Carelessness versus craftsmanship in cryptography

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.trailofbits.com/2026/02/18/carelessness-versus-craftsmanship-in-cryptography/
• Blog Title: Carelessness versus craftsmanship in cryptography
• Suggested Section: 🕵️ Crypto -> Symmetric Crypto (add a subsection on AES-CTR nonce/IV reuse exploitation, known-plaintext keystream recovery, and CTR malleability vs AEAD/GCM-SIV); cross-link from TLS & Certificates for X.509 known-plaintext angles

🎯 Content Summary

What the post is about
Trail of Bits describes an ecosystem-scale cryptography footgun: the JavaScript library aes-js and the Python library pyaes implement AES-CTR in a way that makes misuse extremely likely. Specifically, their CTR APIs do not require callers to provide an IV/nonce; if none is provided, both libraries silently default to the constant value:

0x00000000_00000000_00000000_00000001

This design choice (and ...

🔧 Technical Details

CTR/GCM nonce (IV) reuse exploitation: In stream-like modes (CTR, and GCM when nonces are reused), encrypting two messages with the same (key, nonce/IV) reuses the keystream. An attacker who observes both ciphertexts computes C1 ⊕ C2 = P1 ⊕ P2, leaking structure immediately. If any plaintext is known/guessable, the attacker derives keystream bytes (KS = C ⊕ P) and decrypts other ciphertexts produced under that reused nonce/IV.

Known-plaintext keystream extraction via structured formats: If one reused-IV ciphertext contains highly structured/predictable data (e.g., X.509 certificates, protocol headers, file magic/ASN.1 regions), XORing the known plaintext with ciphertext recovers the keystream for those offsets, which can then be applied to decrypt other secrets encrypted at the same offsets under the same reused keystream.

Leveraging alignment in serialized secrets: When multiple serialized secrets of the same t...

🤖 Agent Actions

Updated crypto/symmetric/README.md with deeper AES-CTR/GCM nonce-reuse exploitation guidance: keystream recovery from known plaintext, structured format leverage (X.509, PKCS#8 alignment), dangers of constant default IVs, and CTR malleability vs AEAD (GCM/GCM-SIV) protections, plus cross-reference to TLS certificates and added reference to the Trail of Bits post.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.trailofbits.com/2026/02/18/carelessness-versus-craftsmanship-in-cryptography/

Content Categories: Based on the analysis, this content was categorized under "🕵️ Crypto -> Symmetric Crypto (add a subsection on AES-CTR nonce/IV reuse exploitation, known-plaintext keystream recovery, and CTR malleability vs AEAD/GCM-SIV); cross-link from TLS & Certificates for X.509 known-plaintext angles".

Repository Maintenance:

• MD Files Formatting: 948 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0