long boi

#electronics

Big CA uses the number four, as in literally “4” as the private key for one of their intermediates like in the fucking xkcd was not on my bingo card for 2026

(1) how do you fuck up this bad as a CA
(2) what exactly were their auditors doing when they signed off on their baseline requirements compliance

hah, it wasn’t a compromise of their infra, it’s way, way worse: apparently somehow, SOMEHOW those intermediates’ private keys had like eight bytes of entropy…between the eight of them, total 🤯

This means that against a physical attacker, FIPS 140-2 level 3 literally only means "we glued the server shut really well", and all that's needed to get inside is a drill or an angle grinder.

There's an interesting detail in that screenshot that's hard to notice to a layperson: They say their HSMs are FIPS 140-2 level 3. FIPS 140-2 has four levels, and what most don't know is that only at level 4, the highest level, is any serious active tamper sensing required. At level 3, which they use here, the requirement is literally:

> Hard opaque potting material encapsulation of [the circuit board] or strong enclosure with removal/penetration attempts causing serious damage.

On the eMudhra CA certificate compromise: I just saw they advertise how they store their intermediate certs in HSMs on their website. There is a PoC of signatures from these keys making the rounds, which illustrates pretty well what the limits of HSMs are: To a network attacker, a HSM is little more than an API boundary, and if they can get access to something with access to the HSM, they don't need the keys, they can just tell the HSM to sign what they need to be signed.

it took so much self control to not name this paper “squiggles SQUIGGLES Squiggles A Field Survey Of Security Squiggles”

RE: https://chaos.social/@jaseg/117466897082919130

do boosts count as citations or does it have to be a quote post to count?

#science

please cite me y’all

the beatsaber modding scene is built on computer crimes. I recently learned that the "native arm64 beatsaber port" is done by taking an x86 beatsaber build, dissecting it, then combining its C# assemblies with a binary arm64 unity runtime from somewhere else and some patched, built-from-source dependencies, then running it in wine.

Following up on the research in that paper, I'm now building an open source HSM toolkit in the Prototype Fund-funded Ashen software and nlnet-funded Yanartas hardware projects. News on these will appear on https://yasec.de/projects/

I've got a new paper coming out in TCHES 2027/1 titled "Tamper Sensing Meshes in Payment Terminals and Beyond". For the paper, I took apart ~30 payment terminals and other "secure" devices to find out how they build their security meshes. Based on that, I create a sort of taxonomy of mesh construction along with a bunch of best practices if you want to build your own.

Here's a link to a preprint:
https://eprint.iacr.org/2026/2475

Yay, got another paper accepted at a major conference. This one is basically a re-formatted version of a chapter of my PhD thesis.

I just uploaded the camera ready, and I guess I'll be at CHES 2027 next year!

I’ve just found the end boss of QR codes at Berlin airport 🤣

One of my little software tools seems to have become popular enough that I've just received a proposal by some shady company asking me if I'd like to integrate their residential proxy malware ("bandwidth sharing SDK").

sadly it's fhd only

lol this is one of those products that makes you wonder for a moment if it's a meme or something you can really buy

https://www.reichelt.de/de/de/shop/produkt/39_6cm_dual-monitor_16_9_1080p_usb-c-414596

lol what's going on with this PCB layout?! is that also slop'ed up, or do they just have a really unique placement and routing style?

This PD analyzer project looks very slopcoded, but if they do a decent job validating its protocol implementation against real-world devices I think this could be a really neat tool both for debugging and for product validation:

https://github.com/T76-org/drpd