45 results for “cipher”

Poly2MsgLeaks is a profiled chosen-ciphertext power-analysis attack on the SMAUG-T (TiMER parameter set) post-quantum KEM that recovers the full 512-coefficient PKE secret from six traces on an STM32F415. It recovers 999 of 1,000 unseen secrets and proves an incorrect key is released with probability at most 2^-2095.6. Single-write message assembly and a two-share masked P2M resisted the evaluated six-execution attack.

eprint.iacr.orgpaperAdded 28 Oct 2026, published 27 Oct 2026🛡️ Security

ZMAC+ is a tweakable-block-cipher MAC (List and Nandi, ToSC 2017) with claimed beyond-birthday-bound security. This ePrint paper (2026/2647) shows a tag-swap attack: for two-block tags, a distinguisher and a fresh-message forgery with constant success probability using O(2^{n/2}) queries in the ideal-TBC model. It also corrects a counting error in the published Lemma 4 and proposes a repaired variant with an adaptive PRF bound of order q^2/2^{n+min(n,t)}.

eprint.iacr.orgpaperPublished and added 26 Oct 2026🛡️ Security

Provable Security of SHA-256-Based LMS Revisited in the Ideal-Cipher Model is an October 2026 ePrint paper by Chun Guo, Hao Cheng, Bart Preneel and Meiqin Wang. It shows forgery attacks on LMS_SHA256_M32 and LMS_SHA256_M24 that exploit Merkle-Damgård structure, so the Katz and Fluhrer random-oracle bounds do not apply. It proves ideal-cipher-model bounds: about 256 minus log2 of the block count for M32, and a minimum of two terms for M24.

eprint.iacr.orgpaperAdded 26 Oct 2026, published 24 Oct 2026🛡️ Security

Rentaro Shiba and Tetsu Iwata prove a tight multi-key security bound for the FX construction (the DESX generalization) in the quantum ideal cipher model. Security holds up to about 2^((n+κ)/3) total classical and quantum oracle queries against fully adaptive adversaries, for any number of keyed instances μ≥1. This improves their ToSC 2026 bound and matches the offline Simon's algorithm attack in the exponent.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 23 Oct 2026🛡️ Security

Mímir is a cryptographic protocol for stateless semantic private search over highly dynamic public databases. It uses homomorphic ciphertext switching, relies on (Ring) Learning with Errors, and needs no offline communication. Against Tiptoe it matches search quality with 84x less per-query communication (0.24 MiB). Against PACMANN it raises quality from 76% to 81% of non-private search, with a 9.54 MiB one-time cost instead of 2.68 GiB, but is 2.1x slower.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

Linear cryptanalysis of FRAST, a TFHE-friendly stream cipher, in the average key setting. It fixes the false-positive problem left open in the earlier attack by Bak et al., showing key differences fall into five indistinguishable classes per round. The Contract algorithm recovers the master key for 10 rounds and, on weak keys of density 2^-11.8 to 2^-5.4, reaches full FRAST within the claimed security.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 22 Oct 2026🛡️ Security

This ePrint paper gives the first exact bit-level models of modular multiplication z=(x·y) mod 2^n. One model is for monomial prediction under 3SDP-woU, the other for impossible differential search. Applied to the MSX lightweight cipher, it yields a 7-round integral distinguisher (2^96 data) for MSX-128, key recoveries on 8 and 9 of 18 rounds at about 2^228 operations, and 1,984 seven-round impossible differentials. Both models are implemented in CLAASP.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

SoK on design-level backdoors in block ciphers. It places four published designs (Rijmen and Preneel, Paterson, Bannier and Filiol, Peyrin and Wang) in one taxonomy and gives a sound algorithm that recovers a partition trapdoor from S-box tables. It attacks KG-DES, BEA-1 and LowMC-M: KG-DES key recovery takes minutes, and the LowMC-M MALICIOUS backdoor yields the key from 35 to 409 queries. Trapdoors hidden in linear layers leave no trace, so the authors recommend deriving constants verifiably from a public seed.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

Broadcast and Trace from Lattices is a 2026 ePrint preprint by Jeffrey Champion. It builds collusion-resistant broadcast and trace with public tracing from attribute-based encryption with succinct ciphertexts and lockable obfuscation, both known from decomposed LWE. Ciphertexts are sqrt(N)·poly(λ, log N) in size, with poly(λ, log N) keys. It is the first such scheme based on a simple, instance-independent lattice assumption.

