PGP: 607E 5A7A D030 D38E 5E5C 2CA5 02C3 0AE9 0FAE 4A6F, #VeraCrypt author, IDRIX founder, AM Crypto founder
Kobe - Japan
Joined October 2018
- Tweets341
- Following44
- Followers212
- Likes859
Grok has spoken!
A nation-state with these intermediate CA private keys for ~17 months could issue valid certs for any domain on demand. With network access they could MitM HTTPS traffic at will—decrypting logins, emails, banking, or government sessions—while remaining invisible to most clients. Code-signing keys would let them distribute trusted malware. Targeted espionage on high-value users or mass surveillance of unprotected systems would have been straightforward and largely undetectable.
I leave it to AI to summarize the issue and implement PoC. What a time to be alive!
The private keys of eight eMudhra intermediate CA certificates have been compromised.
They chain to roots trusted by the Mozilla, Microsoft, Apple and Chrome root programs and by many downstream trust stores.
emudhra.we-have-a-problem.co…
Mounir IDRASSI retweeted
I was invited to give this lecture/tutorial on Verifpal to undergraduate students just learning about cryptography.
My thanks to the University of Edinburgh Informatics Department for this wonderful opportunity. It was great to meet so many students!
youtube.com/watch?v=JYUo5gNc…
HashCheck 2.6.3 is out! You can now create one checksum file per file and copy verification results. It also fixes WinGet detection and opening checksum files on Wine 9.0.
Thanks for your reports and contributions!
github.com/idrassi/HashCheck…
Thank you @ChatGPT for detecting cybersecurity risks while translating Kanji on a fish package. Your safety checks are valuable.
Cryptanalysis is much more fun (and powerful) with AI. This time, my target was FEILIAN from China's NGCC . I learned a lot through this. My full review available is live at amcrypto.jp/security/FEILIAN…
Mounir IDRASSI retweeted
A lot of brilliant people in my field grieving the loss of their purpose. It’d be easier to laugh about if it wasn’t coming for all of us sooner or later.
Found and reported a Microsoft compiler bug affecting AES hardware support in CPUs. Concerning for sensitive cryptographic code like OpenSSL code, which is where I discovered it.
developercommunity.visualstu…
Upgrading or changing compiler is risky business!
My 10 USD run against PQC candidate CHAMP using kimi-k3. Attacks reproduced in python. cryptography reviewed are being democratized.
Ox Alpha is worse than GLM-5.3 for security reviews.
I tested them on a real world repository (3 passes each), judged by gpt-5.6-sol.
Don't fall to the hype.
So many Fields medals lost to AI...mathematicians are also in trouble!
yes, nonsofic groups exist: this statement is one of many new beautiful results proved by Astra, our next major model.
We're releasing 10 such Astra proofs, complete with lean certificates and CoT walkthroughs for each of them. The results are wide-ranging, from von Neumann algebras (disproof of Connes' Rigidity Conjecture) to better bounds for high dimensional sphere packing, for circuit complexity, for monochromatic triangles in multicolored graphs, and more.
More thoughts here: openai.com/index/ten-advance…
So many people are sitting on local Windows privilege escalation exploits that it's not funny anymore...MS can't keep up. Reality is that once an attacker has local access, it's essentially game over.
Standard user to SYSTEM on the Microsoft Surface family (I believe all are affected - tested on Surface 11 Pro (Build 28120.2315)). It's the SurfaceBroker service that trusts a token name any user can fake.
Report to MSRC and be disappointed again, or just drop? 🤔
Btw: researched and built purely with Claude Code this afternoon.
Mounir IDRASSI retweeted
VeraCrypt 1.26.29 is now available!🎉
- Argon2id KDF for non-system volumes
- Security fixes: CVE-2026-54073 & CVE-2026-53762
- Microsoft UEFI CA 2023 support for system encryption
- Driver, EFI, Linux/macOS fixes
🔗More details at veracrypt.jp/en/Release%20No…
I have published an technical analysis of RoguePlanet vulnerability:
amcrypto.jp/security/RoguePl…
Nightmare Eclipse guy has returned (as is tradition) and has released another Microsoft Windows zero day (as is tradition).
> releases zero day
> spells rogue wrong in file
> "rogeplanet"
smh
github.com/MSNightmare/Rogue…
Schrödinger's cat, Anthropic Fable variation.
Arch Linux keyring installed by @arkalinuxgui is outdated, so updates fail. The commands below solved it:
sudo rm -f /var/cache/pacman/pkg/*.part
sudo pacman -Sc
sudo pacman-key --init
sudo pacman-key --populate archlinux
sudo pacman -Sy archlinux-keyring
sudo pacman -Syu
2026 is the year Linux kernel lost its marvel in my eyes.
What a great idea, only Project Zero who makes 0day hard could have thought of this: lore.kernel.org/all/20260508…
Here it is in grsecurity from 23 years ago: github.com/linux-scraping/gr… very shortly after the first KERNEXEC release in 2003.
Now maybe you can find that scsi/cdrom bug :)
Very good and enlightening read .
Do not be worried that LLMs are going to find all the vulns - that is not the case at all.
Read: why vulnerability research is mathematically difficult: github.com/yo-yo-yo-jbo/vr_d…
