CryptoStudies

Core question: When users back up their FIDO2 synced passkeys to the cloud storage of a passkey management service (PMS), how can a website detect that those passkeys have been stolen and are being abused for unauthorized logins?

Main idea: CASPER (“Capturing pASskey comPromise by attackER”) is the first passkey breach detection framework that lets web service providers detect the abuse of passkeys leaked from a PMS. Synced passkeys solve the account-recovery problem of device-bound credentials, but they concentrate risk: a breach of the PMS cloud storage exposes users’ private signing keys. Rather than trying to prevent theft, CASPER detects misuse — it adapts the classic honeywords idea (decoy passwords planted alongside real ones) from the password setting to the passkey setting, planting decoy passkeys in the PMS backup so that a login attempt using a decoy signals that the storage has been breached.

Key concepts:

• Synced passkeys trade device-bound security for recoverability, making the PMS cloud storage a high-value breach target.
• Decoy-based detection: an attacker who steals the backup cannot reliably distinguish real passkeys from planted decoys; using a decoy at login reveals the compromise.
• Detection as a complement to prevention — the framework assumes the breach can happen and focuses on catching exploitation.
• The design analyses detection effectiveness against strategic attackers who optimize which stolen credentials to try, and under partial marking of sites.
• Deployability: CASPER integrates into existing passkey backup, synchronization, and authentication flows with minimal user-experience impact and negligible performance overhead.

Hands-on study:

I explored CASPER beyond the paper in my repo Pollo — The CASPER Saver, which includes an interactive Python notebook walking through the detection simulations (runnable via Binder), a Go proof-of-concept prototype of the login and detection flows, and PRISM model-checking scripts evaluating detection probability across parameters such as the number of snapshots, number of sites, and the fraction of unmarked sites. The official artifact from the authors is available at islamazhar/CASPER.

Study takeaway:

CASPER is a nice example of transplanting a mature defensive idea (honeywords) into a new authentication ecosystem (FIDO2 synced passkeys) while carefully respecting that ecosystem’s constraints — no protocol changes for legitimate users, and a threat model where the attacker fully controls the stolen backup. It also connects naturally to my broader interest in deployment-oriented cryptographic engineering: the hard part is not the cryptographic trick itself, but making detection statistically meaningful against adaptive attackers at negligible deployment cost.

Core question: Can a middlebox enforce policies over encrypted traffic without receiving decryption keys or learning the underlying plaintext?

Main idea: The client proves in zero knowledge that the encrypted traffic observed by the middlebox is bound to a real TLS channel and that the hidden plaintext satisfies the policy. The main engineering challenge is not only expressing the policy, but efficiently proving TLS key derivation, record consistency, parsing, and policy evaluation inside the circuit.

Implementation coverage: The official repository contains the three case studies from the paper, TLS 1.3 channel-opening circuits, AES-CTR/SHA-256/Merkle/ECDHE/key-schedule components, readable xJsnark-derived code, generated Java circuit sources, transcript-generation utilities, and scripts for reproducing the gate counts and timing results.

Study page: Read the detailed paper-and-code study →

Core question: Are some widely deployed symmetric primitives using more rounds than real-world security requires?

Main idea: The paper argues that many modern symmetric primitives were designed with conservative round counts, often under competition-era uncertainty. After years of cryptanalysis, the author suggests that some primitives may retain realistic security with fewer rounds, improving performance while preserving practical security.

Key concepts:

• Distinguishing academic attacks from practical attacks.
• Treating security as risk management rather than a binary broken/not-broken label.
• Evaluating how far the best known attacks are from full-round practical exploitation.
• Reconsidering security margins after years of public cryptanalysis.

Attack-status taxonomy from the paper:

• Analyzed: The primitive has been studied using its internal structure, but no meaningful attack beats generic expectations.
• Attacked: There is a technically better-than-generic attack, but it remains practically infeasible.
• Wounded: The attack is not practical yet, but it is close enough that improvements could matter.
• Broken: The attack is realistically exploitable now or in the near future.

Reduced-round discussion:

The paper discusses reduced-round variants of AES, BLAKE2, ChaCha, and SHA-3. Its central claim is not simply that fewer rounds are faster, but that the cost of extra rounds should be weighed against the actual security margin demonstrated by cryptanalysis.

Study takeaway:

This paper is useful as a risk-assessment reading. It challenges the habit of treating every non-generic cryptanalytic result as equally alarming, and it asks whether cryptographic engineering should distinguish more carefully between theoretical, impractical, near-practical, and practical attacks.