Hey! I'm David, cofounder of zkSecurity and the author of the Real-World Cryptography book. I was previously a crypto architect at O(1) Labs (working on the Mina cryptocurrency), before that I was the security lead for Diem (formerly Libra) at Novi (Facebook), and a security consultant for the Cryptography Services of NCC Group. This is my blog about cryptography and security and other related topics that I find interesting.

# Video: How the RSA attacks using lattices work posted April 2015

This is my second video, after the first explaining how DPA works. I'm still trying to figure out how to do that but I think it is already better than the first one. Here I explain how Coppersmith used LLL, an algorithm to reduce lattices basis, to attack RSA. I also explain how his attack was simplified by Howgrave-Graham, and the following Boneh and Durfee attack simplified by Herrmann and May as well.

The repo is here, you can check the survey here as well.

comment on this story

# How would you detect an Evil Twin attack, especially in a new environment? posted April 2015

An interesting question on security.stackexchange

If two wifi have the same name, and you know one is there for a man in the middle attack, then how can you guess which one it is?

There are a lot of interesting answers, like triangulating the signal to see which one is your modem, or checking the MAC address...

comment on this story

# encryption with a one letter XOR? Really? posted April 2015

So there is this app that encrypts your data on your mobile, in case it ends up in the wrong hands. Sounds good. And then there is this guy who took a look at it and figured out the data was just XORed with a 128bit keys consisting of only 4s. If the data is longer than 128bits? Let's not encrypt it!

I don't know how legit it is, especially considering how easy it is to just write aes(something) but here you go

comment on this story

# Unix command of the day: Tee posted April 2015

The tee command allow you to write to a file and still display the result in output.

For exemple

ls

display the content of the current folder in stdout (the terminal)

ls > file.txt

saves that in a file file.txt

ls | tee file.txt

saves that in a file file.txt and displays in stdout at the same time

1 comment

# Truecrypt report posted April 2015

Some news about the Truecrypt open audit: the report is out.

The TL;DR is that based on this audit, Truecrypt appears to be a relatively well-designed piece of crypto software. The NCC audit found no evidence of deliberate backdoors, or any severe design flaws that will make the software insecure in most instances.

comment on this story