Security, Cryptography, Whatever

Hey, I should say this, and wish I had earlier: I don't really so much care whether Nostr is good or bad. I'm a connoisseur of cryptographic vulnerabilities, and the ones in that paper are fun. We host a podcast (me, Deirdre Connolly, and David Adrian) that is mostly about good crypto vulns. If there's someone affiliated with Nostr that would want to chat for an hour or so about how applicable the vulns in this paper are or aren't, and how they're addressed in NIP44 --- we'd love to talk. My email address is in my profile. Whoever showed up, they'd be in good company! https://securitycryptographywhatever.com/

It's not published weekly, but I listen to most episodes of Security, Cryptography, Whatever as soon as they come out. https://securitycryptographywhatever.com/

Sibling comments have already addressed the fact that Filippo is one of the people you're probably "best leaving" cryptography implementation to. The author has actually talked explicitly about "Don't roll your own crypto": https://securitycryptographywhatever.com/2021/07/31/the-great-roll-you…

This was a great episode, another great one I remember is https://securitycryptographywhatever.com/2021/08/12/what-do-we-do-abou… I'd recommend listening (or reading the transcripts) to anyone who's needs or wants to understand more about JWT and other tokens (And if you're not, check out the other episodes still. That podcast is great, some of the episodes get really deep into the cryptography weeds but if I get trough them I still feel like I learned something :-) thanks for making it)

> on the podcast Click username => Check website, last update 2016... Copy the @_@_ junk to a search engine => Click on Mastodon instance, unable to find any link to "the podcast" in the "profile" => scroll through Mastodon posts, wading through food swooning and memes to find December 2nd ~"SEND US QUESTIONS FOR SCW PODCAST" => put "SCW Podcast" in search engine => Scroll past "SCW Fitness" and "Soft Cock Week"... Put "SCW Security" into search engine => Click https://securitycryptographywhatever.com/ https://securitycryptographywhatever.com/2023/11/13/lattice-attacks/

> Modern implementations must support a range of TLS protocol versions (from legacy TLS 1.0 to current TLS 1.3) So this statement is strange considering "modern" security standards either nudge you (or demand) to deprecate anything that isn't v1.3 or v1.2. If the implementation is "modern" why would I allow 1.0 ? This seems like a HA-Proxy problem. They ought to maintain support for geriatric TLS versions on a dedicated release branch connected to a support-model that nudges their client into updating by increasing their fees for maintaining that system. Not doing so means the vendor is part of the problem why we have slower adoption rates for 1.3 than we could otherwise have. It would have been cool to see AWS's s2n-tls (or s2n-quic https://github.com/aws/s2n-quic) included in their benchmark. One of my all time favorite episode from the SCW podcast goes into the design decisions of s2n: The feeling's mutual: mTLS with Colm MacCárthaigh https://securitycryptographywhatever.com/2021/12/29/the-feeling-s-mutu… From AWS: https://aws.amazon.com/security/opensource/cryptography/ > "In 2015, AWS introduced s2n-tls, a fast open source implementation of the TLS protocol. The name "s2n", or "signal to noise," refers to the way encryption masks meaningful signals behind a facade of seemingly random noise. Since then, AWS has launched several other open source cryptographic libraries, including Amazon Corretto Crypto Provider (ACCP) and AWS…

On that latest episode of 'Security Cryptography Whatever' [0] they mention that the time spent on improving the harness (at the moment) end up being outperformed by the strategy of "wait for the next model". I doubt that will continue, but it broke my intuition about how to improve them [0] https://securitycryptographywhatever.com/2026/03/25/ai-bug-finding/

Obviously no guarantees that it's exactly what was done in this case, but he talked about his general process recently at a conference and more in depth in a podcast: https://www.youtube.com/watch?v=1sd26pWhfmg https://securitycryptographywhatever.com/2026/03/25/ai-bug-finding/ It pretty much is just "Claude find me an exploitable 0-day" in a loop.

Carlini gives some more background about his vulnerability research with Claude in this interview by tptacek & co. https://securitycryptographywhatever.com/2026/03/25/ai-bug-finding/

I tend to be skeptical but listening to the linked podcast with Carlini and found him very credible–not a sales guy, not an AI doomer, but someone talking about how little work he had to do to find real exploits in heavily-fuzzed code. I think there’s still a safe bet that many apps will be cumbersome to attack but I think it’s still going to happen faster than I used to think. https://securitycryptographywhatever.com/2026/03/25/ai-bug-finding/

After seeing STIR/SHAKEN's implementation details (hey what if we used JWT, and then maximized the metadata leakage of who you're calling), I really do not want to trust telecoms to roll their own crypto. https://securitycryptographywhatever.com/2024/04/30/stir-shaken/

I just finished the Security Cryptography Whatever episode [0] about this and when Eric Rescorla is going on about how they almost threw the Web PKI overboard for a blockchain but it was too slow I was like, "just use a layer 2 like Lightning! It's fast, like Lightning!" But then they described SCTs and I was like, "well OK, way worse name, but they got there" [0]: https://securitycryptographywhatever.com/2024/05/25/ekr/

Matrix got ripped apart a couple of years ago and there are some questionable aspects https://securitycryptographywhatever.com/2022/11/02/Matrix-with-Martin…

The "Security. Cryptography. Whatever." podcast just did an episode about the origin of the nistp curves. https://securitycryptographywhatever.com/2023/10/12/the-nist-curves/

From the MLS protocol discussion posted elsewhere in this thread, https://securitycryptographywhatever.com/2023/04/22/mls/ .. you have a cryptographic guarantee that everybody sees the same list of admins, sees the same list of, of non-admins and general members and whatnot. .. The server can absolutely not inject participants because the server is not a member. So, there is this add operation, that can only be performed by an existing member. However, there is also a way for a server, or let’s say generally an outside party to suggest, uh, other members. But that requires the outside party, you know, to have a well-defined credential and to sign that request. And then that can be honored and everybody will see that that was a suggestion from the server. And that’s a controlled way, how you can add people to a group, but you can never do that, you know, steathily.

> it is very possible to simply take every file in a codebase, and prompt it asking for it to find vulnerabilities. My understanding (based on the Security, Cryptography, Whatever podcast interview[0] -- which, by the way, go listen to it) is that this is actually what Anthropic did with the large model for these findings. [0]: https://securitycryptographywhatever.com/2026/03/25/ai-bug-finding/ > I wrote a single prompt, which was the same for all of the content management systems, which is, I would like you to audit the security of this codebase. This is a CMS. You have complete access to this Docker container. It is running. Please find a bug. And then I might give a hint. “Please look at this file.” And I’ll give different files each time I invoke it in order to inject some randomness, right? Because the model is gonna do roughly the same time each time you run it. And so if I want to have it be really thorough, instead of just running 100 times on the same project, I’ll run it 100 times, but each time say, “Oh, look at this login file, look at this other thing.” And just enumerate every file in the project basically.