Side channels! Frequency scaling! Key encapsulation, oh my! We're talking about the new Hertzbleed paper, but also cryptography conferences, 'passkeys', and end-to-end encrypting yer twitter.com DMs.Transcript: https://share.descript.com/view/lPM4lsxha63 Links:Hertzbleed Attack | ellipticnews (wordpress.com)https://www.hertzbleed.com/hertzbleed.pdfhttps://papers.ssrn.com/sol3/papers.cfm?abstract_id=3920031Merch: https://merch.scwpodcast.com"Security. Cryptography. Whatever." is hosted by Deirdre Connolly, Thomas Ptacek, and David Adrian. 

Side channels! Frequency scaling! Key encapsulation, oh my! We're talking about the new Hertzbleed paper, but also cryptography conferences, 'passkeys', and end-to-end encrypting yer <a href="http://twitter.com" rel="nofollow" target="_blank">twitter.com</a> DMs. Transcript: <a href="https://share.descript.com/view/lPM4lsxha63" rel="nofollow" target="_blank">https://share.descript.com/view/lPM4lsxha63</a>  Links:<ul><li><a href="https://ellipticnews.wordpress.com/2022/06/14/hertzbleed-attack/" rel="nofollow" target="_blank">Hertzbleed Attack | ellipticnews (wordpress.com)</a></li><li><a href="https://www.hertzbleed.com/hertzbleed.pdf" rel="nofollow" target="_blank">https://www.hertzbleed.com/hertzbleed.pdf</a></li><li><a href="https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3920031" rel="nofollow" target="_blank">https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3920031</a></li></ul>Merch: <a href="https://merch.scwpodcast.com/" rel="nofollow" target="_blank">https://merch.scwpodcast.com</a> "Security. Cryptography. Whatever." is hosted by <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">Deirdre Connolly</a>, <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">Thomas Ptacek</a>, and <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">David Adrian</a>.

Hertzbleed

Eric Mill

The US government released a memo about moving to a zero-trust network architecture. What does this mean? We have one of the authors, Eric Mill, on to explain it to us.As always, your @SCWPod hosts are Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@davidcadrian).Transcript: https://share.descript.com/view/UayEVA596OKLinks:OMB MemoExecutive order on cybersecurity PIV card Derived PIVBeyondCorpHSTS Preloading.gov preloading Neither Rain, Nor Snow, Nor MITMEDR memoTechnology Transformation Services (TTS)Is it Christmas?

The US government <a href="https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf" rel="nofollow" target="_blank">released a memo</a> about moving to a zero-trust network architecture. What does this mean? We have one of the authors, <a href="https://konklone.com/" rel="nofollow" target="_blank">Eric Mill</a>, on to explain it to us. As always, your <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">@SCWPod</a> hosts are Deirdre Connolly (<a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">@durumcrustulum</a>), Thomas Ptacek (<a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">@tqbf</a>), and David Adrian (<a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">@davidcadrian</a>). Transcript: <a href="https://share.descript.com/view/UayEVA596OK" rel="nofollow" target="_blank">https://share.descript.com/view/UayEVA596OK</a> Links:<ul><li><a href="https://www.whitehouse.gov/wp-content/uploads/2022/01/M-22-09.pdf" rel="nofollow" target="_blank">OMB Memo</a></li><li><a href="https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity" rel="nofollow" target="_blank">Executive order on cybersecurity</a> </li><li><a href="https://www.oit.va.gov/programs/piv/index.cfm" rel="nofollow" target="_blank">PIV card</a> <ul><li><a href="https://csrc.nist.gov/publications/detail/sp/800-157/final" rel="nofollow" target="_blank">Derived PIV</a></li></ul></li><li><a href="https://cloud.google.com/beyondcorp" rel="nofollow" target="_blank">BeyondCorp</a></li><li><a href="https://hstspreload.org/" rel="nofollow" target="_blank">HSTS Preloading</a><ul><li><a href="https://home.dotgov.gov/management/preloading/" rel="nofollow" target="_blank">.gov preloading</a> </li></ul></li><li><a href="https://jhalderm.com/pub/papers/mail-imc15.pdf" rel="nofollow" target="_blank">Neither Rain, Nor Snow, Nor MITM</a></li><li><a href="https://www.whitehouse.gov/wp-content/uploads/2021/10/M-22-01.pdf" rel="nofollow" target="_blank">EDR memo</a></li><li><a href="https://join.tts.gsa.gov/" rel="nofollow" target="_blank">Technology Transformation Services (TTS)</a></li><li><a href="https://isitchristmas.com/" rel="nofollow" target="_blank">Is it Christmas?</a></li></ul>

