Writing on web security

The terrapin attack truncates the start of the SSH secure channel so deleted messages go undetected. Learn the mechanism and the strict…

A chosen prefix collision attack uses a broken hash like MD5 or SHA1 to force two inputs to one digest, enabling forged…

A cipher downgrade attack lets a man in the middle force a connection onto export grade or null crypto. See the FREAK…

The lucky thirteen attack is a timing padding oracle on TLS CBC ciphersuites that recovers plaintext byte by byte. Learn the cause…

Constant time comparison stops secret checks from leaking through timing. See how an early exit equality check enables byte by byte tag…

A compression oracle attack leaks secrets through ciphertext length when data is compressed then encrypted. Learn the CRIME and BREACH class and…

A key commitment attack makes one ciphertext decrypt under two keys, enabling message franking abuse and partitioning oracles. Learn why AEAD fails…

A partitioning oracle attack crafts one ciphertext valid under many keys, so a single query rules out a whole set and cracks…

A keystream reuse attack lets an attacker XOR two ciphertexts to cancel the keystream and recover plaintext. Learn the two time pad…

The sweet32 attack exploits 64 bit block ciphers like 3DES, where birthday collisions leak plaintext over long connections. Learn the cause and…