Kudelski Security Research

`cat /dev/urandom | od -N 1 -An -i` gives you a uniform random number between 0 and 255. The following mod 10 in the awk command introduces "modulo bias", which you can read about here https://research.kudelskisecurity.com/2020/07/28/the-definitive-guide-… You can see it quite intuitively if you iterate over all possible numbers between 0 and 255: $ (for i in {0..255}; do; echo $i | awk ' {print $1 % 10 + 1}'; done) | sort -n | uniq -c 26 1 26 2 26 3 26 4 26 5 26 6 25 7 25 8 25 9 25 10

Hey, Shufflecake co-author here, thanks for the questions. 1. Indeed! 2. Wow wow wow, hold on there :D there is a misunderstanding, the "Swiss Government" was never involved not even remotely. First of all, this project has roots that go waaay back in time [1]. It was finally realized when I met Elia, who was then a student at a joint ETHZ/EPFL MSc program, and Elia accepted the thesis project that I proposed in the Kudelski Security Research team [2]. Kudelski Security (disclaimer: my current employer) is a traditional cybersecurity company, mainly focused on MDR, CISO-As-A-Service stuff, etc, but it's also one of the few ones which also has a dedicated fundamental research team, which I'm part of as a Principal Cryptographer. The goal of our team is not only to "invent new ways for the company to make money", but also to do "good PR", through e.g. scientific/academic publications, talks at conferences, open source software etc., all things which is what I'm personally focused on. As part of this, we offer the possibility to students to do their thesis in our team on some selected topic, and that's where Shufflecake came from. That is, originally. As it is now, Kudelski Security is not involved in Shufflecake anymore, it's basically a pet project of Elia and myself, we pay out of our pocket for website hosting, etc, and we work on Shufflecake on our spare time. So, please feel free to contribute, we need help! 3. That is exactly the point! The "killer feature" of…

> Also, this is a fallacy. What is a fallacy? I asked a question. Non-technical users will never modify their software. The act of doing so would recategorize them as "technical". I don't see any fallacy here? The most likely interpretation of your comment is, you're assuming an argument that I am not making. > Just because "typical user" won't care or won't be able to do something doesn't mean we shouldn't strive to build and popularize platforms that do right things. That's a disagreement with an argument I did not make. > Of course it also has to be good at what users actually do care for to have any chance of taking off, but that's not the point. What is the point, even? I just asked how something being "open source" (to borrow the scare quotes) is more desirable to users who do not read/write software code? What is their incentive supposed to be to prioritize open source over proprietary software? That's not an argument. It's certainly not a fallacious one. > Even though I'm not a "non-technical" user, I don't review crypto of my XMPP client. Little bit of background: I'm the sort of person who would review the crypto of an XMPP client. > And that's fine, I know a few people that did and I trust them enough. This way I don't have to trust an entity that may benefit from being able to access my messages. Cool, let's ask an trustworthy expert then. I can think of no finer expert to chime in on this discussion than JP Aumasson, one of the co-authors of SipHash…

"Take, for example, the simple case of a linear congruential generator (LCG), which is the typical textbook introduction to PRNG implementations. LCGs are to PRNG what ROT13 is to encryption and “1234” is to secure passwords. Despite that, due to their simplicity and popularity, they are the default choice for many non-critically secure applications" [0] As a hacker, always try the easiest things first. It's crazy how often they work. [0] https://research.kudelskisecurity.com/2023/03/06/polynonce-a-tale-of-a…

Hello from Kudelski Security. This is super timely, because we recently had to discontinue one of the other only existing Go libraries for quantum-resistant cryptography in Go! Full story at https://research.kudelskisecurity.com/2024/02/01/the-kyberslash-vulner…

Except for your bitcoins, if your cold wallet had a bug: https://research.kudelskisecurity.com/2023/03/06/polynonce-a-tale-of-a…

URL should be https://research.kudelskisecurity.com/2020/04/22/an-introduction-to-ob…

Never trust anything from the client. [1] https://research.kudelskisecurity.com/2017/10/04/defeating-eddsa-with-…

Another group did a talk on this at DEF CON 26 last year: https://research.kudelskisecurity.com/2018/08/16/breaking-and-reaping-… They analyzed over 340 million keys from the web. > As part of the presentation given at DEF CON 26, one of the outputs was Kudelski Security’s Keylookup application. On this site, you can submit your own public keys and have them tested against our dataset. We will let you know if your key is vulnerable to Batch GCD and ROCA attacks. If your key is in our database, we will be able to give you an answer immediately, if it is not, you may have to wait a bit until the tests complete. > https://keylookup.kudelskisecurity.com/

In order to comment on individual cells, we appear to first have to have an argument about how audits work. You say WhatsApp can only "claim" certain features as a consequence of it being closed source, but that's because of a misunderstanding about how audits work. In a backchannel, as a consequence of this HN article, someone (names withheld to protect the guilty, they can identify themselves if they'd like) started looking at Dust and figured out the key store password is a hardcoded, short, ASCII string and the messages are encrypted with unauthenticated AES-CBC. They did not need the source code to do that. JP Aumasson phrased it more eloquently than I could: https://research.kudelskisecurity.com/2018/10/02/open-source-crypto-is…