OMB Zero Trust Memo, with Eric Mill

We talk about Tink with Sophie Schmieg, a cryptographer and algebraic geometer at Google.Transcript: https://beta-share.descript.com/view/v2Q5Ix8pvbDLinks:Sophie: https://twitter.com/SchmiegSophieTink: https://github.com/google/tinkRWC talk: https://youtube.com/watch?t=1028&amp;v=CiH6iqjWpt8Where to store keys: https://twitter.com/SchmiegSophie/status/1413502566797778948EAX mode: https://en.wikipedia.org/wiki/EAX_modeAES-GCM-SIV: https://en.wikipedia.org/wiki/AES-GCM-SIVDeterministic AEADs: https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#deterministic-authenticated-encryption-with-associated-dataThai Duong: https://twitter.com/XorNinjaAWS-SDK Vuln: https://twitter.com/XorNinja/status/1310587707605659649"Security. Cryptography. Whatever." is hosted by Deirdre Connolly, Thomas Ptacek, and David Adrian. 

We talk about Tink with Sophie Schmieg, a cryptographer and algebraic geometer at Google. Transcript: <a href="https://beta-share.descript.com/view/v2Q5Ix8pvbD" rel="nofollow" target="_blank">https://beta-share.descript.com/view/v2Q5Ix8pvbD</a> Links:<ul><li>Sophie: <a href="https://twitter.com/SchmiegSophie" rel="nofollow" target="_blank">https://twitter.com/SchmiegSophie</a></li><li>Tink: <a href="https://github.com/google/tink" rel="nofollow" target="_blank">https://github.com/google/tink</a></li><li>RWC talk: <a href="https://youtube.com/watch?t=1028&amp;v=CiH6iqjWpt8" rel="nofollow" target="_blank">https://youtube.com/watch?t=1028&amp;v=CiH6iqjWpt8</a></li><li>Where to store keys: <a href="https://twitter.com/SchmiegSophie/status/1413502566797778948" rel="nofollow" target="_blank">https://twitter.com/SchmiegSophie/status/1413502566797778948</a></li><li>EAX mode: <a href="https://en.wikipedia.org/wiki/EAX_mode" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/EAX_mode</a></li><li>AES-GCM-SIV: <a href="https://en.wikipedia.org/wiki/AES-GCM-SIV" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/AES-GCM-SIV</a></li><li>Deterministic AEADs: <a href="https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#deterministic-authenticated-encryption-with-associated-data" rel="nofollow" target="_blank">https://github.com/google/tink/blob/master/docs/PRIMITIVES.md#deterministic-authenticated-encryption-with-associated-data</a></li><li>Thai Duong: <a href="https://twitter.com/XorNinja" rel="nofollow" target="_blank">https://twitter.com/XorNinja</a></li><li>AWS-SDK Vuln: <a href="https://twitter.com/XorNinja/status/1310587707605659649" rel="nofollow" target="_blank">https://twitter.com/XorNinja/status/1310587707605659649</a></li></ul>"Security. Cryptography. Whatever." is hosted by <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">Deirdre Connolly</a>, <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">Thomas Ptacek</a>, and <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">David Adrian</a>.

Tink, with Sophie Schmieg

Live from Amsterdam, it's cancellable crypto hot takes! A fun little meme, plus a preview of the Real World Crypto program!Transcript: https://share.descript.com/view/GiVlw4qKV2iLinks:Tony's twete: https://twitter.com/bascule/status/1512539700220805124Real World Crypto 2022: https://rwc.iacr.org/2022Merch! https://merch.scwpodcast.comFind us at:https://twitter.com/scwpodhttps://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrian

Live from Amsterdam, it's cancellable crypto hot takes! A fun little meme, plus a preview of the Real World Crypto program! Transcript: <a href="https://share.descript.com/view/GiVlw4qKV2i" rel="nofollow" target="_blank">https://share.descript.com/view/GiVlw4qKV2i</a> Links: Tony's twete: <a href="https://twitter.com/bascule/status/1512539700220805124" rel="nofollow" target="_blank">https://twitter.com/bascule/status/1512539700220805124</a> Real World Crypto 2022: <a href="https://rwc.iacr.org/2022" rel="nofollow" target="_blank">https://rwc.iacr.org/2022</a> Merch! <a href="https://merch.scwpodcast.com" rel="nofollow" target="_blank">https://merch.scwpodcast.com</a> Find us at: <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a> <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a>

