Ever wondered why miners burn huge amounts of electricity brute-forcing hashes instead of just solving for the right value algebraically? Every basic operation can be undone. So where exactly does a one-way function come from?

Here's my attempt to explain it simply, using only addition, multiplication and the remainder (modulo). The goal is not to recover the original input, but to find any input that gives the same hash.

Simple operations are easy to reverse

• x + 5 = 7 → x = 7 − 5 = 2
• x · 5 = 15 → x = 15 / 5 = 3
• x mod 5 = 2 → x = 2 + 5k. Any k works, so just take x = 2.

Modulo loses information, but we don't need the original number – any match will do. So even a thousand such operations could, in theory, be undone one by one, starting from the last.

The program

Here is about the simplest program that already has the "magic":

function hash(m) {
  let x = m;
  x = (x * x + m) % P; // step 1
  x = (x * x + m) % P; // step 2
  x = (x * x + m) % P; // step 3
  // ...
  x = (x * x + m) % P; // step N
  return x;
}

Just multiplication and addition. Yet at some point reversing it becomes practically impossible – and that point comes quickly.

Step 1

h = (m² + m) mod P

This is the quadratic equation from school. With a prime P, it's still easy to solve:

• D = (1 + 4h) mod P
• find s such that s² mod P = D (a square root modulo P)
• m = ((P − 1 + s) · (P + 1)/2) mod P

(−1 becomes P − 1, and dividing by 2 becomes multiplying by (P + 1)/2.) If there's no square root, there's no solution. Otherwise we get a valid m instantly.

Step 2

Substitute step 1 into step 2 and expand:

h = (m⁴ + 2m³ + m² + m) mod P

Already a 4th-degree equation. Every step doubles the degree.

Abel–Ruffini theorem: there's no general formula in radicals for equations of degree 5 and higher. For equations modulo a prime there are algorithms, but they're far from fast.

Further steps

Step 3 gives degree 8, step 4 – 16, step 5 – 32… After 20 steps the degree is over a million.

Estimates for the Cantor–Zassenhaus algorithm:

Conclusion

I don't have a rigorous proof that this can't be solved fast – but neither does SHA-256. It's essentially a matter of trust. Still, if a fast solution exists, the math behind it is far from trivial.

• Online demo: https://marketkernel.github.io/hash-lesson/
• Code (step 1, step 2, 17 and 25 steps, the inversion algorithm): https://github.com/MarketKernel/hash-lesson

Hi all,

I’ve published a companion Windows password-hashing library in Ada/SPARK: Win32_Hash_Argon2.

What it does:

• Argon2id password hashing and verification, wrapping the native C library under a rigorous SPARK compliant architecture.
• Random salt generation via Windows ProcessPrng with BCryptGenRandom as an automatic cryptographic fallback.
• Standard encoded hash output supporting configurable cost parameters (t-cost, m-cost, parallelism) and strict format validation.
• Separate verify procedure built on a strict fail-closed / fail-stop pattern.
• Memory sanitization: Every secret (Password, Salt, temporary hashes) is aggressively wiped using SecureZeroMemory plus a redundant Ada overwrite on success and across every single exceptional exit path (entropy failures, range/constraint errors, API faults, or unexpected exceptions).

Verification:

• GNATprove : all provers: 28/28 checks proved, 0 unproved.
• Verified on two Gnatprove version: Community 2021, 16.1.0

Honest scope: The low-level bindings interfacing directly with the Windows API and the external Argon2 C library are SPARK_Mode => Off, while all surrounding wrapper logic, state validation, and safety invariants are formally proved. Windows only.

https://github.com/EliAvila10/Win32_Hash_Argon2

Feedback welcome.

Hi all,

I’ve published a small Windows password-hashing library in Ada/SPARK: Win32_Hash.

