Carelessness versus craftsmanship in cryptography
blog.trailofbits.com | blog | #vulnerability-research | #open-source | #cryptography | #vulnerability-disclosure | #trail-of-bits | #aes | #key-iv-reuse | #ctr-mode | #iv-reuse
Summary
The aes-js and pyaes libraries ship dangerous default IVs in their AES-CTR APIs, causing key/IV reuse bugs; Trail of Bits contrasts their dismissive maintainer with strongSwan's exemplary fix.
- Published
- Collected
--- id: 1299 title: "Carelessness versus craftsmanship in cryptography" source_domain: blog.trailofbits.com source_url: "https://blog.trailofbits.com/2026/02/18/carelessness-versus-craftsmanship-in-cryptography/" published_at: "2026-02-18 12:00" tags: ["vulnerability-research", "open-source", "cryptography", "vulnerability-disclosure", "trail-of-bits", "aes", "key-iv-reuse", "ctr-mode", "iv-reuse"] phying_url: "https://phying.com/item/1299" lang: en --- # Carelessness versus craftsmanship in cryptography ## Summary The aes-js and pyaes libraries ship dangerous default IVs in their AES-CTR APIs, causing key/IV reuse bugs; Trail of Bits contrasts their dismissive maintainer with strongSwan's exemplary fix. ## Intelligence Metadata - **Sources:** blog.trailofbits.com - **Published:** 2026-02-18 12:00 - **Original:** https://blog.trailofbits.com/2026/02/18/carelessness-versus-craftsmanship-in-cryptography/ - **Phying News:** https://phying.com/item/1299