Skip to content

Instantly share code, notes, and snippets.

View atoponce's full-sized avatar
Crypto coffee

Aaron Toponce atoponce

Crypto coffee
View GitHub Profile
@atoponce
atoponce / shuffling.js
Last active August 17, 2026 17:10
Fun with shuffling algorithms
// -- Helpers --------------------------------------------------------------- //
/**
* Generate a uniform random number between 0 and n-1 using modulo with
* rejection. Used in most shuffling algorithms in this file. The CSPRNG is
* provided just in case security is a concern.
*
* @param {number} n
* @returns {number}
*/
@atoponce
atoponce / word-lists.md
Last active August 15, 2026 10:10
A list of notable and primarily English word lists that can be used for building passphrases.

Passphrase Word Lists

Introduction

This document outlines a number of different word lists for passphrase generation, encoding of binary data, and other uses. This document is grouped and sorted by the number of unique words in each word list, fewest unique words first.

Licensing Note

Some of these word lists are placed in the public domain, others are copyrighted with various licenses. Please refer to the license of each word

@atoponce
atoponce / readme.md
Last active July 11, 2026 23:31
Mouse Entropy Implementations

My Approach

https://github.com/atoponce/scripts/blob/master/mouse-entropy.html

  • Generate a 512×512 pixel random bitimage with the browser CSPNG and animate it.
  • Record the pixel color (bit) underneath the (x, y) coordinate at event interrupt.
  • Collect 8 bits, then:
    • Collect and store the timestamp least significant byte into the entropy pool.
    • Assemble coordinate bits as single byte and store in the entropy pool.
    • Store the vector distance from the canvas origin (0, 0).
    • Store the vector magnitude (angle in arcseconds) from the canvas origin (0, 0).
@atoponce
atoponce / rates.md
Last active July 8, 2026 16:10
Verifiable brute force strength rates across different projects

Verifiable brute force strength

Below are table of various projects that can completely exhaust n-bits of keyspace. In other words, counting completely and fully from 0 to 2ⁿ-1.

This Gist implies no discussion about how this is relevant to quantum computing using Grover's algorithm, meet-in-the-middle or birthday attacks, or anything of the like. It's strictly a Gist about raw speed, measuring the result in bits.

If you know of other noteworthy and verifiable brute force searching projects,

@atoponce
atoponce / bitcoin-seeds.bash
Created January 7, 2022 23:34
Generate 1,000 valid BIP39 mnemonic phrases in Bash
#!/bin/bash
bip39=(abandon ability able about above absent absorb abstract absurd abuse access accident account accuse achieve acid acoustic acquire across act action actor actress actual adapt add addict address adjust admit adult advance advice aerobic affair afford afraid again age agent agree ahead aim air airport aisle alarm album alcohol alert alien all alley allow almost alone alpha already also alter always amateur amazing among amount amused analyst anchor ancient anger angle angry animal ankle announce annual another answer antenna antique anxiety any apart apology appear apple approve april arch arctic area arena argue arm armed armor army around arrange arrest arrive arrow art artefact artist artwork ask aspect assault asset assist assume asthma athlete atom attack attend attitude attract auction audit august aunt author auto autumn average avocado avoid awake aware away awesome awful awkward axis baby bachelor bacon badge bag balance balcony ball bamboo banana banner bar barely bargain barrel ba
@atoponce
atoponce / peres.js
Created July 31, 2025 17:16
Peres randomness extractor
/**
* Peres extractor as described in http://dx.doi.org/10.1214/aos/1176348543
* @param {Array} bits - an array of biased bits to debias
* @param {Array} extracted - an array of extracted, unbiased bits
* @returns {Array} - an array of exatracted, unbiased bits
*/
function peres(bits, extracted) {
const u = []; // discarded bits Psi(u1, u2, u3, ...)
const v = []; // discarded bits Psi(v1, v2, v3, ...)
const l = bits.length - (bits.length & 1); // ensure an even length, dropping the last bit if odd
@atoponce
atoponce / index.js
Last active June 2, 2026 14:56
Very efficient type 4 UUID generator in vanilla JavaScript. Runs in ~7.81 cpb on an Intel Core i7-8650U @ 1.9 GHz.
const uuid = new UUID();
console.log(uuid.v4());
@atoponce
atoponce / gist:07d8d4c833873be2f68c34f9afc5a78a
Last active June 2, 2026 13:53 — forked from tqbf/gist:be58d2d39690c3b366ad
Cryptographic Best Practices

Cryptographic Best Practices

Putting cryptographic primitives together is a lot like putting a jigsaw puzzle together, where all the pieces are cut exactly the same way, but there is only one correct solution. Thankfully, there are some projects out there that are working hard to make sure developers are getting it right.

The following advice comes from years of research from leading security researchers, developers, and cryptographers. This Gist was [forked from Thomas Ptacek's Gist][1] to be more readable. Additions have been added from

@atoponce
atoponce / 0-README.md
Last active May 29, 2026 21:23
Magic Hashes

Magic Hashes

Motivations

Calculating magic hashes for https://www.whitehatsec.com/blog/magic-hashes/. These strings should probably be put into a blacklist preventing users from using them as passwords to mitigate PHP evaluating hashes starting with "0e" as floats.

Probabilities