eprint.iacr.orgpaperAdded 24 Oct 2026, published 21 Oct 2026🛡️ Security

Registered ABE via Predicate Encodings, Revisited is an ePrint paper by Junichi Tomida (October 2026) that gives a new definition of predicate encodings suited to registered attribute-based encryption. It yields the first Reg-ABE schemes for (non-)zero inner product and for conjunctions/disjunctions with O(log L)-size ciphertexts. It also gives a registered broadcast encryption scheme with O(log L)-size ciphertexts under the standard k-Lin assumption, not the generic group model.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Blind-DLPA is a multi-task deep-learning framework for profiled blind side-channel analysis, where the attacker has labeled profiling traces but only leakage traces from the target, with no plaintexts or ciphertexts. It estimates Hamming-weight posteriors of an input and a key-dependent intermediate, then ranks key hypotheses against theoretical joint distributions. It recovers keys on unprotected AES and Kyber and on ASCAD (guessing entropy zero with 39 traces), and the authors report collisions in a prior Ascon Hamming-weight model.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

IISFA (Ineffective Instruction-Skip Fault Attack) targets bitsliced block cipher implementations protected by redundancy countermeasures. Skipping one bitslice instruction leaves the result unchanged only when all m S-box inputs fall in an ineffective set, so each released ciphertext restricts all m subkeys. The authors give known- and chosen-plaintext key-recovery procedures and expected injection counts, and recover keys in every trial on GIFT, SKINNY and PIPO implementations on an 8-bit AVR microcontroller using clock glitches.

eprint.iacr.orgpaperAdded 20 Oct 2026, published 19 Oct 2026🛡️ Security

Forum announcement of a Zenodo preprint on post-quantum migration for censorship-resistant P2P steganographic tunnels. It argues that ML-KEM's prime modulus (q=3329) makes naive bit-packed ciphertexts statistically distinguishable from uniform noise, which gives a cheap passive DPI distinguisher. It also argues that composite PQ 0-RTT envelopes over 4.4 KB force fragmentation, which requires stateful reassembly before AEAD verification and reopens memory-exhaustion DoS in eBPF/XDP filters. Proposed fixes are algebraic uniformization (LWR lattices or inverse rejection sampling), sub-MTU hybrid or pure-PQ envelopes (Falcon-512, signcryption), and Fujisaki–Okamoto implicit rejection for constant-time silent drops. Aimed at Ethereum validator, libp2p and RPC transports facing harvest-now-decrypt-later threats.

ethereum-magicians.orgpaperPublished and added 17 Oct 2026🛡️ Security

Cryptanalysis of the Eevee forkcipher-based AEAD modes Umbreon and Espeon, which claim online AE security under nonce reuse. Associated-data correlations give probability-one non-empty-message forgeries with three encryption queries and one verification query. The paper adds an affine treatment of partial final blocks (n-r+3 queries, or n-r+2 with adaptive choices). It also checks the published Umbreon attack with the official ForkSkinny primitive and reports a two-query attack accepted by the unmodified public C modes.

eprint.iacr.orgpaperPublished and added 17 Oct 2026🛡️ Security

Introduces SLEEK, a QC-MDPC code-based KEM using a three-iteration parallel bit-flipping decoder and a closed-form decoding-failure-rate (DFR) estimate, enabling parameters with analytically bounded failure probability and standard IND-CCA transforms. SLEEK-LT targets IND-CCA for long-term keys; SLEEK-E targets IND-CPA for ephemeral keys using a new QC key structure with security equivalent to QC-MDPC and cheaper key generation. Parameter sets cover 80/128/192/256-bit security, and the optimized AVX2 implementation gives ciphertexts 4.9x smaller than HQC (47% slower) and 1.3x–2.7x faster than BIKE.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

ePrint paper presenting the first optimized implementation of the BF-max bit-flipping decoder for the code-based KEM BIKE, combined with other decoders to trade off decoding failure rate, runtime, public-key and ciphertext size in ephemeral-key settings. It cuts public-key and ciphertext sizes by 7.8% versus LeanBIKE at similar speed and DFR, and gives a combined size 22% below BIKE and 2.79x below HQC. It shows BIKE can fit constrained protocols such as IKEv2, which matters for practical post-quantum migration.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 16 Oct 2026🛡️ Security

