Viewing profile — briansmith

Are they the authors of the “informal note” or not? I’ve never seen a math paper of any formality written without the authors’ names on it before.

> Two mathematicians at Anthropic studied and validated Claude’s paper, and produced an informal note for experts stating Claude’s proof concisely. Why hide the names of the people…

If differential parsing of X.509 certificates is a material security concern for something, then that's a bug in that thing.

Just to be clear, OpenSSL isn't doing the wrong thing, based on the description in the blog post. The specification allows and even requires behavior similar to that.

This is uninteresting. CAs are well aware that they have to encode the subject DN and issuer DN identically to maximize interoperability. There are several implementations that req…

Pretty much all the routers that are targeted by the ban would be OpenWrt derivatives, AFAICT. It’s basically the Android of routers, except without the Google resources. Google Wi…

> We have been assessing our existing processes (for OpenWrt, and especially the OpenWrt One) against NIST IR 8425A, and are now accelerating those efforts to ensure we can show th…

[I was at Mozilla during the development of BrowserID but I didn’t work directly on it. I was a huge fan of the effort.] Besides non-obvious UI issues, there were fundamental issue…

The purpose of a system is what it does.

Many implementations limit the RSA key size to 8,192 or 16,384 bits (because the maximum bit length determines indirectly how much stack space is required).

BenQ PD2730S.

Actions have special integration with GitHub (e.g. they can annotate the pull request review UI) using an API. If you forgo that integration, then you can absolutely use GitHub Act…

At https://rwc.iacr.org/2025/program.php you can see there is a talk scheduled to be given in a couple weeks titled "Testing Side-channel Security of Cryptographic Implementations …

Which CA's will issue short-lived certificates without negotiating a custom ($$$) contract with them?

Again, this is just a temporary situation, and a matter of burning down a list of small tasks. Not that the OpenSSL license issue is a big deal for most anyway. Feel free to help; …

> Maybe so, but pretty much all cryptographic primitives have to be written in assembly anyway to achieve constant time operation. This really oversimplifies the situation. Even at…

I think that's a really good question. The way this worked out is worth studying in detail. What was the process with which the AES-GCM cipher suites for SSH were developed? What w…

> But it took until 2023 for someone to do the legwork to figure out how broken it was. It took until 2023 for somebody to publicly disclose the problem. The first fix for it was d…

There are multiple reasons for a user to want "dark mode": * I just want everything to be dark on my screen because I like it. * I am trying to use this device in a dark place. * I…

The the old yanking policy was extra work I did with the intent to help people. It was unfortunate that Cargo had that bug, but also I should have been much more diplomatic in how …