Bilingual

Understanding lattice risks: Many differences between marketing and reality
5 days ago
- The text criticizes a justification for using solo ML-KEM over ECC+ML-KEM by pointing out multiple flaws, including narrowing risk analysis to 'known' cryptanalysis, ignoring software vulnerabilities like timing attacks (e.g., KyberSlash), and excluding issues like tightness gaps in reductions.
- It highlights jargon misuse, such as 'cryptanalysis' excluding software bugs, 'module structure' ignoring other attack surfaces, and 'rank >=2' overlooking ideal-lattice attacks, while noting that claims about no known attacks better than generic lattice reduction have been disproven by recent research.
- The author argues that worst-case-to-average-case reductions for lattice problems are asymptotic and irrelevant to current parameters, while similar reductions exist for RSA and ECDLP, and emphasizes the need for ECC+PQ as a safety layer against PQ failures, criticizing IETF's procedural mishandling of the standardization vote.
wolfSSL vs. MbedTLS
6 days ago
- wolfCrypt consistently outperforms MbedTLS across multiple platforms (x86_64, ARMv8-A Cortex-A76, Cortex-M33, RISC-V), with speed advantages ranging from 1.4x to 53x, especially in public-key operations.
- wolfCrypt includes extensive hand-written assembly optimizations for hot paths on x86, ARM, and RISC-V, while MbedTLS relies more on portable C, leading to significant performance gaps.
- wolfSSL provides a complete post-quantum CNSA 2.0 suite (ML-KEM, ML-DSA, LMS, XMSS, SLH-DSA) and additional algorithms (e.g., EdDSA, AES-SIV) that MbedTLS does not support.
- wolfSSL offers broader portability, certifications (FIPS 140-3, DO-178C DAL-A, ISO 26262 ASIL D), commercial support, and features like OpenSSL compatibility and TLS inspection, unlike MbedTLS.
- wolfCrypt integrates with the Arm PSA Crypto API via wolfPSA, allowing drop-in replacement in PSA-based designs without rewriting applications, while maintaining performance and algorithm coverage.
NSA tries to weaken mlkem standardisation
3 days ago
- The NSA's SIGINT Enabling Project involves sabotaging cryptographic standards, including pushing for the 'ietf-tls-mlkem' standard which weakens the more sensible 'ietf-tls-ecdhe-mlkem'.
- After objections arose, NSA supporters shifted from direct demands to fake technical arguments; the NSA lost a recent IETF TLS vote but called another vote on June 24, 2026, packing the room with new supporters like Mike Jenkins.
- Individuals can oppose by joining the IETF TLS mailing list and sending a message by July 7, 2026, under the subject 'Re: [TLS] WG Last Call: draft-ietf-tls-mlkem-08' stating non-support, using real names to avoid dismissal.
- As of July 1, 2026, over 30 opposition statements exist, with examples from experts like Christian Grothoff, Orr Dunkelman, and others.
Soatok's Informal Guide to Threat Models
2 days ago
- Threat modeling is a key cybersecurity process, often misunderstood or used as a buzzword.
- A basic threat model should answer what assets are being protected, who the adversaries are, how attacks might occur, and prevention strategies.
- Important additional considerations include relationships between assets, assumptions made, and which threats are not being addressed.
- Threat models should be living documents, updated regularly as systems and threats evolve.
- Starting threat modeling involves mapping system components and iteratively analyzing them for risks and assumptions.
- Good threat models list assumptions, assets, actors, and risks with mitigation statuses (prevented, mitigated, addressable, open).
- Bad threat models are often incomplete lists of attacks without clear assets, assumptions, or relationships.
- Threat modeling helps improve security by identifying and mitigating risks, leading to better design choices like using passkeys over passwords.
- In decentralized systems, threat modeling reveals challenges such as ensuring message ordering and avoiding central authorities.
- Understanding threat models aids in evaluating technical debates, such as those around post-quantum cryptography and hybrid vs. pure algorithms.
Web-based cryptography is always snake oil
14 hours ago
- Web-based 'end-to-end' encryption is fundamentally flawed because the server operator, who you're supposedly securing against, distributes the client-side code and could push malicious updates.
- Such cryptosystems are incoherent as they fail to separate the entity being secured against from the one providing the implementation, making them essentially backdoored.
- Companies adopt snake oil cryptography primarily as a legal maneuver to avoid warrant and subpoena obligations, not to provide real security.
- Legal reliance on this model is risky, as government actions like in the Lavabit and FBI–Apple cases show that authorities can and do demand compromises.
- Web platform constraints inherently couple client-side code distribution with the service, making meaningful cryptosystems impossible without a paradigm shift.
- Potential fixes like using service workers with subresource integrity have limitations, such as trust-on-first-use issues and user verification challenges.

Hasty Briefsbeta

#cryptography

Understanding lattice risks: Many differences between marketing and reality

wolfSSL vs. MbedTLS

NSA tries to weaken mlkem standardisation

Soatok's Informal Guide to Threat Models

Web-based cryptography is always snake oil