My online identity comprises a number of accounts spread across dozens of websites and systems. They have different means of identity (e.g. usernames and e-mail addresses) and different modes of authentication (2FA, PIN codes, SSH keys, and traditional passwords). I’ve been using the pass tool to store the passwords for these. It’s a simple tool that follows the UNIX philosophy, storing every password in a separate GPG-encrypted file. It’s easy to understand and work with, and it comes with a number of useful integrations. However, I’ve been concerned about the fact that it doesn’t protect usernames or e-mail addresses—if an attacker can observe the password store, they can locate my accounts.
read more…
Daniel J. Bernstein has created a vast number of high-quality cryptographic primitives that have been accepted as state of the art, especially in pre-quantum cryptography. I was reading about the Ed25519 signature scheme when I noticed something interesting.
Ed25519 relies on a per-signature secret nonce, which is deterministically derived from the signer’s key and the message being signed. The rationale for not using a randomly generated nonce is that any collision (the signing of two different messages with the same nonce) will immediately reveal the secret key and compromise the system. Rather than trying to avoid this property, I’d like to examine it as a feature: there is at most one message for every nonce.
read more…
I am—
on ; by arya dradjicaThose three words are so hard to say.
I remember the first time. My heart was pounding so hard, I couldn’t hear her talking. I mumbled something about needing to tell her something important. I have no doubt she could hear the fear in my voice. I was looking down at my lap because I didn’t want her to see the terror in my eyes too.
“I am—”
read more…