Steve Weis's Avatar

Steve Weis

@saweis.net

Security Engineer interested in cryptography, information security, & privacy engineering.

602
Followers
238
Following
46
Posts
01.05.2023
Joined
Posts Following

Latest posts by Steve Weis @saweis.net

That indicates to me it’s either bad or really, really bad. I’ll wait to see how it plays out.

29.03.2025 17:07 👍 5 🔁 0 💬 0 📌 0
Preview
The Daring Ruse That Exposed China’s Campaign to Steal American Secrets (Published 2023) How the downfall of one intelligence agent revealed the astonishing depth of Chinese industrial espionage.

There is a long track record of the FBI arresting ethnic Chinese professors. Several were exonerated, but not all.

www.nytimes.com/2023/03/07/m...
www.nytimes.com/2020/05/11/u...
www.nytimes.com/2022/01/24/s...
www.nytimes.com/2017/05/10/u...

29.03.2025 16:59 👍 34 🔁 3 💬 3 📌 0

Literally low heat on the burner?

25.03.2025 04:46 👍 0 🔁 0 💬 1 📌 0
Preview
GitHub - sweis/cacr-crypto-contest: Chinese Association for Cryptologic Research Post-Quantum Contest Mirror Chinese Association for Cryptologic Research Post-Quantum Contest Mirror - sweis/cacr-crypto-contest

Weird, they already had a PQ contest that ended in 2020: github.com/sweis/cacr-c...

One of the winners was rejected by NIST for weaknesses though.

06.02.2025 20:38 👍 1 🔁 0 💬 0 📌 0
Preview
RWC 2025 accepted papers Real World Crypto Symposium

The list of accepted talk at @rwc.iacr.org is now available: rwc.iacr.org/2025/accepte... Early registration ends 26 February. CC: programme co-chair @nicksullivan.org

02.02.2025 12:14 👍 29 🔁 17 💬 3 📌 1
Upcoming Events Upcoming NCF (or related) Events & Programs.

National Cryptologic Foundation event about accelerating post-quantum crypto adoption features some NSA speakers:
cryptologicfoundation.org/news-events/...

02.01.2025 19:58 👍 12 🔁 5 💬 0 📌 0
Post image

Proud to be a member of the 1992 Team USA of blocklists with @filippo.abyssdomain.expert, @sockpuppet.org, and @leak.bsky.social

27.12.2024 05:35 👍 6 🔁 0 💬 1 📌 0
A Tour of WebAuthn

Tour of WebAuthn by Adam Langley:
www.imperialviolet.org/tourofwebaut...

23.12.2024 19:16 👍 5 🔁 5 💬 0 📌 0
Abstract. Differentially private (DP) heavy-hitter detection is an important primitive for data analysis. Given a threshold t and a dataset of n items from a domain of size d, such detection algorithms ignore items occurring fewer than t times while identifying items occurring more than t + Δ times; we call Δ the error margin. In the central model where a curator holds the entire dataset, (ε,δ)-DP algorithms can achieve error margin $\Theta(\frac 1 \varepsilon \log \frac 1 \delta)$, which is optimal when d ≫ 1/δ.

Several works, e.g., Poplar (S&P 2021), have proposed protocols in which two or more non-colluding servers jointly compute the heavy hitters from inputs held by n clients. Unfortunately, existing protocols suffer from an undesirable dependence on log d in terms of both server efficiency (computation, communication, and round complexity) and accuracy (i.e., error margin), making them unsuitable for large domains (e.g., when items are kB-long strings, log d ≈ 10⁴).

We present hash-prune-invert (HPI), a technique for compiling any heavy-hitter protocol with the log d dependencies mentioned above into a new protocol with improvements across the board: computation, communication, and round complexity depend (roughly) on log n rather than log d, and the error margin is independent of d. Our transformation preserves privacy against an active adversary corrupting at most one of the servers and any number of clients. We apply HPI to an improved version of Poplar, also introduced in this work, that improves Poplar’s error margin by roughly a factor of $\sqrt{n}$ (regardless of d). Our experiments confirm that the resulting protocol improves efficiency and accuracy for large d.

