https://algoatson.github.io/series/crypto-attacks/ The signing oracle reused a nonce across two messages. That's the whole vulnerability — and it collapses the private key to a couple of modular divisions. The algebra, then the generalisation to merely *biased* nonces and a lattice. en Tue, 16 Jun 2026 02:47:52 +0000 https://algoatson.github.io/p/cbc-padding-oracle/ https://algoatson.github.io/p/cbc-padding-oracle/ Wed, 18 Mar 2026 00:00:00 +0000 cryptoctf A server that merely tells you whether a decrypted ciphertext had valid padding leaks the plaintext one byte at a time. No key, no brute force — just CBC's structure and a single bit of feedback turned into full decryption. https://algoatson.github.io/p/hash-length-extension/ https://algoatson.github.io/p/hash-length-extension/ Fri, 20 Mar 2026 00:00:00 +0000 cryptoctf H(secret ‖ message) looks like a MAC, but Merkle–Damgård hashes leak their internal state in the digest. Knowing that digest and the message length, you can resume the hash and append your own data — forging a valid tag for secret ‖ message ‖ padding ‖ anything, with the secret never in hand. https://algoatson.github.io/p/rsa-attacks-tour/ https://algoatson.github.io/p/rsa-attacks-tour/ Wed, 25 Mar 2026 00:00:00 +0000 cryptoctfmath RSA is sturdy; the ways people deploy it are not. A field guide to the classic breaks — tiny exponents, shared moduli, small private keys, careless primes, partial leaks — each one a parameter choice that turns "factor a 2048-bit number" into a few lines of arithmetic. https://algoatson.github.io/p/ecdsa-nonce-reuse/ https://algoatson.github.io/p/ecdsa-nonce-reuse/ Sun, 22 Mar 2026 00:00:00 +0000 cryptoctfmath The signing oracle reused a nonce across two messages. That's the whole vulnerability — and it collapses the private key to a couple of modular divisions. The algebra, then the generalisation to merely *biased* nonces and a lattice.