We found a new compression side-channel attack against SSH: if you use port forwarding with terminal sessions, a web attacker+eavesdropper can recover a sudo pwd in a few hundred trials. There is only one compression context for all channels. Accepted at CCS 26, preprint: arxiv.org/abs/2609.07709

Crossing the Streams: SSH Plaintext Recovery via a Common Compression Context in Multiplexed Channels

SSH is the standard protocol for secure remote administration of servers. At the transport layer, SSH uses the Binary Packet Protocol (BPP) for encrypted and authenticated communication. Above this, t...

arxiv.org

I guess the people joking satirically about "oh the solution was just out there" will have to revise their view a bit, because Actually, it was in a mathematican's chat logs which it had access to. This isn't even the first time internal secret work leaks via AI

Micah Warren@micah541.bsky.social · 2w ago

cloak and dagger navier stokes cims.nyu.edu/~tristanb/st...

I wrote an essay on Cedarcrypt and on why I teach cryptography in Lebanon. The essay also links to the full Cedarcrypt 2026 photo album, which is now online. symbolic.software/blog/2026-07...

Why I Teach Cryptography in Lebanon — Symbolic Software

Cedarcrypt's first edition has concluded. On what a year of teaching cryptography in and for Lebanon has meant, why the conference met in Cyprus rather than Beirut, and the decades of work ahead.

symbolic.software

I’m in Lisbon, Portugal, after holding the spiqe.cool workshop, enjoying the weather, food, culture, and nature. Europe is amazing! 🇪🇺

Another vote for Chat Control was fast tracked to 12:00 CEST today! This would force backdoors into chat apps, etc

When we educated people about not clicking on links in emails we should have added that this also applies to instant messages.

Want to help shape the cryptography that ends up in Internet standards? CFRG is looking for Crypto Review Panel members. Self-nominations welcome. Two-year renewable term. Send nominations by April 20: cfrg-chairs@ietf.org wiki.ietf.org/group/cfrg/C...

Renewable energy is peace energy. unric.org/en/un-climat...

UN Climate Chief: Recent weeks show the dangers of fossil fuel dependency

Remarks delivered by UN Climate Change Executive Secretary Simon Stiell at the Green Growth Summit in Brussels

unric.org

www.theguardian.com/environment/...

Revealed: the world’s worst mega-leaks of methane driving global heating

Exclusive: Fixing a leak can be simple and equivalent to closing a coal power station, making lack of action maddening, say analysts

theguardian.com

Just putting this out there: the amount of software that exists in production vastly exceeds our global capacity to maintain it. And AI is going to make this an ultimate nightmare as often it is now easier to start from scratch than building a framework. Liability law will need updates.

Claude code has a pattern to extend existing code by adding a condition: size_bytes = total_size.to_bytes(4, 'big') if total_size > 0xFFFF else b"\x00\x00" + total_size.to_bytes(2, 'big') - unnecessary here, but I wonder if that is common in the industry to avoid breaking things?

I gave our students two screenshots, one with a valid PGP signature and one with a signature by the attacker (also valid) where the signer had a different eTLD and a spoofed From: address. They complained it was too hard to spot .org instead of .de. We need sender validation for signed PGP emails!

I vibe-coded hotcrp bidding helper with Claude. It's a single index.html (+2 JS libs from CDN). Preferences can be im- and exported via CSV. Topics/Keyword scores can be taken from your own publications (just drop in PDFs and run a script). Image shows fake data. Enjoy! github.com/lambdafu/hot...

Now's your chance to participate in growing academic cryptography participation in the Middle East and North Africa region: the Africacrypt call for papers is out! Submit your paper and come join us this July in beautiful Hammamet, Tunisia: www.africacrypt2026.tn/call-for-pap...

Over the past few months, I have left my comfort zone and begun working on Agentic AI systems. For that, I am now trying to fill several roles, so if that sounds like something you'd like to work on with me, please get in touch.