Abstract. Differentially private (DP) heavy-hitter detection is an important primitive for data analysis. Given a threshold t and a dataset of n items from a domain of size d, such detection algorithms ignore items occurring fewer than t times while identifying items occurring more than t + Δ times; we call Δ the error margin. In the central model where a curator holds the entire dataset, (ε,δ)-DP algorithms can achieve error margin $\Theta(\frac 1 \varepsilon \log \frac 1 \delta)$, which is optimal when d ≫ 1/δ. Several works, e.g., Poplar (S&P 2021), have proposed protocols in which two or more non-colluding servers jointly compute the heavy hitters from inputs held by n clients. Unfortunately, existing protocols suffer from an undesirable dependence on log d in terms of both server efficiency (computation, communication, and round complexity) and accuracy (i.e., error margin), making them unsuitable for large domains (e.g., when items are kB-long strings, log d ≈ 10⁴). We present hash-prune-invert (HPI), a technique for compiling any heavy-hitter protocol with the log d dependencies mentioned above into a new protocol with improvements across the board: computation, communication, and round complexity depend (roughly) on log n rather than log d, and the error margin is independent of d. Our transformation preserves privacy against an active adversary corrupting at most one of the servers and any number of clients. We apply HPI to an improved version of Poplar, also introduced in this work, that improves Poplar’s error margin by roughly a factor of $\sqrt{n}$ (regardless of d). Our experiments confirm that the resulting protocol improves efficiency and accuracy for large d.

Image showing part 2 of abstract.

Image showing part 2 of abstract.

Hash-Prune-Invert: Improved Differentially Private Heavy-Hitter Detection in the Two-Server Model (Borja Balle, James Bell, Albert Cheu, Adria Gascon, Jonathan Katz, Mariana Raykova, Phillipp Schoppmann, Thomas Steinke) ia.cr/2024/2024

13.12.2024 23:55 👍 3 🔁 2 💬 0 📌 2
Preview
AWS-LC FIPS 3.0: First cryptographic library to include ML-KEM in FIPS 140-3 validation | Amazon Web Services We’re excited to announce that AWS-LC FIPS 3.0 has been added to the National Institute of Standards and Technology (NIST) Cryptographic Module Validation Program (CMVP) modules in process list. This ...

What's that? FIPS 140-3 validated ML-KEM? No biggie

aws.amazon.com/blogs/securi...

10.12.2024 21:03 👍 7 🔁 5 💬 1 📌 1
Post image

Also evergreen reply...

09.12.2024 18:20 👍 3 🔁 0 💬 0 📌 0
Preview
Ordinary computers can beat Google’s quantum computer after all Superfast algorithm put crimp in 2019 claim that Google’s machine had achieved “quantum supremacy”

Google had a similar claim in 2022 about sampling quantum circuits. They said it would take a classical computer 10,000 years and researchers showed it would take a few hours not long after:
www.science.org/content/arti...

09.12.2024 18:20 👍 1 🔁 1 💬 1 📌 0
Preview
Meet Willow, our state-of-the-art quantum chip Our new quantum chip demonstrates error correction and performance that paves the way to a useful, large-scale quantum computer.

Google posting about new noisy quantum computer with better error correction:
blog.google/technology/r...

09.12.2024 18:20 👍 1 🔁 1 💬 1 📌 0
Dual_EC_DRBG with Justin Schuh and Matthew Green
Dual_EC_DRBG with Justin Schuh and Matthew Green YouTube video by Security Cryptography Whatever

NEW EPISODE!

Our esteemed guests @justinschuh.com and @matthewdgreen.bsky.social joined us to debate whether
`Dual_EC_DRBG` was intentionally backdoored by the NSA or 'just' a major fuckup:

securitycryptographywhatever.com/2024/12/07/d...

www.youtube.com/watch?v=i0eo...

