Eight Bits of Trust; eMudhra's CA keys cracked in milliseconds

Scott Helme explains how eight eMudhra intermediate CA private keys were recoverable from their public certificates in under a second because the keys were trivially small, how Chrome and Mozilla responded with CRLSet/OneCRL blocks and root removal, why the compromise cannot be contained, and what site operators should do now.

Blog post · Security · Web PKI · Cryptography

The NIST Elliptic Curves Seeds Bounty Has Been Claimed

Filippo Valsorda reports that the long-mysterious seeds of the NIST P-curves were not hashes of forgotten sentences but drand48 output seeded with UNIX timestamps from 1997–98. A team from Anthropic solved it and claimed his bounty, donating the tripled $36,864 prize to ISRG, the non-profit behind Let's Encrypt.

Blog post · Cryptography · Security · History · Elliptic Curves

SequenceHash: multihashing for the rest of us

Multihashing is one of those cryptographic tasks that’s easy not to think about too much. This is unfortunate, because multihashing is a common stumbling point when cryptographers try to use hashes.

Blog post · Security · Cryptography · Open Source · Programming

The Gold-Bug: Edgar Allan Poe's story that taught me about cryptography

Sudheer Apte recalls how Edgar Allan Poe's short story The Gold-Bug, read in middle school in India, introduced him to cryptography. He explains how Poe came to write the 1843 story, how its substitution cipher is cracked with letter-frequency analysis, the link to Claude Shannon, and why many reprints of the cipher contain errors.

Blog post · Cryptography · History · Security