Technology Consulting, Code Review, Application Development. #appsec #infosec #cryptography #crypto #php
Naples, FL
Joined March 2015
- Tweets971
- Following56
- Followers1.4K
- Likes314
Pinned Tweet
Allow Developers to Cryptographically Sign Their Own Plugins/Themes with the Gossamer Public Key Infrastructure (PKI)
core.trac.wordpress.org/tick…
#WordPress #infosec #crypto #pki #ed25519 #GossamerPKI
Paragon Initiative Enterprises retweeted
Ending the year with a vulnerability in libsodium 00f.net/2025/12/30/libsodium…
Accelerating The Adoption of Post-Quantum Cryptography with PHP
paragonie.com/blog/2025/02/a…
Paragon Initiative Enterprises retweeted
To whoever is working on "image encryption" out there:
- Your custom stream cipher using chaotic maps is not secure or efficient
- AES-CTR is not slow and does not suffer from weak entropy problems (WTF)
- Floating point is not great for cryptography (sorry, Falcon folks!)
Paragon Initiative Enterprises retweeted
Just released a new version of libaegis, as well as the rust bindings github.com/jedisct1/libaegis - Easy-to-use, high security, high performance authenticated encryption. Now with convenient helpers to use it as a MAC, and workarounds for LLVM18 regressions. github.com/jedisct1/libaegis
Old, tired argument:
"You can't declare things as a typed array, e.g. string[], in PHP"
New, refreshing argument: github.com/paragonie/typed-a…
Paragon Initiative Enterprises retweeted
Newly open sourced: A CipherSweet key provider backed by AWS KMS.
github.com/paragonie/ciphers…
Newly open sourced: A CipherSweet key provider backed by AWS KMS.
github.com/paragonie/ciphers…
We introduced CipherSweet with a 2019 blog post: paragonie.com/blog/2019/01/c…
The description the NVD published CVE-2024-33851 is unfortunately misleading.
See the note at the top of github.com/paragonie/phpecc/… for specific details.
Paragon Initiative Enterprises retweeted
Security Issues, Abandonment, and Fork of PHP ECC library (mdanter/ecc, phpecc/phpecc) openwall.com/lists/oss-secur…
The project "has not responded to our attempts to fix
security issues from the year 2021" so "we opted
to fork this library." by @ParagonIE
Paragon Initiative Enterprises retweeted
We forked PHPECC!
Read the release notes below and update your dependency ASAP.
github.com/paragonie/phpecc/…
Paragon Initiative Enterprises retweeted
The latest release of EasyECC uses our PHPECC fork.
Additionally, it prevents and rejects malleable ECDSA signatures and opts for constant-time algorithms when secret keys are involved.
Paragon Initiative Enterprises retweeted
However, this library is still rather low-level, so you're better off using github.com/paragonie/easy-ec… instead.
The API for EasyECC is much simpler, easier to get right, and harder to get wrong.
Paragon Initiative Enterprises retweeted
Given the prevalence of software (especially cryptocurrency-adjacent) that relies on this code, we thought we'd take it over and provide a better story for its security.
So we forked it.
Paragon Initiative Enterprises retweeted
We've been trying to fix PHPECC since 2021, but there has been little-to-no response from the maintainers since 2018.
e.g. github.com/phpecc/phpecc/pul…
We forked PHPECC!
Read the release notes below and update your dependency ASAP.
github.com/paragonie/phpecc/…
However, this library is still rather low-level, so you're better off using github.com/paragonie/easy-ec… instead.
The API for EasyECC is much simpler, easier to get right, and harder to get wrong.