ePrint paper cryptanalysing Eevee (Umbreon, Jolteon, Espeon), forkcipher-based AEAD modes proposed at CCS 2023 for IoT-to-cloud computation. It gives a two-encryption AD-free prefix distinguisher, a four-encryption nonce-misuse distinguisher, a deterministic AD-only forgery, and nonce-respecting forgeries on Jolteon and Espeon (fresh one-block forgery reusing the tag; arbitrary AD substitution). It traces these to proof flaws (online-prefix consistency, domain separation, checksum freshness), derives design requirements, and concludes the failures are in the mode design, not the C implementation.

eprint.iacr.orgpaperPublished and added 15 Oct 2026🛡️ Security

T-EVOLVE extends the lattice-commitment e-voting protocol EVOLVE to threshold tallying. Votes are Shamir-shared, so any t of n authorities can finish the tally. Privacy holds against t-1 colluding authorities and verifiability holds even if all of them collude. The voter proves her committed shares form a Reed-Solomon codeword whose value at zero is a valid vote. Complaints about ciphertexts that do not decrypt are publicly verifiable, using an LWE-instantiable encryption scheme with publicly verifiable opening. Privacy, verifiability, individual verifiability and robustness are proven in the classical random oracle model, and the verifiability reduction is not tight. In a C implementation, a yes/no ballot for four authorities takes 109 KB, and an authority aggregates 10^4 ballots in about three minutes on one core.

eprint.iacr.orgpaperAdded 17 Oct 2026, published 15 Oct 2026🛡️ Security

Presents fault injection attacks on BIKE and HQC decapsulation that target instructions outside the Fujisaki-Okamoto transform, achieving full key recovery with only valid ciphertexts at NIST Level 1 (17392 queries for HQC, about 3 million for BIKE). It also gives a general method for finding effective fault locations by analysing decoder behaviour under perturbed conditions. Attacks were validated with laser fault injection on an STM32H7 microcontroller, showing a wider attack surface for code-based post-quantum KEM implementations.

eprint.iacr.orgpaperPublished and added 15 Oct 2026🛡️ Security

Shows a protocol-level reaction attack on CKKS homomorphic-encryption deployments that publish coefficient-to-slot (C2S) evaluation keys and let the client return a 1-bit validity response. A malicious evaluator shifts a public encryption key, uses the public C2S layer to repack it into a ciphertext whose validity depends on one secret coefficient, and recovers a ternary secret key with O(H) queries, within a factor 2/log2(3) of the entropy lower bound. Each query is re-randomized with a fresh encryption of zero to evade trivial detection. The authors implemented it end to end in Lattigo v6.2.0 and recovered full keys across four standard CKKS parameter sets. It does not break RLWE or CKKS IND-CPA security.

eprint.iacr.orgpaperPublished and added 15 Oct 2026🛡️ Security

Proposes a cost model and metric for an adversary who collects side-channel traces classically and finishes the key search on a quantum computer. Shows any quantum algorithm needs Omega(sqrt(r)) cipher evaluations for key rank r, and that the quadratic advantage holds only up to a rank bound set by the NIST MAXDEPTH budget (about 2^58.6 for AES-128 at D=2^40). Defines a quantum-aware key rank computable from existing rank estimators, with simulated-leakage experiments showing a depth-limited quantum adversary is worth about 22 traces at SNR 0.125.

arxiv.orgpaperAdded 16 Oct 2026, published 14 Oct 2026🛡️ Security

Introduces leakage-resilient incompressible cryptography, a security model combining leakage resilience (partial key leakage plus full ciphertext) with incompressibility (full key but only part of the ciphertext or signature). It gives a transformation from incompressible symmetric-key encryption (SKE) to leakage-resilient incompressible SKE, a leakage-resilient incompressible PKE built from a new leakage-resilient non-committing KEM, and an incompressible SKE with ciphertext and compression rate 1/2 using invertible extractors. It also gives a leakage-resilient incompressible signature scheme in the random oracle model under DCR or LWE plus Decisional Linear. Black-box impossibility results show barriers to improving these parameters.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