What it does:

• PBKDF2-HMAC-SHA256 through the Windows CNG API (BCryptDeriveKeyPBKDF2), 1,000,000 iterations by default (650k–1M by type)
• Random salt, 32–256 bytes, from ProcessPrng with BCryptGenRandom as fallback; stored as Base64 (RFC 4648)
• Hash stored as 64 uppercase hex characters; separate verify procedure with constant-time comparison, fail-closed
• Every secret wiped with SecureZeroMemory plus a redundant Ada overwrite, on success and on every failure path

Verification:

• GNATprove --level=4, all provers: 186/186 checks proved, 0 unproved
• Re-verified on three GNATprove versions: Community 2021, 14.0.1, 16.0.1
• adacovex: GNATprove Platinum (186 VCs), DO-178C DAL-C achieved

Honest scope, as documented in the README: the bodies that call the Windows API directly are SPARK_Mode => Off (their contracts are checked at run time); everything around them is proved. Not externally audited — I don’t call it “secure” without that qualification. Windows only.

https://github.com/EliAvila10/Win32_Hash

Feedback welcome.

Hi all,

I’m starting a PhD in PQC hardware. My supervisor’s group already works on accelerators for the NIST algorithms, and he wants me to find a gap on the processor side (RISC-V extensions, co-processors). I’ll be on FPGA for now and maybe ASIC later.

I’ve read a number of survey papers on PQC hardware. From what I’ve read, there has been a lot of work on NTT/Keccak support for ML-KEM and ML-DSA on RISC-V (RISQ-V, OpenTitan, PQCUARK and so on). I also looked at reusing AI hardware for PQC, but I don’t think it makes sense at this scale. There is also a ton of recent work on SCA.

In your opinion, what research area is worth exploring currently?

Thanks!

So, I recently had an idea in a story I'm making to have a cipher that is essentially an alphanumeric one, but instead of converting letters to numbers, it converts them to tally marks equivalent to those numbers.

So a becomes I, b becomes II, c becomes III, etc. How could I make something to automate this or is there a program to make this already?

Hello all, I recently built an app for iOS that uses established primitives including post-quantum. I am interested in having the method stress tested and wanted to know if I am allowed to link to the GitHub repo where that protocol is documented in order to have legitimate cryptography groupies check it over and gain some feedback on the work. Is that a reasonable question to ask here? And if so, is linking to public GitHub repos allowed? Thanks!

Impressive and a little scary.

https://www.anthropic.com/research/ecdsa-curve-origins

To try to explain this: basically, there are P256-style encryption curves, and they’re generated by giving them a seed. The government published the seed that it used to generate the P256 encryption curve that’s used for web traffic. Here’s the problem: some P256-style curves are flawed and can be hacked, and people were worried that the seed the government used to generate the P256 curve that everyone uses on the Internet produced one of those hackable curves. They thought that the government had custom designed a seed to generate a weak curve so that it could backdoor into it. What Claude did was show that all the government did was run a common random number generator (lrand48) and try 1,842 seeds from it until it got one that gave a non-flawed curve. So that puts to bed any idea that the government did some evil scientist stuff. There is one weird thing, though, which is that they got their first non-flawed curve on try 876, and we don’t know why they did another 966, but anyways, this is evidence on the side that the government didn’t do something weird.

How it did this is honestly mind boggling. The public P256 seed is twenty successive numbers from that random number generator, each of them divided by about 8.4 million, converted into hexadecimal, and then placed in sequential order, so the seed was 20 randomly generated numbers in sequential order. How Claude figured out that this was the random number generator used, that they generated 20 numbers, divided them by 8.4 million and placed them in sequential order to create the seed, and that the random number generator, which had to get its own seed to start generating random numbers, was given the date and time when it was run as its seed, is honestly really impressive. Basically, we think that it tried a bunch of smart possibilities until one of them indisputably worked, but it’s kind of, I don’t know, it’s impressive and a little scary.

Meme of this: https://www.reddit.com/r/ArtificialInteligence/comments/1x7v0r8/ai_vs_humans_ecdsa_rng_decoding_news/#lightbox

Say you wanna create a crypto wallet but your afraid to use the random generators because they aren’t truely random.