Cancellable Crypto Takes, and Real World Crypto 

We're back! With an episode on lattice-based cryptography, with Professor Chris Peikert of the University of Michigan, David's alma mater. When we recorded this, Michigan football had just beaten Ohio for the first time in a bajillion years, so you get a nerdy coda on college football this time!Transcript: https://share.descript.com/view/El2a4Z7OLsdSlides: https://web.eecs.umich.edu/~cpeikert/pubs/slides-qcrypt.pdfLinks:He Gives C-Sieves on the CSIDH: https://eprint.iacr.org/2019/725Lattice-based Cryptography: https://cims.nyu.edu/~regev/papers/pqc.pdfNIST PQC Competition: https://csrc.nist.gov/Projects/post-quantum-cryptography The 2nd Bar Ilan Winter School on Cryptography Lattice- Based Cryptography and Applications: https://www.youtube.com/playlist?list=PL8Vt-7cSFnw2OmpCmPLLwSx0-Yqb2ptqOA Decade of Lattice Cryptography: https://eprint.iacr.org/2015/939.pdfFind us at:https://twitter.com/scwpodhttps://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrian

We're back! With an episode on lattice-based cryptography, with Professor Chris Peikert of the University of Michigan, David's alma mater. When we recorded this, Michigan football had just beaten Ohio for the first time in a bajillion years, so you get a nerdy coda on college football this time! Transcript: <a href="https://share.descript.com/view/El2a4Z7OLsd" rel="nofollow" target="_blank">https://share.descript.com/view/El2a4Z7OLsd</a> Slides: <a href="https://web.eecs.umich.edu/~cpeikert/pubs/slides-qcrypt.pdf" rel="nofollow" target="_blank">https://web.eecs.umich.edu/~cpeikert/pubs/slides-qcrypt.pdf</a> Links: He Gives C-Sieves on the CSIDH: <a href="https://eprint.iacr.org/2019/725" rel="nofollow" target="_blank">https://eprint.iacr.org/2019/725</a> Lattice-based Cryptography: <a href="https://cims.nyu.edu/~regev/papers/pqc.pdf" rel="nofollow" target="_blank">https://cims.nyu.edu/~regev/papers/pqc.pdf</a> NIST PQC Competition: <a href="https://csrc.nist.gov/Projects/post-quantum-cryptography" rel="nofollow" target="_blank">https://csrc.nist.gov/Projects/post-quantum-cryptography</a> The 2nd Bar Ilan Winter School on Cryptography Lattice- Based Cryptography and Applications: <a href="https://www.youtube.com/playlist?list=PL8Vt-7cSFnw2OmpCmPLLwSx0-Yqb2ptqO" rel="nofollow" target="_blank">https://www.youtube.com/playlist?list=PL8Vt-7cSFnw2OmpCmPLLwSx0-Yqb2ptqO</a> A Decade of Lattice Cryptography: <a href="https://eprint.iacr.org/2015/939.pdf" rel="nofollow" target="_blank">https://eprint.iacr.org/2015/939.pdf</a> Find us at: <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a> <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a>

Lattices and Michigan Football, feat. Chris Peikert

We've trashed JWTs, discussed PASETO, Macaroons, and now, Biscuits! Actually, multiple iterations of Biscuits! Pairings and gamma signatures and Datalog, oh my! 🍪 Transcript: https://beta-share.descript.com/view/jHZJPab0n4gLinks:Biscuits V2: https://www.biscuitsec.orgExperiments iterating on  Biscuits: https://github.com/biscuit-auth/biscuit/tree/master/experimentationsApache Pulsar: https://pulsar.apache.orgSpec: https://github.com/biscuit-auth/biscuit/blob/master/SPECIFICATIONS.mdFind us at:https://twitter.com/scwpodhttps://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrian

We've trashed JWTs, discussed PASETO, Macaroons, and now, Biscuits! Actually, multiple iterations of Biscuits! Pairings and gamma signatures and Datalog, oh my! 🍪  Transcript: <a href="https://beta-share.descript.com/view/jHZJPab0n4g" rel="nofollow" target="_blank">https://beta-share.descript.com/view/jHZJPab0n4g</a> Links: Biscuits V2: <a href="https://www.biscuitsec.org/" rel="nofollow" target="_blank">https://www.biscuitsec.org</a> Experiments iterating on  Biscuits: <a href="https://github.com/biscuit-auth/biscuit/tree/master/experimentations" rel="nofollow" target="_blank">https://github.com/biscuit-auth/biscuit/tree/master/experimentations</a> Apache Pulsar: <a href="https://pulsar.apache.org/" rel="nofollow" target="_blank">https://pulsar.apache.org</a> Spec: <a href="https://github.com/biscuit-auth/biscuit/blob/master/SPECIFICATIONS.md" rel="nofollow" target="_blank">https://github.com/biscuit-auth/biscuit/blob/master/SPECIFICATIONS.md</a> Find us at: <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a> <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a>

