Broken Crypto is Broken
summary
Shows concrete failures: weak RNGs in VMs and routers, key material stored with the data, and predictable short keys; demonstrates a browser exploit of a padding oracle attack that recovers plaintext without the key; explains IV-bit flipping in CBC to escalate a session to admin, and timing/length/compression side channels that leak secrets; calls out JWT and XML signature pitfalls (algorithm none, RSA/PKCS#1 v1.5 and length‑extension on MD5) and recommends constant-time comparison, HMAC/AEAD and never reuse nonces.
AI-written summary · about
chapters (14)
- 0:00Start
- 6:15Birthday Paradox
- 14:16Stream Ciphers and Block Ciphers
- 15:27Block Ciphers
- 16:46Cbc Cipher Block Chaining Mode
- 28:26Example of a Size Problem
- 29:51Aes Gcm
- 30:04Aes Counter Mode
- 32:01Asymmetric Encryption
- 36:46Xml Signatures
- 38:19What's Wrong with this Code
- 42:26Constant Time Comparison
- 42:43Json Web Tokens
- 43:59Type Confusion
