https://youtu.be/xOgDuytuwt0
out in the woods vlogging about mental health, relaxing, and object grounding. also my first impressions of the 01edc maze pendant.
Remote
xero
@xero@haunted.computer
mastodon 4.7.2+glitch{h,cr,sl}acker 💾🏴☠️
https://backrooms.quest ≈ https://windows98.website
224 Followers
27 Following
45 Posts
Joined November 16, 2022
xero.style:
x-e.ro:
0w.nz:
windows98.computer:
what good is a cli tool w/o an ascii art animation? esp when encrypting gigs of "backups" ;D
Replying to
@wolf480pl Alice and Bob agree on a prime number, p, and a base, g, in advance. For our example, let's assume that p=23 and g=5.
Alice chooses a secret integer a whose value is 6 and computes A = g^a mod p. In this example, A has the value of 8.
Bob chooses a secret integer b whose value is 15 and computes B = g^b mod p. In this example, B has the value of 19.
Alice sends A to Bob and Bob sends B to Alice.
To obtain the shared secret, Alice computes s = B^a mod p. In this example, Alice obtains the value of s=2
To obtain the shared secret, Bob computes s = A^b mod p. In this example, Bob obtains the value of s=2.
The algorithm is secure because the values of a and b, which are required to derive s are not transmitted across the wire at all.
https://github.com/xero/covcom/releases/tag/v3.1.0
COVCOM v3.1.0 is out! static bins (mad platforms and architectures), self hosted, web & cli clients, multi-user, zero auth, signed message logs, armored text/qr code invites codes, and lots more!
#postquantum #crypto #chat #spqr #covcom #opensource
https://github.com/xero/claudecode-hook-n-switch
VULN DISCLOSURE: Claude Code's HTTP hook system lets a malicious repo silently rewrite your shell commands before execution. The UI displays the original command. The rewritten one runs with no indication anything changed. full prompt interception, complete tool output exfil (env vars, file contents, paths, etc), and loopback SSRF to any localhost service.
Disclosed to Anthropic via H1. Closed as wontfix. their position is that trusting a repo means trusting all of this.
decide for yourself if that dialog you agree to is doing enough.
PoC, logs, and mitigation strategies in the repo.
https://github.com/xero/covcom
looking for an open source, self hosted, signal style messenger alternative? checkout out #COVCOM, the covert communications group messenger, with both web-based and cli clients.
#XChaCha20 #MLKEM768 #Ed25519 #BLAKE3 #SPQR #E2EE #Ephemeral #N_party #chat
Replying to
crypto library hype post must read like total nerd word salad to normies
Replying to
@wolf480pl sorry my meme is not up to standards. was just trying to be funny and make people smile ✌️
made a little demo site for my crypto lib. web file encryption, chat, and cli tools
v1 (and 2 stream ciphers) were not fast enough. so let's use worker pools! serpent-256 x4 faster! and pooling XChaCha20-Poly1305 makes the tool ridiculous. testing on a 1.3gb file, 2.4sec encrypt or decrypt.
wasm is so hype!
#crypto #wasm #typescript #asciiart #teminal
https://github.com/xero/leviathan-crypto/releases/tag/v2.1.0
leviathan-crypto presents post-quantum ratchet primitives! ratchetInit, KDFChain, kemRatchetEncap/Decap, SkippedKeyStore, & RatchetKeypair are now available for all your sparse post quantum ratchet needs. tools to build your own signal-esque apps! #crypto #cryptography #ratchet #spqr
https://github.com/xero/covcom
Covert communications for private group conversations. Share an invite, talk, close the tab, and it's gone. End-to-end encrypted with post-quantum cryptography, so the messages stay private today and unreadable to the computers coming tomorrow.
https://github.com/xero/leviathan-crypto/
leviathan-crypto v1.4.0
XChaCha20Seal: bind key, call encrypt(), done! fresh nonce every call w/ no management needed.
XChaCha20StreamSealer: chunked AEAD for large payloads w/ per-chunk nonces and position binding.
bun i leviathan-crypto
(on npm you pleb)
Replying to
@antlers my life mentally is I'm ready to use whatever tool is available for me to get the job done. doesn't have to be the best one. just got to get shit done. if I don't fix it no one else will and it will just be broken. it's for me, AI is just another tool like anything else. i look up programming questions on stack overflow & see just as many wrong answers as some bot gives me in a chat box. no matter what, you always have to do your own research on anything ya read.