Biscuits, feat. Geoffroy Couprie

Avery Pennarun

“Can I Tailscale my Chromecast?” You love Tailscale, I love Tailscale, we loved talking to Avery Pennarun and Brad Fitzpatrick from Tailscale about, I dunno, Go generics. Oh, and TAILSCALE! And DNS. And WASM.People:Avery Pennarun (@apenwarr)Brad Fitzpatrick (@bradfitz)Deirdre Connolly (@durumcrustulum)Thomas Ptacek (@tqbf)David Adrian (@davidcadrian)@SCWPodLinks:DERP server: https://github.com/tailscale/tailscale/tree/main/derphttps://xtermjs.org/The Tail at Scale : https://research.google/pubs/pub40801/Raft: https://raft.github.io/Litestream: https://litestream.io/MagicDNS: https://tailscale.com/kb/1081/magicdns/Netstack: https://github.com/google/netstackTranscript: https://share.descript.com/view/2NAe5jEcEqB

“Can I Tailscale my Chromecast?”  You love Tailscale, I love Tailscale, we loved talking to Avery Pennarun and Brad Fitzpatrick from Tailscale about, I dunno, Go generics. Oh, and TAILSCALE! And DNS. And WASM. People:<ul><li>Avery Pennarun (@apenwarr)</li><li>Brad Fitzpatrick (@bradfitz)</li><li>Deirdre Connolly (@durumcrustulum)</li><li>Thomas Ptacek (@tqbf)</li><li>David Adrian (@davidcadrian)</li><li>@SCWPod</li></ul>Links:<ul><li>DERP server: <a href="https://github.com/tailscale/tailscale/tree/main/derp" rel="nofollow" target="_blank">https://github.com/tailscale/tailscale/tree/main/derp</a></li><li><a href="https://xtermjs.org/" rel="nofollow" target="_blank">https://xtermjs.org/</a></li><li>The Tail at Scale : <a href="https://research.google/pubs/pub40801/" rel="nofollow" target="_blank">https://research.google/pubs/pub40801/</a></li><li>Raft: <a href="https://raft.github.io/" rel="nofollow" target="_blank">https://raft.github.io/</a></li><li>Litestream: <a href="https://litestream.io/" rel="nofollow" target="_blank">https://litestream.io/</a></li><li>MagicDNS: <a href="https://tailscale.com/kb/1081/magicdns/" rel="nofollow" target="_blank">https://tailscale.com/kb/1081/magicdns/</a></li><li>Netstack: <a href="https://github.com/google/netstack" rel="nofollow" target="_blank">https://github.com/google/netstack</a></li></ul>Transcript: <a href="https://share.descript.com/view/2NAe5jEcEqB" rel="nofollow" target="_blank">https://share.descript.com/view/2NAe5jEcEqB</a>

Tailscale, feat. Avery Pennarun and Brad Fitzpatrick

Colm MacCárthaigh

We recorded this months ago, and now it's finally up! Colm MacCárthaigh joined us to chat about all things TLS, S2N, MTLS, SSH, fuzzing, formal verification, implementing state machines, and of course, DNSSEC.Transcript: https://share.descript.com/view/tjrQu8wZKT0Find us at:https://twitter.com/scwpodhttps://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrian

We recorded this months ago, and now it's finally up! Colm MacCárthaigh joined us to chat about all things TLS, <a href="https://github.com/aws/s2n-tls" rel="nofollow" target="_blank">S2N</a>, MTLS, SSH, fuzzing, formal verification, implementing state machines, and of course, DNSSEC. Transcript: <a href="https://share.descript.com/view/tjrQu8wZKT0" rel="nofollow" target="_blank">https://share.descript.com/view/tjrQu8wZKT0</a> Find us at: <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a> <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a>

The feeling's mutual: mTLS, feat. Colm MacCárthaigh

Happy New Year! Feliz Navidad! Merry Yule! Happy Hannukah! Pour one out for the log4j incident responders!We did a call-in episode on Twitter Spaces and recorded it, so that's why the audio sounds different. We talked about BLOCKCHAIN/Web3 (blech), testing, post-quantum crypto, client certificates, ssh client certificates, threshold cryptography, U2F/WebAuthn, car fob attacks, geese, and more!Transcript: https://share.descript.com/view/N9ROtj1AiW0Find us at:https://twitter.com/scwpodhttps://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrian 

Happy New Year! Feliz Navidad! Merry Yule! Happy Hannukah! Pour one out for the log4j incident responders! We did a call-in episode on Twitter Spaces and recorded it, so that's why the audio sounds different. We talked about BLOCKCHAIN/Web3 (blech), testing, post-quantum crypto, client certificates, ssh client certificates, threshold cryptography, U2F/WebAuthn, car fob attacks, geese, and more! Transcript: <a href="https://share.descript.com/view/N9ROtj1AiW0" rel="nofollow" target="_blank">https://share.descript.com/view/N9ROtj1AiW0</a> Find us at: <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a> <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a>

Holiday Call-in Spectacular!

