neuromancer.sk

I have participated in artifact evaluation committees since 2021.

Last week, I had the pleasure of presenting at Real World Crypto 2026 in Taipei, Taiwan.

Recently, I presented our work on Let’s DOIT: Using Intel’s Extended HW/SW Contract for Secure Compilation of Crypto Code at CHES 2025 in the hot and humid Kuala Lumpur, Malaysia.

I recently attended CHES 2024 and presented a paper on pyecsca: Reverse engineering black-box elliptic curve cryptography via side-channel analysis.

Recently we (me & Lukasz Chmielewski) gave a tutorial on pyecsca: Reverse-Engineering ECC implementations Using Side-Channel Analysis at the Summer School on real-world crypto and privacy 2024.

Today I came up with a clever solution for a dumb problem.

I recently attended CHES 2023 and presented a work-in-progress poster on pyecsca: Reverse-engineering elliptic curve cryptography implementations via side-channel analysis.

I recently presented an updated version of the RedHat Research Day talk on analyzing the security certifications landscape.

I recently presented joint work with Petr Švenda, Adam Janovský, Jiří Michalík and Stanislav Boboň on analyzing the security certifications landscape at Red Hat Research Day 2022.

I recently presented the paper “They’re not that hard to mitigate”: What Cryptographic Library Developers Think About Timing Attacks on Real World Crypto 2022 and IEEE Security & Privacy 2022.

This year, we at the Crocs-Side-Scripting CTF team took part in the hxp CTF 2021 .

Cryptographic code needs to be constant-time to not leak secrets via timing.

Every EU member state is rushing to implement Digital Green Certificates until the end of June, yet no one is stopping to look at their security.

Language (SK) Ak hľadáte stránku na odber notifikácii o COVID-19 očkovaní na Slovensku, nájdete ju na covid.neuromancer.sk.

This post explores the current state of tools for verification of constant-time properties in cryptographic implementations, both static and dynamic.

This year I took part in the hxp ctf with a bunch of friends from and around the CRoCS lab.

Language (SK) Slovensko plánuje celoplošné antigénové testovanie na COVID-19 a z pohľadu na tlačovky to vyzerá, že to robí nie práve informovane.

I recently presented our work on the Minerva group of vulnerabilities on the Cryptographic Hardware and Embedded Security conference.

Language (SK) Tento post analyzuje Slovenskú contact-tracing aplikáciu Covid19 ZostanZdravy , konkrétne jej bezpečnosť a udržiavanie súkromia.

I gave a short talk during the rump session at the 23rd Workshop on Elliptic Curve Cryptography highlighting some interesting aspects of the Minerva attack.

I gave a lightning talk during the student session of the 2019 SummerSchool on real-world Crypto and Privacy in Šibenik, Croatia, focusing on the research into JavaCard and smart-card security that is performed at CRoCS, the slides can be found here.

Recently, I presented work on the ECTester tool for testing black-box elliptic curve cryptography implementations during SantaCrypt 2018 in Prague, Czech republic.

As the GSoC 2017 final evaluation period just ended, my final work product is finally submitted.

django-pgpmailman progress# Successfully created the mail list views.

This post is about my current plans on how to implement the web ui part of PGP enabled Mailman.

This week was tough but productive.

The second evaluation period came quite fast after the first one, nonetheless the project advanced much further so quick recap of its current state is in order.

Signature hash tracking# It would be relatively easy to replay a signed message to a mailing list by a user as no kind of challenge-response is done on posting.

This week is around the halfway of GSoC 2017 project timeline, hence the title.

Just a quick update about the state of the project before I disappear from civilization for this weekend.

As I note in one of my previous GSoC project updates, the PGP-enabled mailing lists require two new features from Mailman Core, both related to workflows.

The first evaluation period is here, I have already sent in my evaluation so I thought I would recap the state of the project.

This week things moved along with the mailman-pgp plugin.

Since my last post, I’ve been looking for a suitable PGP python library as I realized my original candidate python-pgp just wouldn’t work: Its not actively maintained.

As last time I described outstanding PRs to Mailman Core and other Mailman’s components, this time I am going to describe the plugin I am building on top of those components to enable PGP encrypted mailing lists.

This week has been quite productive.

Since a plugin-like out-of-tree approach is required for implementing encrypted lists into Mailman, a straight forward integration into Postorius and HyperKitty (as first proposed) by making them “aware” of the encrypted lists plugin is not possible.

Structure# pgpmailman - A Core plugin. styles - Both styles generate a list keypair based on plugin settings on list creation as well as set other attributes for an encrypted mailing list.

Plugin API enhancements in Core# To cleanly implement encrypted mailing lists as a plugin to Mailman Core I propose several general changes to the plugin api, to allow for cleaner integration of plugins, more flexibility and easier plugin deployment.

ecgen is a tool for generating Elliptic curve domain parameters.