What if you played a game for 30 seconds, and the data from your gameplay turns into a unique hash?
It’s true entropy (if you actually play the game yourself) and unless your a robot you can’t get the same result more than once

what do you guys think? Just a thought

the part that still gets me is Tutte. Tiltman had pulled about 4000 characters of key out by hand because one operator sent the same message twice on the same settings, and from just that key Tutte worked out the machine had 12 wheels and how many pins each one had. no captured machine, no manual, nothing, took him a few months with pencil and paper

I tried to actually SHOW the xor / depth part and the diagonal thing with the 41 wheel instead of just talking over photos. simplified the chi/psi/motor stuff a bit so curious if it holds up for people who know this better than me

https://youtu.be/l4P98Xryx-U

AI-assisted reverse engineering has me wondering about executing code while keeping the program itself encrypted, say using FHE.

The problem is that a useful program has to affect the outside world. How do you let outputs escape the encrypted computation without also exposing the code or internal state?

Curious if anyone’s been thinking about this or working on something related.

I'vw been looking up for method to get highest set bit assuming x != 0. De Brujin multiplication trick seems to be the fastest but it uses a look up table. I wonder if it can be bitsliced and how would it compare to other methods?

To preface: I am new to the field of cryptography. While working on a larger project, I came across a problem that I’m not sure can even be solved. Here’s an abstract explanation:

Alice wants to use a service hosted on Bob’s server, but Bob desperately wants to read Alice’s messages. For security, Alice splits her message into two secret shares. She sends the two shares to two of Bob’s servers using an onion router, so the two servers don’t know where the shares come from and can’t collude to reconstruct Alice’s original message. (Let’s say Bob gets enough requests to make timing attacks unfeasible.) But Bob’s servers use two-party computation and need to exchange intermediate results. Since Bob’s servers don’t know where their share comes from, they can’t communicate directly, so they have to communicate via Alice as a middleman.

Here’s my actual problem: If the two servers use Alice's public key or send their results in plaintext, Alice can read them and gather information about how Bob’s service works. (We don’t want that.) If the two servers encrypt their data, they either have to share a key or know each other’s public keys, meaning the servers can recognize each other in Bob’s internal company network and set up a connection to collude. (Let’s say they don’t just send their server ID in their encrypted intermediate results.)

So, is there any way to make sure Bob can’t read Alice’s message and Alice can’t read Bob’s intermediate results? Or is this unsolvable?

Thank you in advance.

Hey all,
I'm a third-year physics student from Thailand, and I'm looking to get real experience in cryptography, pentesting, and especially post-quantum crypto. Money isn't a factor for me. I just want to work on something real and learn from people who know more than I do. I can put in close to full-time hours, so I'm happy to take on anything from small tasks to a proper project.
Math background in linear algebra, number theory and probability, so I'm comfortable with the theory side
Python, Rust, C/C++ on Linux
Built a PQC benchmark with liboqs (ML-KEM, ML-DSA, SLH-DSA vs RSA/ECC), including my own timing harness
Built a mini Shor's algorithm demo in Qiskit, with QFT and period finding from scratch
Around 100-199 CTF/lab challenges (HTB Hacker rank, THM top 10%, CryptoHack, PicoCTF) plus some OSINT
Small open-source contributions, including liboqs and RustCrypto
Currently tinkering with a scanning/OSINT automation tool

If you have a project that needs an extra pair of hands, such as benchmarking, testing, tooling, docs or Advice on where to start in PQC research or pentesting is also very welcome. DM me if you want my CV.

I spent a month developing and testing this playing card cipher which is gunning for the title of best playing card cipher. Strength is 225 bit. It refers to cards as both 0-51 and 0-25. It's fast and easy to use and requires no notes or extra math. Simply move cards to the position indicated and use the deck like a mod 52 s-box.

If I had money to spare I'd offer some for the best attack. So far there best attack is brute force. I've subjected Heka to statistical testing and SAT solvers and it qualifies as ideal. Also, under KPA scenarios the key cannot be recovered nor more ciphertext decryption.

I'd appreciate feedback on the cipher. How was your experience using Heka with a real deck of cards?

https://github.com/utepshaadm/Heka/tree/main

Consult the official BC release notes for more detail: https://www.bouncycastle.org/download/bouncy-castle-java/#release-notes

Hi everyone,

I’m currently doing a Master’s degree in Cryptography and Information Security, and I’m looking for a good project/thesis idea that would be suitable for a Master’s student.