Jason Donenfeld

Hey, a new episode! We had a fantastic conversation with Jason Donenfeld, creator of our favorite modern VPN protocol: WireGuard! We touched on kernel hacking, formal verification, post-quantum cryptography, developing with disassemblers, and more!Transcript: https://share.descript.com/view/olVgXGtRpsYLinks: WireGuard: https://www.wireguard.comTamarin: https://tamarin-prover.github.ioIDApro: https://hex-rays.com/ida-proNIST PQC: https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissionsWireGuard Patreon: https://www.patreon.com/zx2c4

Hey, a new episode! We had a fantastic conversation with Jason Donenfeld, creator of our favorite modern VPN protocol: WireGuard! We touched on kernel hacking, formal verification, post-quantum cryptography, developing with disassemblers, and more! Transcript: <a href="https://share.descript.com/view/olVgXGtRpsY" rel="nofollow" target="_blank">https://share.descript.com/view/olVgXGtRpsY</a> Links: <ul><li>WireGuard: <a href="https://blog.cryptographyengineering.com/should-you-use-srp" rel="nofollow" target="_blank">https://www.wireguard.com</a></li><li>Tamarin: <a href="https://tamarin-prover.github.io" rel="nofollow" target="_blank">https://tamarin-prover.github.io</a></li><li>IDApro: <a href="https://hex-rays.com/ida-pro" rel="nofollow" target="_blank">https://hex-rays.com/ida-pro</a></li><li>NIST PQC: <a href="https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissions" rel="nofollow" target="_blank">https://csrc.nist.gov/projects/post-quantum-cryptography/round-3-submissions</a></li><li>WireGuard Patreon: <a href="https://www.patreon.com/zx2c4" rel="nofollow" target="_blank">https://www.patreon.com/zx2c4</a></li></ul>

WireGuard, feat. Jason Donenfeld

Some cryptography &amp; security people talk about security, cryptography, and whatever else is happening.

A conversation that started with PAKEs (password-authenticated key exchanges) and touched on some cool math things: PRFs, finite fields, elliptic curve groups, anonymity protocols, hashing to curve groups, prime order groups, and more. With special guest, George Tankersley!Transcript: https://share.descript.com/view/X8x8oO2Q8TwLinks: SRP deprecation: https://blog.cryptographyengineering.com/should-you-use-srpOPAQUE: https://www.ietf.org/id/draft-irtf-cfrg-opaque-06.htmlobfs: https://github.com/shadowsocks/simple-obfsElligator: https://elligator.cr.yp.toHash to Curve: https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-12.htmlMagic Wormhole: https://github.com/magic-wormhole/magic-wormholeBiscuits: https://github.com/CleverCloud/biscuitRistretto: https://ristretto.groupMonero signature bug: https://www.getmonero.org/ru/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.htmlSIDH smooth-order supersingular curves: https://link.springer.com/chapter/10.1007/978-3-662-53018-4_21

