excursions into security, cryptography and math
# On the receiving end: pactl load-module module-native-protocol-tcp-new port= 4656 listen= < local server I P > # On the sending end: pactl load-module module-native-protocol-tcp-new sink= < local server I P > :4656 # To finish: pactl unload-module module-native-protocol-tcp-new
If you're using DnsOverTLS=yes in your resolved.conf and some applications need 10 seconds to resolve something - try disabling your router's DNS servers: [DHCP] UseDNS=false [IPv6AcceptRA] UseDNS=false DHCPv6Client=false systemd-resolved always tries to contact the IPv6 DNS server of my ISP's router on port 853 - but it doesn't respond at all (not even a RST ), which is why it…
Addressing Misconceptions > Obviously a PIN is brute-forceable No, it's not obvious: there's several secure implementation options that prevent a brute-force attack in the device-local data access scenario. See Mitigation and Remediation options 2 and 3. I might as well install a keylogger This is a different attack scenario. If I throw away my computer, or you steal it in its powered…
Someone asked for an executor that only executes synchronous code... So here's a terrible crime: use std :: future :: Future ; use std :: pin :: Pin ; use std :: task :: Poll ; use std :: task :: { Context , RawWaker , RawWakerVTable , Waker }; fn fib (n : i32 ) -> Pin < Box < dyn Future < Output = i32 >>> { if n <= 2 { Box :: pin ( async move { 1 }) } else { Box :: pin ( async move { fib (n…
Here I implemented two simple futures without using async fn . A simple async function We first look at the simplest possible example: async fn does_nothing () {} An async function boils down to a function returning some type that implements the Future trait: fn does_nothing_desugared () -> impl Future < Output = ()> { /* ... */ } The Future trait looks like this: pub trait Future { type…
In the "Secure Bank" challenge of the Cyber Security Challenge Germany (CSCG) 2021 we are presented with a protocol that is meant to ensure that we can only login if we know a certain PIN. In a real world application this PIN could be generated as in TOTP s that are used for 2 factor authentication. In the challenge the PIN is simply generated randomly: challenge = os.urandom( 32 ).hex() msg =…
A visualization of a 3D Z-order curve . Doesn't really work on mobile - use the mouse to rotate the view. A friend of mine asked me about optimizing matrix multiplication. One way to obtain better cache locality is to use space filling curves. I made this visualization using WGLMakie and JSServe.jl in Julia . We can convert between points in \(\{0,\ldots,2^{3 \cdot n}-1\}\) and…
A seminar paper on symbolic execution.
"Jodlgang" is a challenge at the 2018 FAUST CTF. From the challenge description: The Jodlgang platfrom replaced the old password login for a state-of-the-art face authentication system. To sign in, a patron must provide an image of his face alongside his email address. The face snap must be a color image of size 224x224 pixels and must not be larger than 1MB. Luckily we are given the neural…