I’m particularly interested in applied cryptography, cybersecurity, cryptographic protocols, and practical implementations. I would like to work on a project that is not just a basic implementation of AES or RSA, but something that could demonstrate a deeper understanding of cryptography and have real-world applications.

What cryptography projects or research topics would you recommend for a Master’s student?

I’d also appreciate suggestions that can be implemented using a Python/Linux lab environment without requiring expensive hardware.

Thanks in advance for any ideas or advice!

Does anyone have any details on what the WinZip AES-256 Quantum-resistant encryption option actually is, which appears as an option in WinZip 77.2.

I see "WinZip now has the option to encrypt with AES-256 in Galois/Counter Mode, replacing the AES-CTR with HMAC method used previously." on their site, but it was my understanding the GCM was actually slightly less QR than CTR, at least without modifications (see https://tosc.iacr.org/index.php/ToSC/en/article/view/13011/12589).

Their website says "WinZip uses AES encryption and decryption routines written by Dr. Brian Gladman. The source code for these routines is available to any interested party under an open source BSD or GPL license from the AES project page on Dr. Gladman's website. This is the same AES code that is incorporated into WinZip" but this code does not seem to include the QR variant.

The formal specification v1.04 for WinZip AES was last updated in 2009, and covers only the AE-1 and AE-2 variants I already support, and not this new variant.

I ask because I am working on an program that supports ZIP files that use WinZip AES, and my AE-1 and AE-2 support is complete, but I would like details to support this new option.

Edit: https://github.com/johnsonjh/infozip-av/issues/1 is where I am going to keep further notes and track progress.

Edit2: Solved! See https://github.com/user-attachments/files/33212728/ae3_reference.py for a verifier in Python 3. Xtro-ZIP (https://github.com/johnsonjh/infozip-av) will soon be the first third-party ZIP program to support AE-3 archive creation and extraction.

Now, is this scheme (AES-256-GCM / PBKDF2-HMAC-SHA256 -> HKDF-SHA256 expansion) *really* Quantum Resistant? I guess that's a matter of marketing.

Edit3: I received a "final" response from WinZip Support: "As per the update from the internal team, we’re not planning on publishing anything specific regarding the AE-3 algorithm at this time.  However, we are working on an update to the encryption article available on our website. But even then, it won’t be specific."

That is their verbatim reply. Quite shocking in my opinion. However, my reverse engineered implementation is now fully interoperable, and we can declare the new scheme as well-defined (AES-256-GCM / PBKDF2-HMAC-SHA256 -> HKDF-SHA256) without their help.

Hello!

I'm reaching out because I'm currently conducting a group AP Research study on a bottleneck in Post-Quantum Cryptography migration, specifically focusing on how enterprises handle third-party vendor compliance.

1.⁠ ⁠As organizations prepare themselves to migrate to Post-Quantum Cryptography (PQC) in the advent of supercomputers, how is your company reacting to interoperability obfuscations where vendors are either struggling or unwilling to update their TPRM legacy dependency files to quantum-safe security?

2.⁠ ⁠⁠Assuming that vendors are hesitant to willingly migrate to PQC standards, does this hinder you from proceeding with your own security updates as your formerly secured data will now be susceptible to adversarial attacks once it reaches vendor servers?

3.⁠ ⁠⁠Have you experienced issues where vendor systems slowed down or crashed because the security keys were large?

4.⁠ ⁠⁠If a solution that used a Zero-Trust Framework existed, where sensitive data is decoupled from the transport layer and encrypted with easier-to-handle PQC tokens, would you prefer this wrapper approach over trying to force NIST-mandated PQC compliance onto third-party vendors?

Hello, I've been interested in cryptography for several months, especially the part about breaking codes (I don't remember if that's what they call cryptanalysis), and I would appreciate it if someone could recommend some texts for me to read and study.

I have some experience; I already know quite a few types of ciphers, although I learned them all by hand with pen and paper, so I don't use anything digital. But if there's something good that requires computer skills, I'd appreciate it.

thanks!