How I Tamper-Proofed my Web Server

Imagine building a world-class digital vault, complete with un-crackable elliptic curve cryptography and advanced quantum-resistant algorithms. You host it on a remote server, confident that no one can peer inside. But what happens if a malicious actor doesn’t try to crack the vault itself, but instead secretly slides a modified, compromised keyhole onto your front door while you aren’t looking?

In the web security world, this is a massive vulnerability. Traditional browsers blindly download and execute whatever code a remote server throws at them. If a server is compromised, your security app can be turned against you before you type your first keystroke.

To protect PassLok, KyberLock, and now Privacy Bar Mobile, I decided to flip the script. With Gemini’s help, I built a zero-trust, Authenticated Bootloader—a miniature cryptographic gatekeeper that turns your browser into a self-checking logic engine.

Here is the exact story of how I made my applications entirely tamper-proof, running smoothly both on the remote web and natively offline on your mobile home screen.

Read More

PolyCrypt improved

Abstract cryptographic visualization showing interconnected security patterns and encryption elementsWe are now in the era of Artificial Intelligence, and I’m using it to improve many things—including my cryptographic codes. I asked Gemini AI to analyze the PolyCrypt algorithm, which is designed to be human-computable, and it discovered several vulnerabilities. These issues are now resolved in PolyCrypt 2. Read on to see how these improvements were achieved.

Read More

Current version of KyberLock

Beginning with v2.0, KyberLock uses a self-verifying loading script. File index.html verifies the signature and the hashes of the rest of the code. The only thing the user should verify is index.html itself, which is the same for other apps, such as PassLok and Privacy Bar mobile. Here’s a copy of the file: loader_index.html

The SHA256 of the current index.html loader is:

82b831a9a9450989e7d8a9169e17714c0ab061d17eb8544d74547cef1fe1acd8

I’m not reading it in a video because that has become too easy to fake these days. Instead, you’ll see this hash posted in multiple places, such as the Chrome store pages for the associate extensions.

 

Previous version of KyberLock was: 1.0.1

Made on 11/25/24

Main source: https://kyberlock.com/app

SHA256 for web sources (single html file):

1024-6687-b546-9561-7eb4-0527-311a-cfbc-e8bc-e6c8-ed4b-a51b-4acd-85b8-e153-baab

KyberLock released

KyberLock is a new web app, similar to PassLok, making quantum-proof cryptography easy to use. It is based on the recently released standard for post-quantum encryption, and has a strength comparable to that of AES-192. The main method is called Crystals-Kyber by its authors, hence the name of the app.

You may ask, why mess with quantum-proof cryptography now, since quantum computers capable of breaking current methods are not yet expected to be available in the next ten years? Because you may have private data right now that you would not like to be vulnerable even in ten years’ time.  Someone might record it in encrypted state, and wait until quantum computers can decrypt it.

You can get it from its GitHub page, or run it from its own page. Don’t forget to look at the code.

Read More

Long article on Cryptography

I have written a fairly long article, entitled “Can a Tabula Recta provide security in the XXI Century?” combining several posts from this website. The overarching assumption is that, in a world where connected computers are everywhere, we may get to a point where no electronic means within a given person’s reach can be trusted. What then? Use low-tech means that have been tweaked and optimized using computers, to stand against computer-aided attack if if comes to that. You can find the article here.

Introducing PolyCrypt

Some time ago, a user named Steven uncovered a weakness in the FibonaRNG cipher, leading to this other post as a reply. At that time, I did not think that FibonaRNG needed to be strengthened, but recently I have realized that it would not be very difficult to remove that weakness. The result is PolyCrypt. The “Poly” bit comes from the fact that it can not only add security, but also remove it, making it a good platform to test classic human-computable ciphers.

Read More