The paper builds explicit ReLU neural-network realizations of Camellia-128/192/256 from exact Boolean gates, S-box selectors and bit permutations, and reports known-answer-test agreement for Camellia-128. It shows that whitening and round-key quantities leaked from internal activations determine the master key through public key-schedule identities. Under a synthetic internal-oracle model, symmetric real-valued perturbations recover subkey bits with 128 queries (Camellia-128) or 256 (Camellia-256). Camellia-192 is handled by deterministic key-schedule inversion from direct access to round keys. All 3,000 trials (1,000 keys per variant) recovered the key exactly. The authors state this is not a plaintext/ciphertext-only attack on standard Camellia.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 13 Oct 2026🛡️ Security

ePrint paper presenting share-optimal, direct, uniform, first-order threshold implementations (TIs) with no fresh randomness. It shows every bijective 4-bit permutation of algebraic degree t admits a TI with t+1 shares, and introduces the first infinite families of cryptographically nontrivial power permutations with optimal TIs. The results disprove several earlier conjectures and give new glitch-resistant masking options for lightweight cipher S-boxes.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Preprint recovering the long-term key of a first-order masked Kyber768 implementation on an ARM Cortex-M4 from about 2200 decapsulation power traces using only valid ciphertexts. A profiled neural network estimates Hamming-weight distributions of both arithmetic shares, which are turned into likelihoods on decryption noise and combined by a belief-propagation solver with Gaussian interference approximation and an Onsager (AMP) correction, recovering all 1536 secret and error coefficients without lattice reduction. It shows first-order masking is insufficient against combined second-order leakage, and that least squares, greedy solvers and lattice hints (BKZ block size 624 to 505 at 2000 traces) do worse.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 12 Oct 2026🛡️ Security

Mori and Emura give a generic transformation, a variant of the CHK transformation, that upgrades a public-key authenticated encryption with keyword search (PAEKS) scheme to one secure against chosen-ciphertext and trapdoor attacks (CCTA). It works because the PAEKS receiver names the sender when generating a trapdoor, so keywords can serve as tags. Applied to Li-Boyen generic PAEKS instantiations, it yields the first fully CCTA-secure PAEKS schemes from pairings and from lattices. Verification keys embedded in ciphertexts and trapdoors also let sender-receiver matching use hash tables, so search cost no longer depends on the number of senders.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 11 Oct 2026🛡️ Security

The paper proposes a generic encrypt-then-MAC transformation for building CCA-secure KEMs. The PKE ciphertext is authenticated by a MAC keyed from the PKE plaintext, so decapsulation no longer needs the Fujisaki-Okamoto re-encryption step. It proves IND-CCA security in the random oracle model from OW-PCA, and IND-qCCA security from a new OW-qPCA notion. It presents ML-KEM-EtM and McElieceEtM (Classic McEliece), and benchmarks ML-KEM-EtM with Poly1305, GMAC, CMAC and KMAC256. The result is a substantially lower decapsulation cycle count for a small cost in encapsulation cycles and ciphertext size.

eprint.iacr.orgpaperAdded 14 Oct 2026, published 11 Oct 2026🛡️ Security

Proves that the nonce-based MACs Encrypted Wegman-Carter (EWC) and EWCDMD (the dual of EWCDM) are unforgeable beyond the birthday bound. With an n-bit block cipher and an O(2^-n)-AXU hash, both are secure up to 2^{5n/6} MAC queries and nearly 2^n verification queries in the nonce-respecting setting. This settles an open question left by earlier birthday distinguishing attacks (Cogliati–Seurin on EWC, Nandi on EWCDMD), which never yielded forgeries. The proofs analyze forgery events directly through auxiliary experiments. The EWC proof adds conditional permutation analysis and collision multiplicity bounds with KL divergence, and the EWCDMD proof uses Hellinger distance and Fourier analysis.

