Hi, I'm Pascal! Cryptography Engineer at ELCASecurity, privacy enjoyer and tinkerer. Here I write about Cryptography and Security. For shorter and more frequent posts see:
Filen hashes passwords with MD5(MD4(MD2(pwd))). This post shows several cryptographic weaknesses in their protocol and questions if it's even worth doing end-to-end encryption delivered through a webpage.
Adding PQC to this product was like installing a vault door on a tent. The server could intercept your keys and an RCE let attackers run code on your desktop.
Proton says privacy "isn't a promise, it's mathematically ensured." I found new ways they could read your data anyway.
NIST finalized their first post quantum secure cryptographic algorithms in August 2024. This post provides a gentle introduction and an intuition on the actual impact.
Getting into the weeds of my flashy website banner, that simulates a padding-oracle attack on AES-CBC.
During my master thesis I reviewed the cryptography of the end-to-end encrypted Sharekey collaboration app. This post covers the most interesting issues I found.