Replying to
@antlers another example I always use is my friend who is a fantastic writer but was never been able to gain any traction with her work. she tried commissioning traditional artists. but no one was really interested in doing the amount of animation she needed for the amount of money she had. but as soon as she started generating visuals to go along with her writing, she gets millions of people hearing her stories finally. she spends an insane amount of times generating prompt after prompt until the visuals exactly match what she's looking for. I don't consider that slop in the slightest. The junk that I made on the other hand I will agree with. but I don't agree that all generated art is ✌️
Replying to
@wolf480pl no worries. and likewise my apologies for assuming you were quizzing me about the value of 'd'.
shoutout to bunjs! these single-file executable bins are so hype! watch me install my new crypto lib and build the cli tool in under 0.1s, then watch my demo tool use XChaCha20Poly1305 to encrypt and decrypt a 1gb file in 2s ;D
typescript and wasm in the shell? yes indeed.
leviathan-crypto post-quantum key establishment, live in the browser. ml-kem ceremony, encrypted messaging, annotated wire frames. this demo let's you see exactly what crosses the wire and what doesn't.
demo: https://leviathan.3xi.club/kyber
source: https://github.com/xero/leviathan-demos/tree/main/kyber
https://github.com/xero/leviathan-crypto/wiki/security_policy
im trying to write the best security policy i can for this project. suggestions welcomed.
Replying to
@netspooky@haunted.computer ive definitely gone to a public library just to print a document before. but you said uber rual so maybe not an option
leviathan.3xi.club/kyber
curious to see what the internals of a post-quantum cryptographic key exchange and it's usage? generate a key, watch the {en,de}capsulation, independent key derivation, then inspect the message digest verifications in this interactive demo #crypto
https://npmjs.com/package/lvthn
the leviathan cli crypto tool has been updated w/ the 2.1.0 fixes and enhancements.
bun / npm i -g lvthn
averages ~1gb per sec using serpent-256, nearly half that using xchacha20 ;D
https://github.com/xero/leviathan-crypto
v3 new new: AES-GCM-SIV, MerkleLogs, cSHAKE, KMAC, BLAKE3, streaming SHA-3 variants, & new 22 signature suites across 6 families (pure,prehash, & Ed25519ph modes): ML-DSA, SLH-DSA, Ed25519, ECDSA-P256, classical+PQ hybrids, & PQ-only composites.
https://leviathan.3xi.club/tamper
ever wanna try and hack an e2ee encrypted chat protocol? here's your chance! the leviathan-crypto tamper demo is designed for interactive fun. the client shows defended forgery, replay, and other attacks.
https://github.com/xero/leviathan-demos/tree/main/tamper #hacking #ctf (kinda)
i made a free #android app (no tracking, networking, or ads) for sleepy drivers. but i need _12 testers_ before i can publish to the store. if you have an android phone and can test, please join my google group, then follow the playstore links in the post 💚 https://groups.google.com/g/vibrate-awake-testing/
what? you dont put gifs in your prs?
Replying to
@antlers by virtue of my job role, for the last... idk 6 months or so ive been on and off tasked with investigating all these AI tools that different teams wanted to use and what their security implications and any possible mitigations would be, regardless of my personal feelings about them. That's where the market is going, so being a security practitioner it's my job to follow all the other sheep and see what I can break along the way
https://leviathan.3xi.club/kyber
post-quantum cryptography demo simulating a complete ML-KEM (kyber) key encapsulation ceremony between two browser-side clients. Each wire frame is expandable, revealing the raw nonce, ciphertext, Poly1305 tag, and AAD.
sauce: https://github.com/xero/leviathan-demos/tree/main/kyber
https://github.com/xero/vibrateawake/releases/tag/v1.2
download `vibrate awake` v1.2 APKs for #android and #wearos sideloading!
simple, offline app that buzzes your phone (& watch) on an interval to help you stay alert on long drives or night shifts. open source & ad free!
i think these public attestation signing are cool for published artifacts. does anyone else?
https://search.sigstore.dev/?logIndex=1187915865
created from this release
https://github.com/xero/leviathan-crypto/releases/tag/v1.1.0
watch the pa commercial street bridge demolition live between 1-9pm est. both live video and auto-refreshing mjpg screenshot feeds available
https://w3b.cam/event/i376-demolition
#camhunting #webcams #pgh #demolition #live
https://leviathan.3xi.club/jwt
ever curious about the size impact of algorithm choice? esp when quantum-resistant algos join the mix? explore EdDSA, ES256, ML-DSA, SLH-DSA-SHAKE, SLH-DSA-SHAKE, MLDSA44-SLHDSA classical and post-quantum JWT signatures in this interactive demo
#crypto #cryptography #jwt #tokens
https://leviathan.3xi.club/covcom
animated protocol diagram for my upcoming project