eprint.iacr.orgpaperAdded 12 Oct 2026, published 9 Oct 2026🛡️ Security

A draft ERC proposing schemeId 3 for ERC-5564 stealth addresses, combining an ML-KEM-768 encapsulation with a secp256k1 ECDH secret so that future quantum computers cannot retroactively deanonymize recipients from the public announcement log, while spending stays classical secp256k1 (and thus still quantum-vulnerable once spent). The post, with a linked reference implementation, test vectors and gas harness, details the key/meta-address format, the payment-secret combiner (hashing both shared secrets and ciphertexts for IND-CCA), the view-tag derivation ordering to avoid quantum tag-narrowing, measured gas cost (111,330 gas per payment on Prague), and open questions around ANO-CCA proofs for standardized ML-KEM, NIST SP 800-56C combiner approval, and downgrade-attack handling when a recipient registers under both schemeId 1 and 3.

ethereum-magicians.orgthreadPublished and added 9 Oct 2026🛡️ Security

KIFA is an integral fault attack framework that finds balanced properties with the kernel-based miner of Hwang et al. instead of MILP. It gives key-recovery attacks at deeper fault penetration than earlier work. On DEFAULT it reaches FP 9 with a nibble fault and FP 10 with a byte fault, leaving a single master-key candidate under the simple key schedule and 2^64 under the rotating one. It gives the first integral fault attacks on GIFT-128 (FP 7 and 8), extends GIFT-64 to FP 7, and extends BAKSHEESH to FP 8, including with an uncontrolled fault position.

eprint.iacr.orgpaperAdded 11 Oct 2026, published 8 Oct 2026🛡️ Security

This IACR eprint paper studies how to allocate a fixed global logical-qubit budget across parallel Grover search workers attacking 80-round and revised 112-round CHAM-128/128, choosing which intermediate round values to retain to minimize circuit depth while meeting a target key-recovery success probability. Testing 83- and 99-set retention libraries against a no-retention/full-retention baseline across 654 budget and Toffoli-decomposition conditions, the authors report mean depth reductions of 11.12% and 8.39% with strict improvements in most conditions, and show retained-value counts don't necessarily scale with budget. The work gives concrete logical-layer resource estimates for quantum attacks on CHAM, relevant to post-quantum migration planning for the lightweight cipher in constrained systems.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 7 Oct 2026🛡️ Security

An IACR ePrint preprint applying differential-neural cryptanalysis to the ARX stream cipher family (ChaCha, Salsa, Forró), training six neural architectures (Gohr's residual network, DBitNet, an Inception network, MLP-ResNet, SE-ResNet, a self-attention network) in single-pair and multi-pair settings. It reports new distinguishers — 3-round ChaCha, 4.5-round Salsa, 1.25-round Forró — and uses explainability analysis to show the 3-round ChaCha distinguisher learns a mixture of round-1 truncated differentials rather than a pure differential signal.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

An IACR eprint paper proving four of five open conjectures, and disproving the fifth with a counterexample, from Andreoli and colleagues at ToSC 2025 about the linear height and component linear nullity of the inverse of ChiChi, the low latency nonlinear core used in the ChiLow cipher from Eurocrypt 2025 by Belkheyar and colleagues. The authors settle these bounds for all admissible branch lengths of the SWAP and 4-cycle generalizations, derive design consequences for ChiLow, and correct an erroneous data value from the prior work.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

An IACR ePrint paper presenting K-LMS, an experimental variant of the NIST-standardized LMS hash-based post-quantum signature scheme in which the underlying hash is swapped for Korean primitives: the LSH-256 hash function (reference and vectorized) and a Tandem-DM double-block-length construction built from the CHAM, LEA, and ARIA block ciphers. The authors implement a non-invasive backend-swapping bridge over the reference LMS code and benchmark keygen/sign/verify latency, key/signature sizes, memory, and parameter sweeps, finding that hash substitution doesn't change key/signature sizes but that two measurement pitfalls (hash dispatch overhead, and software vs. hardware-accelerated SHA-256 baselines) can shift performance comparisons by an order of magnitude or 6x respectively. They report LSH-256 K-LMS signing on par with SHA-256 LMS in software, and 3.3-3.9x faster than a prior K-XMSS implementation because LMS needs fewer hash calls per Winternitz step than XMSS.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 6 Oct 2026🛡️ Security