Please don't, or if you do, host the relay node from a completely different connection. Onion sites are not completely hidden, and uptime times can be correlated to know which ip is running which hidden service [1], completely missing the point of hidden services. [1] https://research.kudelskisecurity.com/2013/09/04/dont-run-a-tor-router…

When you say "the FIDO Alliance", you mean the entity that runs a Metadata Service[0] which: > provides organizations deploying FIDO Authentication with a centralized and trusted source of information about FIDO authenticators. The aim of this centralized system is to allow revocation of hardware that doesn't meet their unchallengeable opinion of whether you've spent enough money on your device or not. They can similarly require that devices do biometric scanning[1], and be issued by your government, and require you to agree to lengthy (and self-updating) terms of use. There are actually (at least) two different types of device attestation that FIDO support[2]. One uses a hardcoded on-device private key, that's common between 100,000 devices of the same model, which means that an attacker can brick 99,999 other people's devices just by extracting the key from their own device. The other method requires a certificate from a "trusted third-party Attestation CA", which presumably allows a malicious (perhaps government-mandated) CA to spy on (and filter) every login request you make. This system is like a dystopian parody of the traditional model of web security, which had no need for "authenticators that have a Trusted Platform Module (TPM) onboard", and which only required CAs to be on a list that the user agent is in control of (and users can add their own CAs to). Instead, what FIDO are building is basically DRM for human identity, with all the corruption and failure…

Relevant stories: Even though Curve25519 is built to be easy to implement in constant time, there was a non-constant time bug in a Curve25519 library: https://research.kudelskisecurity.com/2017/01/16/when-constant-time-so… Basically the compiled code ends up using a run-time Windows library for 64-bit multiplication. That library decided to skip the upper 32-bit multiplication when the operands had 32 all zero MSBs. Oops. ChaCha20 is also easy to implement in constant time. Which tends to be true. But most ChaCha20 implementations have other side channels. Turns out, when CPUs access non-register memory, the EM and power characteristics of that access are dependent on the bits of the data being accessed. Which means you can perform power or EM analysis on a CPU running ChaCha20 and extract the key. Oops. (Search for bricklayer attack) In other words, become a cryptographer because you'll always have more work :)

I don't use Signal mostly because nobody I know uses it, even though I know they have it installed. By pure usage statistics the winner would be WhatsApp. I also use Wire. In terms of issues with each of these, Wire has occasional bugs and hiccups (UX wise) and would be unsuitable for large groups exchanging messages (every device implies an entirely new ratchet, users own multiple devices, and all Wire group chats are client-fan-out, meaning pairwise ratchets with all members. Users with more than one device, even if they communicate one-on-one, are effectively in a group session). However the group message problem implies trade-offs and doesn't have an easy solution, so this shouldn't be seen as game-ending criticism (there's an ongoing effort involving people from all three messengers to figure out group messaging in a safe and scalable way, called Message Layer Security). WhatsApp is much more feature stable, but compromises on client-fan-out to make group messaging simpler. I think Signal also does client fan-out. I think Signal were also a bit dismissive of the low order point issue in their protocol (https://research.kudelskisecurity.com/2017/04/25/should-ecdh-keys-be-v… but it's arguable whether this is an issue at all their instantiation of DH (https://moderncrypto.org/mail-archive/curves/2017/000896.html). So in terms of cryptography, all three are state-of-the-art. I haven't really used Threema, but for completeness I had a brief look at their crypto…

This is a pretty good primer, and I think Matt Green is generally good at tutorials that reduce the technical complexity to make material more accessible. I'll add a couple of notes: 1. Hash-based cryptography is not capable of providing public-key encryption, so unfortunately these are only useful for quantum-resistant digital signature schemes. But they're still very good at that. 2. Since collision resistance is a stronger notion of security than preimage resistance and second preimage resistance, achieving collision resistance achieves all three. I just wanted to make this point explicit. Likewise, indistinguishability is an even stronger notion and subsumes all three. 3. The current state of the art in quantum-resistant hash-based signatures is the SPHINCS family and its variants, including SPHINCS+ and Gravity-SPHINCS [1,2,3]. One of the really interesting innovations here is a transition to trees with few-time signatures instead of one-time signatures underlying them. A good, reasonably up to date source for a technical overview of the current research landscape is the PQCrypto Conference's 2017 Summer School, specifically the two "Hash-based signatures" videos/slides [4]. ____________________ 1. https://sphincs.cr.yp.to/papers.html 2. https://sphincs.org/ 3. https://research.kudelskisecurity.com/2017/12/01/our-submission-to-nis… 4. https://2017.pqcrypto.org/school/schedule.html