this post was submitted on 18 Feb 2026

13 points (93.3% liked)

Pulse of Truth

pulse_of_truth@infosec.pub

2,615 readers

1,102 active

15 users here now

Cyber Security news and links to cyber security stories that could make you go hmmm. The content is exactly as it is consumed through RSS feeds and wont be edited (except for the occasional encoding errors).

This community is automagically fed by an instance of Dittybopper.

Commenting rules:

Be respectful.
No bigotry (including racism, sexism, homophobia, transphobia).
No pornography.
Nothing illegal.
More rules will be added when necessary

founded 3 years ago

moderators

krogoth@infosec.pub

Cryptographic Issues in Matrix’s Rust Library Vodozemac (soatok.blog)

submitted 8 months ago by lemmydev2@infosec.pub [B] to c/pulse_of_truth@infosec.pub

12 comments fedilink hide all child comments

Comments

you are viewing a single comment's thread
view the rest of the comments

[–] Soatok@pawb.social 1 point 8 months ago (6 children)

I haven't reviewed SimpleX, but it does some weird things (Curve448? Really??) that make me wonder about the author's capacity for threat modeling.

parent

hideshow 6 child comments

[–] redsand@infosec.pub 1 point 8 months ago* (5 children)

Where? It's all TLS and NTRU prime now to my knowledge. They have a couple audits now.

https://github.com/simplex-chat/simplex-chat/blob/stable/blog/20240314-simplex-chat-v5-6-quantum-resistance-signal-double-ratchet-algorithm.md

parent

hideshow 5 child comments

[–] Soatok@pawb.social 1 point 8 months ago (4 children)

https://github.com/simplex-chat/crypton/blob/90e1a0f46a2adb30feb3222b417ddef41b1feee1/Crypto/PubKey/Curve448.hs

parent

hideshow 4 child comments

[–] redsand@infosec.pub 1 point 8 months ago (3 children)

3 year old subpackage blob. Maybe it's from before the switch to PQC? They have a published threat model that helped guide the audits and seemed well reasoned. I'm not sure where that version of curve would be used in the current client or server.

parent

hideshow 3 child comments

[–] Soatok@pawb.social 1 point 8 months ago (2 children)

Either way, it's just... weird.

parent

hideshow 2 child comments

[–] redsand@infosec.pub 1 point 8 months ago (1 child)

you can message the developers directly from the client. Ask, if they dont know why it's there it'll get stripped out. I would guess it's legacy compatibility but it could be zombie code that needs pruned

parent

hideshow 1 child comment

[–] Soatok@pawb.social 1 point 8 months ago

Why would I want to use the client? :S

I'm just here to criticize cryptographic open source software. I don't actually want to use these programs.

parent