Crypto Blogging Award 2016

I spent a lot of time reading this blogpost today and thought to myself: this is a great blog post. If there was a blogging award for security/crypto blogposts this would probably be the front runner for 2017.

But I can’t really blog about it, because we’re still waiting for a lot more good blog posts to come this year.

So what I decided to do instead, is to go through all the blog posts that I liked last year (it’s easy, I have a list here) and find out which ones stood out from the rest.

please do not get offended if yours is not in there, I might have just missed it!

How does a blog post make it to the list? It has to be:

• Interesting. I need to learn something out of it, whatever the topic is. If it’s only about results I’m generally not interested.
• Pedagogical. Don’t dump your unfiltered knowledge on me, I’m dumb. Help me with diagrams and explain it to me like I’m 5.
• Well written. I can’t read boring. Bonus point if it’s funny :)

So here it is, a list of my favorite Crypto-y/Security blogposts for the year of 2016:

• The amazing series of Thai Duong’s The Internet of Broken Protocols. Don’t read the answer right away, try to solve them yourself, it’s fun :)
• Crypto Classics: Wiener’s RSA Attack. The explanation is top notch. If I could have something like that for every crypto attack I would know everything.
• The most incredible hiding-in-the wild backdoor found: OpenSSL key recovery attack on DH small subgroups (CVE-2016-0701) (it also merged into a paper and was nominated in the pwnie awards).
• Adam Langley on Cryptographic Agility which shows a lot of the arguments behind TLS 1.3’s design.
• BearSSL and many of its documentation pages (yes I know, these are not blog posts but they read like blog posts).
• Filippo with his explanation (and finding) of the pen and paper Bleichenbacher 2006 signature forgery
• The hilarious Graphing when your Facebook friends are awake. (Not really crypto.)
• Another hilarious post: Playing games with an attacker: how I messed with someone trying to breach the CryptoWall tracker. (Again, more security than crypto.)
• All the blogposts on Matthew Green’s blog. The one on Sweet32, the iMessage attack, the DROWN attack, …
• The Goldreich–Goldwasser–Halevi (GGH) Cryptosystem and Nyguen’s Attack by Kelby Ludwig. Will teach you about lattices, a lattice-based cryptosystem and an attack while showing you how to see these things in Sage.
• The Hunting For Vulnerabilities in Signal series by Jean-Philippe Aumasson and Markus Vervier.
• The excellent Cloudflare blog has many crypto blog posts, for example this article by Filippo on TLS nonce-nse
• A Survival Guide to a PhD.
• Literally everything on the blog of Stephane Bortzmeyer (warning: it’s in french).
• The crypto work of Quarkslab. Here’s their analysis of Confide.
• Ransomware: Past, Present, and Future. I haven’t read this one but it seems so complete I couldn’t not include it :)

Did I miss one? Make me know in the comments :]