This press release is gold:

https://emudhra.com/en/press-release/emudhra-statement-distrust-global-tls-intermediate-root-ca

"Last weekend, an independent researcher found that the weak keys could be reverse-engineered possibly with AI-assisted techniques."

Your private key was the number 4. Your fucking private key, which is supposed to be a 115 digit number, was the fucking number 4. As in, the fourth key a very naive first analysis would try. But sure scary scary AI did it.

I independently recovered the private key, without any AI assistance, on Monday evening. Not because I was involved in the incident, just because I was curious and had a little bit of free time on my hand.

Considering offering HSM services to CAs.

Oh wait, now I get it, when they say singularity, they mean IPO.

Oh God, this is getting even worse: apparently the "source" of the claim that AI might have broken classical cryptography is the fact that some numbers are skipped in the OpenAI math dump. You know, that same dump that doesn't even have formal verification on more than half of the results and some of the formally verified results have been shown to be incorrectly formalized?

I dunno, but isn't the far, far more likely explanation that the skipped numbers simply contained obviously false statements and were removed because they were, well, false?
Brother Occam, we're going to need a bigger razor!

(Also it is now Sunday, the 11th, 12:15 PT and I still have zero evidence that anyone with the qualifications to review it has seen any claim whatsoever that would put public key cryptography at risk that had not been known already)

I am an incredibly minor public figure. One thing that, even at my incredibly narrow status, I learned, is to not speculate on main, when you have absolutely zero evidence to back up any of your speculation.

Unfortunately not everyone in this position has learned that lesson.

In case you've seen some wild cryptography related speculation today, my status, at least at this point in time, October 8th, 13:40 PT is that absolutely no one who has the expertise to evaluate it has seen any result that would be in the least concerning for the state of public key cryptography. That might change, of course, but that is always the case.

Whenever I'm attending a US government event, I make a mental list of various archetypes. As far as I can tell there are:
- government employees who "accidentally" say DoD most of the time, but throw in the occasional DoW as plausible deniability
- government employees who proudly and enthusiastically say DoW all the time
- non-government employees who say DoD and then are unsure and correct themselves to DoW
- non-government employees who say DoD and if asked, will say that Congress comes up with the names and hasn't changed that one (this is me, I'm in this category)
- (newly added category) government employees who will correct people who say DoW, telling them it's DoD and that Congress hasn't changed the name. They are the GOAT.

Actually no, this isn't the most recent example, this one is:

https://github.com/golang/go/issues/81199

There are just so many of these that a Google search and quick scan isn't guaranteed to find the correct one

Most recent context:

https://github.com/golang/go/issues/80573

But generally, middle boxes that try to parse ClientHello while not following the corresponding RFCs and then dying are a constant scourge on the internet. Leave the ClientHello alone, it's not for you, if it was for you, you wouldn't be a middle box, but a server.

Maybe we can define a PQC signature that kills the very concept of a middle box itself. Like on a platonic ideal level.

Why are middle boxes?

Out of context work quote: "we should find these machines, take their CPUs, and mount them on a stick as a warning to the others"

Has anyone written a "things developers misunderstand about probabilities" guide?

Woohoo, the TLS key exchange algorithm Chrome, Firefox, and friends have been using for the last two years is now an actual standard!

https://datatracker.ietf.org/doc/html/rfc10024

(oh and also, bucking @lcamtuf 's observed trends, this was written by actual humans and not AI, despite being an AI related blog post)

New blog post about cryptanalysis and AI.

In particular: don't panic about AI ending up breaking all of cryptography just yet. While it's super impressive work, it's still the same work that humans have been doing for centuries with the same fundamental limitations.

https://bughunters.google.com/blog/more-cryptanalysis-makes-us-all-safer

Technician: so usually this end is supposed to be cool and that end is supposed to be warm, but in your case it's the other way around
Me: so we have heatpump?
Technician *laughs*: no you have a broken AC

I do have to admit, I'm somewhat proud of my economicified explanation of key exchange algorithm negotiations.

https://mailarchive.ietf.org/arch/msg/tls/evs5vqvK7kTEFHCPdnqM7Xf3Yyk/

If you told me ten years ago that one day I would get into online fights with economic Nobel price laureates, and that I would be the one looking sane in the exchange, I would have laughed out loud.

So far, the most important thing I've learned in the whole story is that apparently the English equivalent of the German phrase "storm in a water glass" is "tempest in a tea cup".
Which quite frankly gets bonus points for the alliteration. Well done, English language.

I now get pestered by more djb minions on here being all like BuT WhAt If YoUr BaNk UsEd PuRe ML-KEM?!!)?!?
Well, if my bank servers support this cipher exactly nothing happens. My client will still not offer it, so it will not be negotiated. And if it were to be negotiated then… also nothing would happen and my data would stay secure.