Submissions are now open for the SPIQE Workshop! Submit your work until 12th of March AoE! ⚛️ spiqe.cool

At the gpg.fail talk and omg #39c3 You can just put a \0 in the Hash: header and then newlines and inject text in a cleartext message. Won’t even blame PGP here. C is unsafe at any speed. gpg has not fixed it yet.

I strongly believe that AI will have a lasting impression on human to human communication. Expectations will be presented as prompts rather than as opportunities. The response to non-compliance will be reinforcement rather than reflection. And success will be judged by how well the recipient obeyed.

Announcing SPIQE 2026: 2nd Workshop on Secure Protocol Implementations in the Quantum Era, bringing together researchers and implementers to securely deploy PQC! 📍 Co-located with Euro S&P in Lisbon, Portugal, July 6-10, 2026 spiqe.cool #SPIQE2026 #EuroSP #PostQuantumCrypto

Coming back from south east Asia, there are so many small things I immediately notice about my home, the Ruhr area. There is too little workers helping people behave better, like keeping a bit of distance away from the baggage belt (there were no markings either).

This is a friendly reminder that the call for contributed talks to Real World Crypto in Taipei 2026 is open until October 10. We are looking for interesting talks bridging cryptography and its real-world use! Also it’s a great way to meet new people! rwc.iacr.org/2026/contrib...

RWC 2026 call for papers

Real World Crypto Symposium

rwc.iacr.org

Penang Hill, Malaysia

RWC 2026 in Taipei!

We found a new vulnerability in TLS. It's a variant of the ALPACA attack that bypasses current countermeasures. Relativly low impact - but great insight! Check it out: opossum-attack.com

Man lese und lösche umgehend seinen Twitter-Account, falls immer noch nicht geschehen. Unfaßbar, was @arminwolf.at versucht hat und wie er an X, den Iren, der EU und (natürlich) an den USA scheitert.

X ist ein rechtsfreier Raum › Blog von Armin Wolf

Warum es praktisch unmöglich ist, anonyme Hass-Postings auf X zu bekämpfen: Die Gesetze sind zu schwach, X ignoriert sie, zuständige ...

arminwolf.at

Eamonn and I received a Zama Cryptanalysis Grant to help with the lattice estimator github.com/malb/lattice.... We hope to hire interns to work on the estimator over two periods over the next 18 months. Zama are still taking applications for this grant, see here: www.zama.ai/post/announc...

GitHub - malb/lattice-estimator: An attempt at a new LWE estimator

An attempt at a new LWE estimator. Contribute to malb/lattice-estimator development by creating an account on GitHub.

github.com

Kinderschutz im Netz bleibt oft Theorie: Informatikerin Veelasha Moonsamy untersuchte mit Kolleg*innen aus Belgien und den Niederlanden rund 70.000 Werbeanzeigen auf Webseiten für Kinder – mit alarmierenden Ergebnissen. 👉 news.rub.de/wissenschaft... (Foto: Roberto Schirdewahn)

Als Mitglied des Exzellenzclusters CASA erforscht @veelasha.bsky.social die Systeme unseres alltäglichen Gebrauchs, wie etwa unsere Smartphones. Am 22. Mai entscheidet sich, ob CASA und damit die Forschung von Moonsamy und ihren Kolleg*innen weiter gefördert wird. Daumen drücken! 🤞

Goodbye @ruhr-uni-bochum.de Hello @uni-wuppertal.bsky.social Today is my first day at BUW. Super excited to join this awesome place. Looking forward to many interesting projects and collaborations. If you would like to join or collaborate with our brand new IT security group get in touch with me.

We (@lambdafu.bsky.social & me) found a critical security vulnerability in the #Erlang/OTP SSH daemon that allow attackers to execute arbitrary code via network access on devices running Erlang/OTP SSH servers. This vulnerability is #CVE-2025-32433, patches out now. Estimated CVSSv3 10.