A conversation that started with PAKEs (password-authenticated key exchanges) and touched on some cool math things: PRFs, finite fields, elliptic curve groups, anonymity protocols, hashing to curve groups, prime order groups, and more. With special guest, George Tankersley! Transcript: <a href="https://share.descript.com/view/X8x8oO2Q8Tw" rel="nofollow" target="_blank">https://share.descript.com/view/X8x8oO2Q8Tw</a> Links: <ul><li>SRP deprecation: <a href="https://blog.cryptographyengineering.com/should-you-use-srp" rel="nofollow" target="_blank">https://blog.cryptographyengineering.com/should-you-use-srp</a></li><li>OPAQUE: <a href="https://www.ietf.org/id/draft-irtf-cfrg-opaque-06.html" rel="nofollow" target="_blank">https://www.ietf.org/id/draft-irtf-cfrg-opaque-06.html</a></li><li>obfs: <a href="https://github.com/shadowsocks/simple-obfs" rel="nofollow" target="_blank">https://github.com/shadowsocks/simple-obfs</a></li><li>Elligator: <a href="https://elligator.cr.yp.to/" rel="nofollow" target="_blank">https://elligator.cr.yp.to</a></li><li>Hash to Curve: <a href="https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-12.html" rel="nofollow" target="_blank">https://www.ietf.org/archive/id/draft-irtf-cfrg-hash-to-curve-12.html</a></li><li>Magic Wormhole: <a href="https://github.com/magic-wormhole/magic-wormhole" rel="nofollow" target="_blank">https://github.com/magic-wormhole/magic-wormhole</a></li><li>Biscuits: <a href="https://github.com/CleverCloud/biscuit" rel="nofollow" target="_blank">https://github.com/CleverCloud/biscuit</a></li><li>Ristretto: <a href="https://ristretto.group/" rel="nofollow" target="_blank">https://ristretto.group</a></li><li>Monero signature bug: <a href="https://www.getmonero.org/ru/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html" rel="nofollow" target="_blank">https://www.getmonero.org/ru/2017/05/17/disclosure-of-a-major-bug-in-cryptonote-based-currencies.html</a></li><li>SIDH smooth-order supersingular curves: <a href="https://link.springer.com/chapter/10.1007/978-3-662-53018-4_21" rel="nofollow" target="_blank">https://link.springer.com/chapter/10.1007/978-3-662-53018-4_21</a></li></ul>

PAKEs, oPRFs, algebra, feat. George Tankersley

A lot of fixes got pushed in the past week! Please apply your updates! Apple, Chrome, Matrix, Azure, and more nonsense.Find us at:https://twitter.com/scwpodhttps://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrianLinks!The accuvant story in MIT Technology ReviewAll the Apple platforms patched FORCEDENTRY no-click 0-dayChrome patched some 0-days that were being exploited in the wildPASETO update Transcript: https://share.descript.com/view/Um4im6a3dqj

A lot of fixes got pushed in the past week! Please apply your updates! Apple, Chrome, Matrix, Azure, and more nonsense. Find us at: <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a> <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a> Links! <a href="https://www.technologyreview.com/2021/09/15/1035813/us-sold-iphone-exploit-uae" rel="nofollow" target="_blank">The accuvant story in MIT Technology Review</a> All the Apple platforms <a href="https://support.apple.com/en-us/HT212807" rel="nofollow" target="_blank">patched</a> <a href="https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/" rel="nofollow" target="_blank">FORCEDENTRY</a> no-click 0-day Chrome <a href="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html" rel="nofollow" target="_blank">patched some 0-days</a> that were being exploited in the wild PASETO <a href="https://paragonie.com/blog/2021/09/promoting-misuse-resistance-in-paseto-libraries" rel="nofollow" target="_blank">update</a> Transcript: <a href="https://share.descript.com/view/Um4im6a3dqj" rel="nofollow" target="_blank">https://share.descript.com/view/Um4im6a3dqj</a>

"Patch, Damnit!"

Not the hero the internet deserves, but the one we need: it's Ryan Sleevi!We get into the weeds on becoming a certificate authority, auditing said authorities, DNSSEC, DANE, taking over country code top level domains, Luxembourg, X.509, ASN.1, CBOR, more JSON (!), ACME, Let's Encrypt, and more, on this extra lorge episode with the web PKI's Batman.Transcript: https://share.descript.com/view/61pZGOJlqu6Find us at:https://twitter.com/scwpodhttps://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrian

Not the hero the internet deserves, but the one we need: it's Ryan Sleevi! We get into the weeds on becoming a certificate authority, auditing said authorities, DNSSEC, DANE, taking over country code top level domains, Luxembourg, X.509, ASN.1, CBOR, more JSON (!), ACME, Let's Encrypt, and more, on this extra lorge episode with the web PKI's Batman. Transcript: <a href="https://share.descript.com/view/61pZGOJlqu6" rel="nofollow" target="_blank">https://share.descript.com/view/61pZGOJlqu6</a> Find us at: <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a> <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a>

How to be a Certificate Authority, feat. Ryan Sleevi

Matthew Green

We're talking about Apple's new proposed client-side CSAM detection system. We weren't sure if we were going to cover this, and then we realized that not all of us have been paying super close attention to what the hell this thing is, and have a lot of questions about it. So we're talking about it, with our special guest Professor Matthew Green.We cover how Apple's system works, what it does (and doesn't), where we have unanswered questions, and where some of the gaps are.Transcript: https://share.descript.com/view/cEni6L9rMxIFind us at:https://twitter.com/scwpodhttps://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrianLinks:https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdfhttps://www.apple.com/child-safety/pdf/Apple_PSI_System_Security_Protocol_and_Analysis.pdfhttps://www.law.cornell.edu/uscode/text/18/2258Ahttps://www.missingkids.org/content/dam/missingkids/gethelp/2020-reports-by-esp.pdfhttps://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CThttps://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_doeshttps://research.fb.com/blog/2021/02/understanding-the-intentions-of-child-sexual-abuse-material-csam-sharers/https://www.nytimes.com/interactive/2019/11/09/us/internet-child-sex-abuse.htmlhttps://www.apple.com/child-safety/pdf/Expanded_Protections_for_Children_Frequently_Asked_Questions.pdf

