1
Stuxnet was embarrassing, not amazing (2011)
As the New York Times posts yet another breathless story about Stuxnet, I’m surprised that no one has pointed out its obvious deficiencies. Everyone seems to be hyperventilating about its pur…
Nate Lawson
Embedded security, cryptography, software protection
- Popular posts
- 5
- Total points
- 513
- HN comments
- 387
- Rank
- #4,997 personal
Visit rdist.root.org → RSS feedOn Hacker News May 2009 – Nov 2019
Security & Privacy 4Software Engineering 2Society, Policy & Culture 1Networking & Internet 1History & Retro Computing 1
2
Nate Lawson Breaks Google Keyczar's HMAC Crypto Signatures
I recently found a security flaw in the Google Keyczar crypto library. The impact was that an attacker could forge signatures for data that was “signed” with the SHA-1 HMAC algorithm (t…
3
H(m || k) also insecure, you really should use HMAC
The HMAC construction turns a cryptographic hash algorithm into a keyed hash. It is commonly used for integrity protection when the sender and recipient share a secret key. It was developed to addr…
4
Final post on Javascript crypto
The talk I gave last year on common crypto flaws still seems to generate comments. The majority of the discussion is by defenders of Javascript crypto. I made JS crypto a very minor part of the tal…