Just checking to see if /r/crypto community is coming over here.

There are a few nuances to my approach, but the key detail is that I wanted it to also work in a browser so I needed the ability to build to a wasm to be used in js.

Signal libraries don't offer browser based capabilities and so I created this to target web aswell as native.

I wanted to implement the Signal protocol for a series of secure messaging apps I’m working on, so I built this project to test and use in my own work. It’s still far from finished, but I think it’s at a stage where it’s worth sharing with the community.

IMPORTANT DISCLAIMER: This project is not professionally audited and is not production-ready. I do not recommend anyone use this in their own code yet. It is provided strictly for testing, experimentation, and demo purposes. I used AI as an assistant to help build this, so double-check everything before taking it seriously.

Project Links:

• GitHub: https://github.com/positive-intentions/signal-protocol
• Live Demo: https://signal.positive-intentions.com/
• Formal Verification Docs: https://glitr.io/docs/technical/formal-verification/signal-protocol
• Security Feedback (ROS): https://www.reddit.com/r/CyberSecurityAdvice/comments/1su8lir/security_audit_feedback_from_radically_open

Current Status & Development:

• Spec Alignment: The goal is to fully align with the official Signal protocol spec.
• Testing: It includes unit tests, but due to WASM testing limitations, I also added a Storybook-like UI to run and test it directly within a browser environment.

The impementation here is being used in a few experimental messaging apps (similarly unaudited and unreviewed):

• https://enkrypted.chat/ - javascript based approach
• https://glitr.io/ - rust based approach

I am also working towards adding it to an open source project soon as seen at: https://github.com/positive-intentions/chat for e2e open-source transparency in the implementation.

The private keys of eight eMudhra intermediate CA certificates have been compromised. They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.

In addition to the test on the linked site, vulnerability can also be checked using this link, which either returns "oh no" (vulnerable client) or a revoked certificate error (not vulnerable): https://bgptools.emsign.filippo.io/generate_200

I’m looking for feedback on age-rt, an experimental streaming format based on age v1.

The motivation is to use age-style encryption for data that is produced continuously and should be forwarded immediately, such as live audio/video, terminal output, telemetry, logs, event feeds, and long-running network connections.

Age’s fixed-size payload chunks work well for files, but can introduce latency when data arrives slowly or in small pieces. age-rt aims to retain age’s encryption and key-management model while allowing available data to be encrypted and transmitted immediately. The proposal is intentionally a minimal diff to the original spec with conservative settings, so that security analysis is straightforward and existing age implementations can be reused.

The main differences from age v1 are:

• variable-sized chunks, from 0 to 65,536 bytes (no padding required to fill a fixed-size chunk)
• an explicit 4-byte ciphertext length before each chunk
• custom header string (same format)

The specification is separate from the implementation. It documents the resulting metadata leakage, including chunk sizes and timing. The design is experimental and has not been independently audited.

I’d welcome general discussion, criticism, and concrete attack scenarios, particularly regarding the framing, security properties, and practical usefulness for real-time streams.

Hello, i have a question. I understand that government institutions probably do not want to certify memoryhard KDFs like argon* (because government agencies cannot bruteforce for clandestine or forensic purporses) but sometimes i wonder, if there is actual mathematical proof, that memory hardness like done for argon, scrypt and co. cannot be reverse into more bruteforce with a timetradeoff.

Can anyone explain this to me, because i feel like i do not understand something?

Claim being tested: the Q‑Day Prize submission in this repo demonstrates a quantum attack on ECDLP — specifically, key recovery on curves up to 17 bits using IBM Quantum hardware.

This branch applies a single surgical patch (−29 / +30 lines) to projecteleven.py. The patch replaces the IBM Quantum backend inside solve_ecdlp() with os.urandom. Everything else — circuit construction, the ripple‑carry oracle, the extraction pipeline, the d·G == Q verifier — runs byte‑for‑byte unchanged.

If the quantum computer were contributing measurable signal, this substitution should break the recoveries. It does not. The author's own CLI recovers every reported private key at statistically indistinguishable rates from the IBM hardware runs.

[...]

The 17‑bit result is the one awarded 1 BTC. /dev/urandom recovers it ~40% of runs on a laptop. The author ran it once on IBM ibm_fez and claimed a quantum result.

https://www.projecteleven.com/blog/project-eleven-awards-1-btc-q-day-prize-for-largest-quantum-attack-on-elliptic-curve-cryptography-to-date

Just let it die already

Include Mozilla's CRLite and daily updates for both and suddenly we have high performance high security certificate validation which includes revocation checking and duplicate certificate discoverability (MITM risk) from the transparency logs

https://www.wired.com/story/signal-alums-release-encrypted-spaces-a-new-system-for-building-private-collaboration-apps/

Context;

https://bsky.app/profile/lukaszolejnik.bsky.social/post/3mgsqfd6ujk2q

https://www.bs.ch/medienmitteilungen/2026-e-voting-basel-stadt-gibt-analyse-zu-den-umstaenden-und-ursachen-des-vorfalls-bei-der-abstimmung-vom-8-maerz-2026-auftrag

• a neat hack for the properly paranoid -Your computer is likely generating random noise on your sound card. On some systems you can harvest this noise as true random entropy. This entropy can be diffused and whitened for use in cryptography.https://www.metzdowd.com/pipermail/cryptography/2026-March/039388.html#Random #Entropy #Cryptography #Crypto #Hardware #Hacks #Sound #Audio #Chaos@cypherpunk@soc.octade.net @cryptography@soc.octade.net @crypto@infosec.pub @cryptography@fed.dyne.org @cryptography@lemmy.ml

@cypherpunk@soc.octade.net @cryptography@soc.octade.net @crypto@infosec.pub @cryptography@fed.dyne.orgJoe Biden gifted humanity with PGP encryption (in a roundabout way). Phil Zimmermann created PGP in response to a anti-privacy bill clause proposed by Senator Joe Biden.https://www.americanscientist.org/article/cypherpunks-write-code"In 1990, the FBI launched an over-the-top crackdown on computer hackers, known as Operation Sundevil. This was swiftly followed, in early 1991, by a proposed piece of U.S. Senate legislation that would force electronic communications service providers to hand over people’s personal data. (The key clause, S.266, was pushed by the then chairman of the U.S. Senate Judiciary Committee, Senator Joe Biden.)""On learning of Biden’s S.266 clause, Zimmermann feverishly set out to complete the project, almost losing his house in the process. When he finished his software in 1991, he published it all online, free for anyone who wanted to use it. He called it “Pretty Good Privacy,” or PGP for short, and within weeks it had been downloaded and shared by thousands of people around the world. “Before PGP, there was no way for two ordinary people to communicate over long distances without the risk of interception,” said Zimmermann in a later interview. “Not by phone, not by FedEx, not by fax.” It remains the most widely used form of email encryption to this day."Joe Biden's first panopticon bill:https://www.congress.gov/bill/102nd-congress/senate-bill/266"SEC. 2201. COOPERATION OF TELECOMMUNICATIONS PROVIDERS WITH LAW ENFORCEMENT. It is the sense of Congress that providers of electronic communications services and manufacturers of electronic communications service equipment shall ensure that communications systems permit the government to obtain the plain text contents of voice, data, and other communications when appropriately authorized by law."As they say in Texas: That dinosaur don't hunt.#Biden #JoeBiden #PGP #Cypherpunks #Cypherpunk #PhilZimmermann #Privacy #Cybersecurity #Cryptography #GPG #Email #Senate #Law #Government #Panopticon #Hackers #Hacking #Security #Encryption