We're talking about Apple's new proposed <a href="https://www.apple.com/child-safety/" rel="nofollow" target="_blank">client-side CSAM detection system</a>. We weren't sure if we were going to cover this, and then we realized that not all of us have been paying super close attention to what the hell this thing is, and have a lot of questions about it. So we're talking about it, with our special guest Professor Matthew Green. We cover how Apple's system works, what it does (and doesn't), where we have unanswered questions, and where some of the gaps are. Transcript: <a href="https://share.descript.com/view/cEni6L9rMxI" rel="nofollow" target="_blank">https://share.descript.com/view/cEni6L9rMxI</a> Find us at: <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a> <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a> Links: <a href="https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf" rel="nofollow" target="_blank">https://www.apple.com/child-safety/pdf/CSAM_Detection_Technical_Summary.pdf</a><a href="https://www.apple.com/child-safety/pdf/Apple_PSI_System_Security_Protocol_and_Analysis.pdf" rel="nofollow" target="_blank">https://www.apple.com/child-safety/pdf/Apple_PSI_System_Security_Protocol_and_Analysis.pdf</a><a href="https://www.law.cornell.edu/uscode/text/18/2258A" rel="nofollow" target="_blank">https://www.law.cornell.edu/uscode/text/18/2258A</a><a href="https://www.missingkids.org/content/dam/missingkids/gethelp/2020-reports-by-esp.pdf" rel="nofollow" target="_blank">https://www.missingkids.org/content/dam/missingkids/gethelp/2020-reports-by-esp.pdf</a><a href="https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT" rel="nofollow" target="_blank">https://www.reuters.com/article/us-apple-fbi-icloud-exclusive/exclusive-apple-dropped-plan-for-encrypting-backups-after-fbi-complained-sources-idUSKBN1ZK1CT</a><a href="https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does" rel="nofollow" target="_blank">https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_what_it_does</a><a href="https://research.fb.com/blog/2021/02/understanding-the-intentions-of-child-sexual-abuse-material-csam-sharers/" rel="nofollow" target="_blank">https://research.fb.com/blog/2021/02/understanding-the-intentions-of-child-sexual-abuse-material-csam-sharers/</a><a href="https://www.nytimes.com/interactive/2019/11/09/us/internet-child-sex-abuse.html" rel="nofollow" target="_blank">https://www.nytimes.com/interactive/2019/11/09/us/internet-child-sex-abuse.html</a><a href="https://www.apple.com/child-safety/pdf/Expanded_Protections_for_Children_Frequently_Asked_Questions.pdf" rel="nofollow" target="_blank">https://www.apple.com/child-safety/pdf/Expanded_Protections_for_Children_Frequently_Asked_Questions.pdf</a>

Apple's CSAM Detection, feat. Matthew Green

We did not run out of things to talk about: Chrome vs. Safari vs. Firefox. Rust vs. C++. Bug bounties vs. exploit development. The Peace Corps vs. The Marine Corps.Transcript: https://share.descript.com/view/DpeqIOCREyZFind us at:https://twitter.com/scwpodhttps://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrian

We did not run out of things to talk about: Chrome vs. Safari vs. Firefox. Rust vs. C++. Bug bounties vs. exploit development. The Peace Corps vs. The Marine Corps. Transcript: <a href="https://share.descript.com/view/DpeqIOCREyZ" rel="nofollow" target="_blank">https://share.descript.com/view/DpeqIOCREyZ</a> Find us at: <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a> <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a>

Platform Security Part Deux, feat. Justin Schuh

🔥JWT🔥We talk about all sorts of tokens: JWT, PASETO, Protobuf Tokens, Macaroons, and Biscuits. With the great Jonathan Rudenberg!After we recorded this, Thomas went deep on tokens even beyond what we talked about here: https://fly.io/blog/api-tokens-a-tedious-survey/Transcript: https://share.descript.com/view/pb428e60pPoFind us at:https://twitter.com/durumcrustulumhttps://twitter.com/tqbfhttps://twitter.com/davidcadrianhttps://twitter.com/scwpod

