Viewing profile — CiPHPerCoder

> However, donating money to an open collective is prohibitively hard for most big companies. You are absolutely correct. However, that's the mechanism that Frank has made availabl…

> Did you also check all of the libraries that implement the check differently to libsodium? Yes, but it was a breadth-first search sourced from the ianix webpage, so I certainly m…

I found several libraries that simply didn't implement the check, but none that implemented in incorrectly in the same way as the vulnerability discussed above. If you didn't recei…

From the article: If libsodium is useful to you, please keep in mind that it is maintained by one person, for free, in time I could spend with my family or on other projects. The b…

This also affected the PHP library, sodium_compat. https://github.com/FriendsOfPHP/security-advisories/pull/756 I'm planning to spend my evening checking every other Ed25519 implem…

Most people don't make their spam public, but I did when I ran this bounty program: https://hackerone.com/paragonie/hacktivity?type=team The policy was immediate full disclosure, u…

It's just an Ed25519 signature of a file. The closest thing we have to runtime code-signing are Phar signatures. https://www.php.net/manual/en/phar.fileformat.signature.php

While I appreciate the sentiment, I don't know that a hard fork is necessarily the right answer. https://scottarc.blog/2024/10/14/trust-rules-everything-arou...

I'd been staying out of this conflict, partly because I'm not really in the know on WP Engine's behavior behind-the-scenes and, as weird as Mullenweg's plays have been, I don't lik…

> There is not any reason to NOT run hybrid cryptography schemes right now, when the use case allows for it. This is reasonable, but runs contrary to the stance taken by CNSA 2.0.

> All the criticism of cryptographic agility that I have seen has involved an attacker negotiating a downgrade to a broken protocol. Consider this an additional data point, then: h…

Thanks for the feedback. I'll add a note after that section to make sure it's referenced appropriately. And especially thanks for taking the time to share your experiences and obse…

> A lot of posters here are fixating too much on the "stolen hard disk" picture which I think the article addressed by declaring it out of scope. So the real points aren't getting …

Sure, that's why I addressed the government in the immediate statement that followed the thing you quoted.

Okay, this sounds vaguely like a problem that may be solved by "HPKE where the secret key is reconstructed from a threshold secret sharing scheme" (>=2 of N shares needed, 1 held b…

> So I'm not so sure what's the point of encryption at rest in AWS except just to tick off a compliance and regulatory checklist. > The private key is with them anyway, just don't …

> The author is confusing "it costs us nothing (now that encryption can be done in hardware and is integrated into most desktop operating systems) and protects in some scenarios, s…

If you're using a secure disk encryption technology, and you manage to clear the keys from the TPM or overwrite the header containing the KDF salts and other metadata, that should …