07.12.2024 20:15 👍 27 🔁 15 💬 6 📌 7
Preview
How Meta built large-scale cryptographic monitoring Cryptographic monitoring at scale has been instrumental in helping our engineers understand how cryptography is used at Meta. Monitoring has given us a distinct advantage in our efforts to proactiv…

Post by Meta about integrating logging into their crypto libraries:
engineering.fb.com/2024/11/12/s...

04.12.2024 22:11 👍 6 🔁 2 💬 0 📌 0
EncryptedSystems.org

If you’re curious about the design and analysis of encrypted algorithms and encrypted databases, I’m putting together a collection of resources at encryptedsystems.org

03.12.2024 16:02 👍 49 🔁 19 💬 2 📌 1
Preview
Cryptography 10 Years Later: Obfuscation, Proof Systems, and Secure Computation This program will bring together researchers from different subareas of cryptography toward the goal of advancing some of the major research frontiers in the field.

Simons is doing a bootcamp and program on obfuscation, proof systems, and secure computation: simons.berkeley.edu/programs/cry...

03.12.2024 21:28 👍 15 🔁 9 💬 0 📌 0
Preview
Attestations: A new generation of signatures on PyPI For the past year, we’ve worked with the Python Package Index (PyPI) on a new security feature for the Python ecosystem: index-hosted digital attestations, as specified in PEP 740. These attestatio…

🔑
blog.trailofbits.com/2024/11/14/a...

24.11.2024 02:44 👍 4 🔁 4 💬 0 📌 0
Post image

@nyzn.bsky.social This is the peak tech career outcome.

22.11.2024 17:32 👍 4 🔁 0 💬 1 📌 0

TIL Zebrafish have three copies of the SLC6A4 gene that encodes a serotonin transporter. Some mollusks have two copies.

Do they have been feeding zebrafish drugs for a long time.

https://pubmed.ncbi.nlm.nih.gov/21522057/

05.07.2023 20:17 👍 1 🔁 0 💬 0 📌 0
An octopus decides between a pill and another octopus.

An octopus decides between a pill and another octopus.

On the right, a member of the species of the appropriate gender to invoke sexual attraction.

On the left, a giant pill of E stamped with a happy face.

05.07.2023 20:08 👍 2 🔁 0 💬 1 📌 0
Just a moment...

I want to see the grant proposal to give giant octopuses some MDMA to see what happens: https://www.cell.com/current-biology/fulltext/S0960-9822(18)30991-6

05.07.2023 19:53 👍 3 🔁 0 💬 1 📌 0

I think I said “I think I have that backwards” right after. Mental lapse.

You’re right. RSAP doesn’t solve factoring, but vice versa obviously does.

30.06.2023 03:58 👍 2 🔁 0 💬 0 📌 0
Preview
‎Security Cryptography Whatever: Why do we think anything is secure, with Steve Weis on Apple Podc... ‎Show Security Cryptography Whatever, Ep Why do we think anything is secure, with Steve Weis - Jun 29, 2023

NEW EPISODE!

Why the hell do we think any of this cryptography stuff is secure anyway, with @saweis.net!

https://podcasts.apple.com/us/podcast/why-do-we-think-anything-is-secure-with-steve-weis/id1578405214?i=1000618720739

29.06.2023 16:18 👍 6 🔁 4 💬 1 📌 1

I didn't see you were CISO of Lacework. Congratulations!

27.06.2023 21:07 👍 4 🔁 0 💬 0 📌 0

I won’t spoil the dinosaur-like creatures for you.

26.06.2023 05:22 👍 0 🔁 0 💬 0 📌 0

Spoiler: Jellyfish. Saved you a click.

26.06.2023 04:01 👍 6 🔁 1 💬 1 📌 0
Post image

They say local journalism is dying.

26.06.2023 04:01 👍 5 🔁 0 💬 1 📌 0

It would be nice to see some concrete use cases with comparisons to best alternatives.

For example, they cite a healthcare example. Is anyone using FHE in healthcare or is it hypothetical?

23.06.2023 15:38 👍 0 🔁 0 💬 1 📌 0
Post image

Twitter is sending out incoherent, unhinged recruiting messages.

21.06.2023 03:33 👍 5 🔁 0 💬 5 📌 0