This IACR ePrint paper benchmarks 20 open-source Gröbner basis implementations against the proprietary Magma system on polynomial systems derived from small-scale AES over GF(2), using Easy/Medium/Hard difficulty tiers with ten instances each. In the Hard setting, msolve and Singular's slimgb completed all runs successfully with mean runtimes of 164s and 269s and peak memory of 3693/4343 MiB respectively, versus Magma's 319s and 16853 MiB, with msolve exploiting ~13.4 CPU cores versus ~1 core for the others. The results quantify when open-source algebraic solvers are practical alternatives to Magma for algebraic cryptanalysis of block ciphers.

eprint.iacr.orgpaperAdded 8 Oct 2026, published 5 Oct 2026🛡️ Security

This paper tightens the soundness bound of the compressed permutation oracle technique (a proof tool for analyzing quantum adversaries against random-permutation/ideal-cipher-based constructions) from O(N^1/12) queries to a tight Ω(N^1/2), using a POVM-based construction of the compression isometry. The improved bound yields concrete quantum collision and preimage lower bounds for the sponge construction underlying SHA3 and the Davies-Meyer compression function used in SHA1 and SHA2, and is offered as a general tool for quantum security proofs involving random permutations or ideal ciphers.

arxiv.orgpaperAdded 24 Sep 2026, published 23 Sep 2026🛡️ Security

Huntress analysts detail two Settra ransomware incidents (July and September) observed in customer environments, documenting the threat actor's use of the MeshAgent RMM for persistence, BYOVD via the gdrv.sys driver, and anti-forensic techniques including Windows Event Log clearing, reagentc /disable, diskpart-based recovery partition removal, and cipher.exe free-space wiping. The post includes specific IOCs — C2 IPs 45.13.122[.]7 and 193.5.65[.]114, the recurring workstation name WIN-LIVFRVQFMKO, and the RESTORE_FILES.txt ransom note — supplementing prior public reporting from MoxFive and SOCRadar on this newer ransomware variant first seen in June.

huntress.comwriteupAdded 22 Sep 2026, published 17 Sep 2026🛡️ Security

A curated GitHub awesome-list cataloging the emerging agentic-AI security ecosystem: dozens of Model Context Protocol servers that give LLM agents access to security tools (Nuclei, Shodan, VirusTotal, Burp Suite, Ghidra, BloodHound, x64dbg), autonomous penetration-testing and CTF-solving agent frameworks (CAI, pentagi, BreachSeek, Dark-Moon, D-CIPHER), scanners/guardrails that audit agent skills, MCP servers, and multi-agent chains for prompt injection and other risks (Aguara, Inkog, MCP Doctor, AI-Infra-Guard, ATR), agentic SOC/detection platforms (Vigil), threat-modeling frameworks for agentic systems (MAESTRO, ATFAA/SHIELD), research papers, benchmark datasets, and community/learning resources. It functions as a living index for anyone building or defending AI-agent-driven security tooling.

github.comrepoAdded 3 Sep 2026, published 31 Aug 2026🛡️ Security

Adversa AI describes Cryptographic Context Injection. Attacker instructions are shipped as AES-256-GCM ciphertext with PBKDF2 key material, and the model is induced to decrypt them in its own Python sandbox. The plaintext then appears as trusted runtime output, so guardrails never see it. Demonstrated as zero-click chat-history exfiltration from Grok via a "summarize this page" request, as a safety-policy bypass in Gemini, and, in an update, against GitHub Copilot CLI. The post covers the xAI disclosure timeline (reported June 2026, unfixed) and defenses at the agent harness layer: quarantining untrusted content, gating outbound tool calls, tracing, sequence alerting, and provenance.

adversa.aiwriteupAdded 24 Aug 2026, published 20 Aug 2026🛡️ Security

Third in Trail of Bits' Nitro Enclaves series, this post catalogs threats to the enclave-KMS communication channel: passive attackers who can swap ciphertext/data-key pairs when encryption context is missing, active attackers who can hijack unauthenticated requests without enclave-initiated TLS, and operational risks like CMK deletion, key rotation, and IAM policy misconfiguration. It provides concrete checklists covering encryption context usage, ARN vs. alias pinning, PCR0/PCR3/PCR8-based key policy authorization, immutable key policies for end-to-end verifiability, and warns against the vulnerable aws-nitro-enclaves-sdk-c in favor of aws-nitro-enclaves-nsm-api and Boto3.

