On string comparison timing attacks in Go
It’s well known that string comparisons can leak timing information. Go is no different but exploitation is tricky.
KEL.BZ
Recent content on KEL.BZ
Latest posts
Control planes are a useful concept
A useful software architecture concept is the distinction between the control plane and data plane. Even if you don’t use the jargon, this is a useful concept for safer deployments.
Physical proximity and latency
An experiment showing the effects physical proximity has on network latency.
Notes on Virtualization.Framework
Notes from reversing implmentation details of the macOS Virtualization.Framework
P-256 in Sage
Reference code for creating NIST P-256 curve objects in Sagemath.
Authenticated Dictionaries with Skip Lists and Commutative Hashing
Notes and implementation of the Goodrich and Tamassia paper on authenticated dictionaries with skip lists.
The Hidden Number Problem
Notes on the Boneh and Venkatesan’s paper describing the Hidden Number Problem and code demonstrating some of the results.
ECDSA is Weird
Unexpected properties of ECDSA signatures.
Measures of Entropy
Different ways to describe the entropy of a random variable.
RSA-based Key Encapsulation Mechanisms
How to use RSA to encrypt symmetric keys and how RSA-KEM relates to RSA-OAEP.
Questions for System Design Reviews
Moving towards operationalizing system design reviews. What questions should a review team ask, or expect to be answered?
What is the Value-add of ssh-agent?
The purpose of ssh-agent and observations how ssh-agent improves UX and security.
Fiat-Shamir Heuristic
Overview and implementation of the Fiat-Shamir heuristic used to build signature schemes from interactive zero-knowledge proofs.
Building Lattice Reduction (LLL) Intuition
My attempt to grok the Lenstra–Lenstra–Lovász (LLL) algorithm used for basis reduction.
Subgroup Confinement Attacks
Subgroup confinement attacks can apply in offline and online contexts.
User-influenced Shell Commands Are Still Considered Harmful
Non-obvious ways of getting code execution when testing code that uses user input to build shell commands.
The GGH Cryptosystem
An introduction to lattice-based cryptography using the broken Goldreich–Goldwasser–Halevi (GGH) cryptosystem.
ASIS CTF 2016: RSA Write-up
Breaking RSA with sequential prime key parameter generation.
Tokyo Westerns / MMA CTF: Twin Primes Write-up
Decrypting RSA ciphertexts using correlated parameters.
Modifying IP Headers With netfilter
Using netfilter to programmtically rewrite the source IP address of ICMP packets.
Authorization Design Patterns
Patterns/anti-patterns for designing authorization APIs.
Iceland
Takeaways from my first trip to Iceland and places I hope to revisit.
Secure Password Hash Migrations
How to securely migrate from an insecure password hash algorithm to a secure one.
Fuzzing Servers
One tip for finding fast and useful fuzz targets for networked code.