david wong

Hey! I'm David, cofounder of zkSecurity and the author of the Real-World Cryptography book. I was previously a crypto architect at O(1) Labs (working on the Mina cryptocurrency), before that I was the security lead for Diem (formerly Libra) at Novi (Facebook), and a security consultant for the Cryptography Services of NCC Group. This is my blog about cryptography and security and other related topics that I find interesting.

Video: How the RSA attacks using lattices work posted April 2015

This is my second video, after the first explaining how DPA works. I'm still trying to figure out how to do that but I think it is already better than the first one. Here I explain how Coppersmith used LLL, an algorithm to reduce lattices basis, to attack RSA. I also explain how his attack was simplified by Howgrave-Graham, and the following Boneh and Durfee attack simplified by Herrmann and May as well.

The repo is here, you can check the survey here as well.

Also, follow me on twitter

comment on this story

encryption with a one letter XOR? Really? posted April 2015

So there is this app that encrypts your data on your mobile, in case it ends up in the wrong hands. Sounds good. And then there is this guy who took a look at it and figured out the data was just XORed with a 128bit keys consisting of only 4s. If the data is longer than 128bits? Let's not encrypt it!

I don't know how legit it is, especially considering how easy it is to just write aes(something) but here you go

comment on this story

Unix command of the day: Tee posted April 2015

The tee command allow you to write to a file and still display the result in output.

For exemple

ls

display the content of the current folder in stdout (the terminal)

ls > file.txt

saves that in a file file.txt

ls | tee file.txt

saves that in a file file.txt and displays in stdout at the same time

1 comment

Truecrypt report posted April 2015

Some news about the Truecrypt open audit: the report is out.

The TL;DR is that based on this audit, Truecrypt appears to be a relatively well-designed piece of crypto software. The NCC audit found no evidence of deliberate backdoors, or any severe design flaws that will make the software insecure in most instances.

comment on this story