Posted in未分类
RSA-OAEP Has a Payload Ceiling: Why 2048-Bit RSA Fits Only 190 Bytes
A 2048-bit RSA key does not encrypt 256 bytes of useful plaintext. With OAEP-SHA256, the…
Posted in未分类
Your JWT Verifier Passed a Forged Token. The Library Did Exactly What It Was Told.
Algorithm confusion is the most common JWT verifier failure in production. Pin the alg, pin the iss, pin the aud — then verify the signature.
Posted in未分类
Your PEM File Is a Black Box Until It Isn’t: A Field Guide to the X.509 Certificate Decoder
Paste the PEM, see every field in one screen — validity badge, subject and issuer, public key, signature algorithm, SAN list, and a copy-paste-friendly SHA-256 fingerprint. All parsed locally in your browser.
Posted in未分类
Entropy, Not Characters: A Field Guide to the Secure Random Generator
The bottom line If you remember one thing from this guide, remember this: a secret…
Posted in未分类
Why Your HMAC Verifier Leaks the Whole Secret at Lunchtime
You ship a webhook signature check that compares two hashes with == and you feel…
Posted in未分类
Why Your Profanity Filter Misses 1337: Catch the Mixed-Token Bypass
Your filter blocks a banned word, but does it still recognize the same word after…
Posted in未分类
Why a 2,000-Year-Old Cipher Breaks in 25 Guesses
Caesar's substitution cipher has a 25-shift keyspace — every ciphertext collapses on the first brute-force pass. Here is why every modern cipher is just a Caesar cipher with a bigger keyspace.
Posted in未分类
Why Scrypt Verification Quietly Fails: The Parameter Trap Behind Every Login
A standalone Scrypt Validator belongs in your incident kit. Verification is where scrypt silently breaks, and a bit-exact debugging instrument catches it before customers do.
Posted in未分类
Rotate Secrets Before They Become Incidents
A practical four-week plan for turning a messy .env file into an owned, staged, and reversible credential lifecycle.
Posted in未分类
Measuring Cryptographic Strength with an Entropy Calculator
Length is not a security metric. Use Min-Entropy to measure how unpredictable a password, key, or token really is — and how long it would take an adversary with 10⁶ to 10¹² guesses/sec to crack it.