Topic: cryptography
-
Checking whether a TLS connection actually negotiated X25519MLKEM768
Distinguish an installed post-quantum capability from the group selected on a real TLS connection, using browser details, OpenSSL, curl and server-side evidence.
-
OpenSSH post-quantum defaults and the non-post-quantum key-exchange warning
Trace OpenSSH's warning to the selected key exchange, check effective settings on both peers, and restore hybrid negotiation without weakening host authentication.
-
Encryption at rest: what it protects against and what it does not
Volume encryption protects data on stolen or discarded drives and on media that leaves the building; while the system is running and mounted, every process with read access sees plaintext, so it does nothing against SQL injection, a stolen application credential or a compromised host. Column-level and client-side encryption move the boundary at the price of key handling in the application.
-
Post-quantum signatures and public TLS certificates: separate readiness checks
ML-DSA and SLH-DSA are standardized signature algorithms, but public TLS certificate issuance also depends on certificate profiles, protocol integration and trust-policy acceptance.
-
Building and maintaining a cryptographic inventory for post-quantum migration
Record where cryptography protects data, who owns each dependency, and what evidence supports the record. Use a CycloneDX CBOM to exchange technical assets without mistaking it for a complete migration plan.
-
Finding TLS group pins that prevent applications from adopting hybrid defaults
Audit explicit group lists in Go, Java, nginx and OpenSSL configuration before assuming a library upgrade enables post-quantum key exchange.
-
Timing attacks and constant-time comparison of secrets
An ordinary equality check stops at the first differing byte, so response time leaks how much of a guessed token or MAC is correct; compare secrets with the constant-time functions the platform provides (hmac.compare_digest, crypto.timingSafeEqual, subtle.ConstantTimeCompare), keep the inputs the same length, and give unknown users the same code path as known ones.
-
Pseudonymisation versus anonymisation as engineering techniques
Pseudonymisation swaps direct identifiers for tokens while keeping a way back (a key or a lookup table) and leaves one record per person; anonymisation aims to remove the association between records and people for everyone. Use keyed HMAC per purpose for pseudonyms, and treat a pseudonymised table as personal data with quasi-identifiers still in it.
Machine-readable: JSON