🔥JWT🔥 We talk about all sorts of tokens: JWT, PASETO, Protobuf Tokens, Macaroons, and Biscuits. With the great Jonathan Rudenberg! After we recorded this, Thomas went deep on tokens even beyond what we talked about here: <a href="https://fly.io/blog/api-tokens-a-tedious-survey/" rel="nofollow" target="_blank">https://fly.io/blog/api-tokens-a-tedious-survey/</a> Transcript: <a href="https://share.descript.com/view/pb428e60pPo" rel="nofollow" target="_blank">https://share.descript.com/view/pb428e60pPo</a> Find us at: <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf</a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a> <a href="https://twitter.com/scwpod" rel="nofollow" target="_blank">https://twitter.com/scwpod</a>

What do we do about JWT? feat. Jonathan Rudenberg

Filippo Valsorda

Special guest Filippo Valsorda joins us to debate with Thomas on whether one should or should not "roll your own crypto", and how to produce better cryptography in general.After we recorded this, David went even deeper  on 'rolling your own crypto' in a blog post here: https://dadrian.io/blog/posts/roll-your-own-crypto/Transcript: https://share.descript.com/view/2tqKjLxleKMLinks:https://peter.website/meow-hash-cryptanalysishttps://arxiv.org/pdf/2107.04940.pdfhttps://ristretto.grouphttps://filippo.io/heartbleedFind us at:https://twitter.com/durumcrustulumhttps://twitter.com/tqbf https://twitter.com/davidcadrian

Special guest <a href="https://twitter.com/filosottile" rel="nofollow" target="_blank">Filippo Valsorda</a> joins us to debate with Thomas on whether one should or should not "roll your own crypto", and how to produce better cryptography in general. After we recorded this, David went even deeper  on 'rolling your own crypto' in a blog post here: <a href="https://dadrian.io/blog/posts/roll-your-own-crypto/" rel="nofollow" target="_blank">https://dadrian.io/blog/posts/roll-your-own-crypto/</a> Transcript: <a href="https://share.descript.com/view/2tqKjLxleKM" rel="nofollow" target="_blank">https://share.descript.com/view/2tqKjLxleKM</a> Links: <a href="https://peter.website/meow-hash-cryptanalysis" rel="nofollow" target="_blank">https://peter.website/meow-hash-cryptanalysis</a> <a href="https://arxiv.org/pdf/2107.04940.pdf" rel="nofollow" target="_blank">https://arxiv.org/pdf/2107.04940.pdf</a> <a href="https://ristretto.group/" rel="nofollow" target="_blank">https://ristretto.group</a> <a href="https://filippo.io/heartbleed" rel="nofollow" target="_blank">https://filippo.io/heartbleed</a> Find us at: <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf </a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a>

The Great "Roll Your Own Crypto" Debate, feat. Filippo Valsorda

Deirdre, Thomas and David talk about NSO group, Pegasus,  whether iOS a burning trash fire, the zero-day market, and whether rewriting all of iOS in Swift is a viable strategy for reducing all these vulns.Transcript: https://share.descript.com/view/PQRb3nsY7N4Find us at:https://twitter.com/durumcrustulumhttps://twitter.com/tqbf https://twitter.com/davidcadrian

Deirdre, Thomas and David talk about NSO group, Pegasus,  whether iOS a burning trash fire, the zero-day market, and whether rewriting all of iOS in Swift is a viable strategy for reducing all these vulns. Transcript: <a href="https://share.descript.com/view/PQRb3nsY7N4" rel="nofollow" target="_blank">https://share.descript.com/view/PQRb3nsY7N4</a> Find us at: <a href="https://twitter.com/durumcrustulum" rel="nofollow" target="_blank">https://twitter.com/durumcrustulum</a> <a href="https://twitter.com/tqbf" rel="nofollow" target="_blank">https://twitter.com/tqbf </a> <a href="https://twitter.com/davidcadrian" rel="nofollow" target="_blank">https://twitter.com/davidcadrian</a>

NSO group, Pegasus, Zero-Days, i(OS|Message) security

Security. Cryptography. Whatever.

The best self improvement podcast episodes. From improving productivity, to finding purpose in your life to what constitutes freedom, this topic is on anything and everything that can help people to improve their lives. Add episodes you're interested into your queue below!

Best Episodes on Self Improvement, Growth & Development

The best philosophy podcast episodes. Asking questions about how to live a better life, what it means to be and do good, to the idea of God. This topic includes episodes that bring about important questions that everyone should be asking themselves. Add episodes you're interested into your queue below!