Skip to content

Instantly share code, notes, and snippets.

View atoponce's full-sized avatar
Crypto coffee

Aaron Toponce atoponce

Crypto coffee
View GitHub Profile
@atoponce
atoponce / rates.md
Last active April 12, 2024 21:23
Verifiable brute force strength rates across different projects

Verifiable brute force strength

Below are table of various projects that can completely exhaust n-bits of keyspace. In other words, counting completely and fully from 0 to 2ⁿ-1.

This Gist implies no discussion about how this is relevant to quantum computing using Grover's algorithm, meet-in-the-middle or birthday attacks, or anything of the like. It's strictly a Gist about raw speed, measuring the result in bits.

If you know of other noteworthy and verifiable brute force searching projects,

@atoponce
atoponce / word-lists.md
Last active April 4, 2024 23:58
A list of notable and primarily English word lists that can be used for building passphrases.

Passphrase Word Lists

Introduction

This document outlines a number of different word lists for passphrase generation, encoding of binary data, and other uses. This document is grouped and sorted by the number of unique words in each word list, fewest unique words first.

Licensing Note

Some of these word lists are placed in the public domain, others are copyrighted with various licenses. Please refer to the license of each word

@atoponce
atoponce / trivium.js
Last active April 4, 2024 17:59
Trivium stream cipher with test vectors
"use strict"
/** Class representing the Trivium stream cipher. */
module.exports = class Trivium {
#state // Trivium 288-bit state.
#keystream // Trivium keystream.
/**
* Initialize Trivium with key and IV.
* @param {Uint8Array} key - An 8-bit array of 10 unsigned integers.
@atoponce
atoponce / bias.py
Last active March 27, 2024 10:13
Some solutions removing bias from loaded dice
#!/usr/bin/python3
import random
# Simple script to simulate biased throws of a single d6 die.
# bias should sum to 1
# pips ( 1, 2, 3, 4, 5, 6 )
BIAS = (0.125, 0.125, 0.25, 0.25, 0.125, 0.125)
@atoponce
atoponce / k4.md
Created March 21, 2024 19:44
No, ChatGPT didn't solve Kryptos 4

So you think ChatGPT solved K4? You're not the only one. First, here's the K4 ciphertext and clues:

                           OBKR
UOXOGHULBSOLIFBBWFLRVQQPRNGKSSO
TWTQSJQSSEKZZWATJKLUDIAWINFBNYP
VTTMZFPKWGDKZXTJCDIGKUHUAUEKCAR

Jim Sandborn, the creator of the sculpture and puzzle has given us clues, revealing that characters:

@atoponce
atoponce / gist:07d8d4c833873be2f68c34f9afc5a78a
Last active March 19, 2024 17:24 — forked from tqbf/gist:be58d2d39690c3b366ad
Cryptographic Best Practices

Cryptographic Best Practices

Putting cryptographic primitives together is a lot like putting a jigsaw puzzle together, where all the pieces are cut exactly the same way, but there is only one correct solution. Thankfully, there are some projects out there that are working hard to make sure developers are getting it right.

The following advice comes from years of research from leading security researchers, developers, and cryptographers. This Gist was [forked from Thomas Ptacek's Gist][1] to be more readable. Additions have been added from

@atoponce
atoponce / bitcoin-seeds.bash
Created January 7, 2022 23:34
Generate 1,000 valid BIP39 mnemonic phrases in Bash
#!/bin/bash
bip39=(abandon ability able about above absent absorb abstract absurd abuse access accident account accuse achieve acid acoustic acquire across act action actor actress actual adapt add addict address adjust admit adult advance advice aerobic affair afford afraid again age agent agree ahead aim air airport aisle alarm album alcohol alert alien all alley allow almost alone alpha already also alter always amateur amazing among amount amused analyst anchor ancient anger angle angry animal ankle announce annual another answer antenna antique anxiety any apart apology appear apple approve april arch arctic area arena argue arm armed armor army around arrange arrest arrive arrow art artefact artist artwork ask aspect assault asset assist assume asthma athlete atom attack attend attitude attract auction audit august aunt author auto autumn average avocado avoid awake aware away awesome awful awkward axis baby bachelor bacon badge bag balance balcony ball bamboo banana banner bar barely bargain barrel ba
@atoponce
atoponce / oi.js
Last active January 8, 2024 23:59 — forked from PaulCapestany/oi.js
Dan Kaminsky's DefCon RNG challenge
#!/usr/bin/env node
/**
* Forked from https://gist.github.com/PaulCapestany/6148566. Changes:
* - Beautified code
* - NodeJS-specific (will not work in the browser)
* - Scope variables with let and const keywords
* - 256-bit RNG
* - Remove von Neumann debiasing
* - Remove byte assembly

Originally posted at https://www.nccgroup.trust/us/about-us/newsroom-and-events/blog/2011/august/javascript-cryptography-considered-harmful/

Javascript Cryptography Considered Harmful

WHAT DO YOU MEAN, "JAVASCRIPT CRYPTOGRAPHY"?

We mean attempts to implement security features in browsers using cryptographic algoritms implemented in whole or in part in Javascript.

You may now be asking yourself, "What about Node.js? What about non-browser Javascript?". Non-browser Javascript cryptography is perilous, but not doomed. For the rest of this document, we're referring to browser Javascript when we discuss Javascript cryptography.