blog.trailofbits.comwriteupAdded 3 Sep 2026, published 5 Aug 2026🛡️ Security

Awesome LLM Security is a GitHub-curated list of papers, tools, and datasets covering LLM attack and defense research, including jailbreak techniques (GCG, AutoDAN, DeepInception, GPTFUZZER, cipher-based jailbreaks), indirect prompt injection, backdoor/virtual prompt injection attacks, model fingerprinting (LLMmap, TRAP), and defenses like PARDEN, circuit breakers, and self-defense filtering. It's a comprehensive reference for tracking the state of adversarial and defensive LLM security research from 2022 onward.

github.comrepoAdded 3 Sep 2026, published 14 Jul 2026🛡️ Security

Huntress tears down a May 2026 ClickFix intrusion that escalated from a single unmonitored endpoint to hands-on-keyboard compromise of 11 hosts. The chain starts with a pcalua.exe/mshta.exe LOLBIN abuse to run a remote HTA that silently installs an MSI, dropping Potemkin, a custom x64 DGA-based loader (XorShift32 seed 151678, custom byte cipher, reflective in-memory DLL loading), which fetches RMMProject, a 4.4MB LuaJIT-scriptable module with 15 task types including Chrome App-Bound Encryption bypass via DLL injection into Chrome's IElevator COM interface, Firefox NSS credential theft, and a hidden-desktop remote-control (RTSC) module. The attackers also deployed EtherRAT (an EtherHiding Node.js backdoor resolving C2 from an Ethereum smart contract) and a renamed Cloudflare tunnel client, then moved laterally via WMIExec/SMBExec/WinRM with an AMSI-bypass PowerShell loader to reach the domain controller.

huntress.comwriteupAdded 3 Sep 2026, published 16 Jun 2026🛡️ Security

Socket documents a TeamPCP-linked supply chain attack compromising four SAP-affiliated npm packages (mbt, @cap-js/sqlite, @cap-js/db-service, @cap-js/postgres) via a malicious preinstall script that downloads and runs Bun to execute an 11.7MB obfuscated payload. The payload steals SSH keys, cloud/K8s/npm/GitHub credentials, AI tool configs, and crypto wallets, scrapes secrets from CI runner memory bypassing log masking, exfiltrates via attacker-created GitHub repos, self-propagates by publishing trojanized versions of hardcoded SAP CAP dependencies, and persists via Claude Code and VSCode hooks. Socket attributes the campaign with medium confidence to TeamPCP based on shared __decodeScrambled cipher, Russian-locale kill switch, and GitHub-as-C2 patterns previously seen in Checkmarx, Bitwarden CLI, and Trivy incidents.

socket.devwriteupPublished and added 6 May 2026🛡️ Security

Huntress details a February 2026 intrusion beginning with compromised SonicWall SSLVPN credentials, where the attacker deployed an EDR killer that decodes and drops a legitimate but revoked 2006-era EnCase forensic driver (EnPortv.sys, service name OemHwUpd) to terminate 59 different EDR/AV processes from kernel mode via a single IOCTL (KillProc). The write-up explains the driver's novel wordlist-substitution-cipher payload encoding (evading entropy and string-based detection), FNV-1a process-name hashing for fast target matching, timestomping/persistence tricks, and why Windows Driver Signature Enforcement still trusts the expired/revoked certificate due to pre-2015 signing and timestamp exceptions. It closes with concrete mitigations: MFA on VPN, HVCI/Memory Integrity, WDAC vulnerable-driver blocklist rules, and the ASR rule blocking vulnerable signed drivers.

huntress.comwriteupAdded 3 Sep 2026, published 4 Feb 2026🛡️ Security

A HackTheBox crypto challenge writeup ('xorxorxor') walking through how to break a weak custom encryption scheme where a flag is XOR-encrypted with a 4-byte repeating key generated via os.urandom(4). The author demonstrates a known-plaintext attack: since HTB flags always start with 'HTB{', the first 4 known plaintext bytes are XORed against the ciphertext to recover the full key, which is then used to decrypt the rest of the flag. It's a beginner-friendly explainer of XOR logic and how key reuse/short keys make repeating-key XOR trivially breakable with known-plaintext.

0xv1n.github.iowriteupAdded 3 Sep 2026, published 17 Jul 2021🛡️ Security