xnyhps’ blog

The Wrong Number Attack

Common DH groups

Out with octopress, in with Hakyll

Validate the encoding before passing strings to libcurl or glibc

Multi-end to multi-end encryption

HTTPS Attacks and XMPP 2: CRIME & BREACH

CVE-2014-1361: SecureTransport buffer overflow

Breaking Half of The Telegram Contest

HTTPS Attacks and XMPP 1: BEAST

Suppose the attacker already has a list of contacts who are on my contact list. I send a packet and the attacker is interested in finding out whether it was a message to one of my contacts, and if so, to whom. Here’s the plain text of the message, shown split at the block boundraries:The client will then mirror the ‘id’ and send a reply or error back:

Misconceptions about forward-secrecy