Choose Your Backend: Three TLS Bugs in GoAhead

FoxIO researcher Sébastien Féry details three independent bugs in the TLS integrations of GoAhead, an embedded web server in hundreds of millions of IoT, firewall and industrial devices: revoked client certificates accepted on OpenSSL builds (CVSS 9.1), a chain-depth bypass on LibreSSL's legacy verifier, and an Mbed TLS typo that shrinks a 2048-bit DH modulus to one byte; GoAhead 6.1.1 fixes them.

Research · Security · Cryptography · IoT

Claude reveals ECDSA curve origins

Anthropic's Frontier Red Team explains how Claude helped uncover how the unexplained seeds behind the NIST ECDSA curves in FIPS 186-2 were generated: from timestamps fed into a standard random number generator, not a hidden passphrase. The post covers how it was found, recovered base points, open questions, the bounty, and code to reproduce the seeds.

Research · Cryptography · Security · AI · Elliptic Curves

Claude Fable 5.1 Solves the Cyphral DistichWe gave Claude Fable 5.1 an open task: solve an unsolved 370-year-old cipher. It solved it within a day.

Vals AI reports that Claude Fable 5.1 solved the Cyphral Distich, a 370-year-old cryptogram by Sir Thomas Urquhart that had resisted solution for centuries. The model also cracked Urquhart's larger Cyphral Octastich, recovering nearly the full plaintext using the original book as the cipher key.

Research · LLMs · AI · Cryptography · History