post made it click. I think the 'secret passage in the cave' is just a very bad stand-in for knowledge. Perhaps a maze would be better. But the parable also focuses to much on 'creating false transcripts' without explaining why being able to fake it makes it 'zero knowledge'.

Matthew Green is a well known Cryptography professional and has a ton of write ups on his also well known blog. https://blog.cryptographyengineering.com/ You seem a little judgemental and obviously unaware.

Hi Josh, thanks for taking the time! My question, to both you and (especially) Moxie: Why do you trust Intel SGX so much (for Signal but now also MobileCoin)? Why are you not worried about vulnerabilities? As you're surely aware, even Matt Green who is/used to be(?) the biggest fan of Signal[0] is very concerned[1] about SGX. I don't question your intentions but the fact that Signal as an organization has stayed completely silent about this is… worrisome and at the very least taints its reputation of openness and trustworthiness. With MobileCoin now relying on it, too (more or less), this only seems to be getting worse. [0]: http://web.archive.org/web/20200201112751/https://signal.org/ [1]: https://blog.cryptographyengineering.com/2020/07/10/a-few-thoughts-abo…

Truecrypt was mysteriously shutdown out of nowhere. Rumours abound that it was because of a national security letter or some other governmental interference. TC was never proven to be fundamentally insecure, but the original developers abandoned the project with the incident and the project was forked by others as VeraCrypt, which is now the recommended solution for local encryption (on Windows at least). audit: http://istruecryptauditedyet.com/ final audit summary: https://blog.cryptographyengineering.com/2015/04/02/truecrypt-report/

The best systems aren't vulnerable to that, since it's a 2-way handshake using a Password Authenticated Key Exchange (PAKE)[1] like SRP (Secure Remote Password) or OPAQUE[2]. [1] https://blog.cryptographyengineering.com/2018/10/19/lets-talk-about-pa… [2] https://eprint.iacr.org/2018/163.pdf

I have yet to run across a cryptographer that I trust whose opinion differs significantly. But I have no trouble finding ones that I trust who agree with the key parts of that rant. For example https://www.schneier.com/blog/archives/2016/12/giving_up_on_pg.html, https://blog.cryptographyengineering.com/2014/08/13/whats-matter-with-… https://dev.to/artis3n/encrypting-files-in-a-post-pgp-age-59bf and many, many more. Whether or not you can trust your phone doesn't change that PGP is missing nearly 30 years of what we've learned about best practices for encryption.

The story here is that Zoom uses key distribution servers located in China (in addition to several servers in the USA) and that Chinese law might be compelling Zoom to disclose the encryption keys. I think it is a valid concern, but for me it also raises the question of whether this may also be required in the US. In addition to letting the Chinese (and possibly US) government in on the encryption keys, the encryption scheme is also badly broken (ECB mode of AES). Prof. Matthew Green has written many articles about AES and encryption more generally and I recommend his blog if you are interested (even as a lay person). https://blog.cryptographyengineering.com/2011/12/01/how-not-to-use-sym…

Bruce Schneier posted a summary today that referenced a great write-up by Matthew Green of Johns Hopkins. [1] https://www.schneier.com/blog/archives/2020/03/the_earn-it_act.html [2] https://blog.cryptographyengineering.com/2020/03/06/earn-it-is-an-atta…

It's always sad to see someone taking down a project that is run with the best intentions. However, it may be time to move away from the entire PGP ecosystem. Consider the post's "We've known for a decade this attack is possible. It's now here and it's devastating.". Consider also the final section, "PGP is bad technology and it’s making a bad community", of https://blog.cryptographyengineering.com/2018/05/17/was-the-efail-disc… (by noted cryptographer Matthew Green.) My sympathies to the victims of this attack. [EDIT: reworked slightly at 7m to try to be as kind as possible]

This is a strawman -- many, many people were aware that this change did not enable sync for existing accounts, and were concerned regardless. Matthew Green does an excellent job articulating all of the reasons why this is a terrible change, and specifically notes that sync is not among them: https://blog.cryptographyengineering.com/2018/09/23/why-im-leaving-chr…

What's the reason to use these boxes? "Nobody ever got fired for buying IBM"? It seems that vulnerabilities are much more common than in the platform VPN (ipsec/ssh/openvpn etc) implementations shipping in server operating systems, why not just just terminate at a server box? My favourite recent one was the slapstick Fortinet one, https://blog.cryptographyengineering.com/2017/10/23/attack-of-the-week… (Same goes for terminating TLS at load balancers)

Matthew Green's blog on why it happened and how it escaped detection is a really good read. https://blog.cryptographyengineering.com/2017/10/16/falling-through-th…

For those, like me, who needed a good primer on SNARKs, this reference they linked is great https://blog.cryptographyengineering.com/2014/11/27/zero-knowledge-pro…

I don't have time to list everyone, but a few off-hand: For crypto, Matt Green: https://twitter.com/matthew_d_green https://blog.cryptographyengineering.com/ For cybercrime, Brian Krebs (though I would call him an investigative journalist rather than an expert): https://krebsonsecurity.com/ For intelligence/counterintelligence/OPSEC, thegrugq: https://twitter.com/thegrugq https://medium.com/@thegrugq A few of these can occasionally be biased when there's a political edge to something, but some others I trust: Moxie Marlinspike, Daniel Bernstein, Dan Kaminsky, Rob Graham, Thomas Ptacek, Michał Zalewski, @SwiftOnSecurity (semi-parody account, but trustworthy info), Tavis Ormandy

> Facebook mines WhatsApp metadata [1]. Thomas addressed this: If you're worried about Facebook seeing your metadata, which is a sane worry, Wire is approximately as slick and usable as WhatsApp with mostly the same underpinnings. > I'm not sure I'd elevate WhatsApp over iMessage I would! Consider the following: https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-app… That sort of attack is not possible against WhatsApp.

Yes, see my link to the BULLRUN program. There were quite a few follow-ups as well. [1] https://freedom-to-tinker.com/2015/10/14/how-is-nsa-breaking-so-much-c… [2] https://arstechnica.com/security/2015/10/how-the-nsa-can-break-trillio… [3] https://blog.cryptographyengineering.com/2013/12/03/how-does-nsa-break… And so on and so forth. Also keep in mind that they are retaining a full take online-- storing all traffic on the internet. Even if it can't be decrypted in realtime, they can come back to it in, say 10 years, with all the advancements in brute forcing and potentially quantum computing available in 2027, to take a look at your 2017 activity. The emails you wrote, the websites you visited, all your chats, all your searches, saved forever.

> I am under the impression iMessage is pretty secure Why's that? (I'm asking seriously, because I don't understand how people get this impression.) iMessage has some very fundamental design flaws that led to this attack: https://blog.cryptographyengineering.com/2016/03/21/attack-of-week-app… The attack is not super-spectacular, but the more worrying thing is that the design is not sound. They use an ad-hoc crypto construction that fails to follow usual best practices. And they haven't really fixed it, they just put some duct tape over it to avoid the attack.

I suggest reading this piece on the recent Jupiter vulnerability: http://blog.cryptographyengineering.com/2015/12/on-juniper-backdoor.ht… "The problem with cryptographic backdoors isn't that they're the only way that an attacker can break into our cryptographic systems. It's merely that they're one of the best. They take care of the hard work, the laying of plumbing and electrical wiring, so attackers can simply walk in and change the drapes."

indeed. at the risk of entering tinfoil hat land, note the following http://blog.cryptographyengineering.com/2014/12/on-new-snowden-documen… ..although also the not 100% reassuring https://nohats.ca/wordpress/blog/2014/12/29/dont-stop-using-ipsec-just…