#cryptography

Articles tagged with #cryptography

Verifying Why zeroize Matters: Dead-Store Elimination and Memory Remanence in Rust
Part 2 of the "Building a Memory-Safe File Encryptor in Rust" series. Part 1 covered the encryptor's design decisions - Argon2id, AES-GCM, the file format, and a first pass at zeroizing secrets in mem
Sep 22, 20267 min read2
What Building a File Encryptor in Rust Taught Me About Authenticated Encryption
What this does A command-line tool that encrypts a single file with a password. Under the hood: Argon2id turns your password into a 256-bit key, AES-256-GCM encrypts the file with that key, and everyt
Sep 20, 20266 min read2
JWT Attack Lab — Part 8: Algorithm Confusion, and a Bug the Attack Uncovered By Accident
Part 8, the final stage in a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 7 closed a gap in expiry enforcement. This last stag
Jul 18, 20265 min read2
JWT Attack Lab — Part 6: Spoofing the JWKS URL an RSA Verifier Trusts
Part 6 of a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 5 exploited kid to point a local file lookup somewhere unintended. Th
Jul 18, 20264 min read
JWT Attack Lab — Part 4: Cracking a Weak HMAC Secret With Hashcat
Part 4 of a series building a Flask API with JWT authentication, then deliberately exploiting six real vulnerabilities in it. Part 3 fixed the alg: none bypass by explicitly restricting which algorith
Jul 18, 20264 min read1
Building a PKI From Scratch, Part 1: The Root CA
What this does I'm building a complete Public Key Infrastructure by hand - a Root Certificate Authority, an Intermediate CA, end-entity certificate issuance, revocation, and CRL generation - using Pyt
Jul 13, 20266 min read6