PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

crypto-condor: a test suite for cryptographic primitives

blog.quarkslab.com | research | #open-source | #compliance | #cryptography | #tool | #crypto-condor | #test-suite
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Quarkslab presents crypto-condor, an open-source suite for compliance-testing cryptographic implementations — test vectors and RNG checks — built during an internship to automate routine audits.
Published
Collected

Related coverage

tool · github.com
Peach: Single-user, Local-first Personal Media Library and Management System
Offers a privacy-respecting, local-first alternative for media library indexing and playback, combining cloud-drive integration with automated scraping while keeping sensitive viewing data strictly local.
blog · certik.com
CertiK Joins LF Decentralized Trust to Advance Security Standards for Enterprise Blockchain
CertiK joined LF Decentralized Trust, the Linux Foundation's enterprise blockchain community, to bring security expertise into shared open-source infrastructure as global regulation tightens.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
SightHouse: Automated function identification
Quarkslab presents SightHouse, an open-source reverse-engineering tool that retrieves program metadata and identifies functions already known from other libraries, binaries or online source code.
research · blog.quarkslab.com
Getting started with Wirego
An introduction to Wirego, a Quarkslab tool that funnels Wireshark's plugin API over ZMQ so reverse engineers can write dissectors in friendly languages such as Python or Go.
Back