3 ms·
Not parent. As to the first point, I think it's missing Spectre/Meltdown vulnerabilities? Also something with EFAIL, and something with regards to all the JWT
by shp0ngle 6y ago
Not parent.
As to the first point, I think it's missing Spectre/Meltdown vulnerabilities? Also something with EFAIL, and something with regards to all the JWT mess that's currently being used everywhere.
Hm.... But now, when I am reviewing them again (I last tried them in 2015-ish), I see they are mostly low lever crypto; things like JWT and EFAIL probably does not belong there.
- tptacek 6y agoThat's correct. So, for instance, invalid curve attacks --- which broke JWT --- are in cryptopals 8. JWT isn't. There's probably a malleability-gadget challenge we could do that's abstract enough to fit and captures what's interesting about EFAIL, but then, the underlying cryptographic flaw in EFAIL is so simple it's already in there. Weird how relevant "historical" cryptography is when you're in the real world, looking at real systems.