DEF CON 2019 CTF: Invalid Curve Attack Used to Extract CryptoNote Tracking Key

·1 views

At DEF CON 2019, a Capture The Flag challenge called CaptureTheCoin tasked participants with exploiting a flaw in a CryptoNote-based digital currency client. The vulnerability involved an invalid curve attack on the brainpoolP160r1 elliptic curve, where malformed transaction points were sent to force the server into computations on a weaker, low-order curve. By analyzing error logs that leaked the server's computed secrets, participants could determine the private tracking key modulo several small group orders. Applying the Chinese Remainder Theorem to these residues allowed the full private tracking key to be reconstructed. The challenge demonstrated how improper elliptic-curve point validation in cryptographic implementations can lead to complete key compromise.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Nitter and XCancel Resume Service After X Corp Cease-and-Desist Threat

X Corp issued cease-and-desist letters on August 24 demanding the shutdown of Nitter instances and its repository, raising fears that two widely used privacy-friendly Twitter viewers would disappear. After seeking legal advice, the Nitter project confirmed it will continue operating, and XCancel has also come back online. Nitter is an open-source, JavaScript-free alternative front end that supports self-hosting, though public instances remain only as reliable as whoever runs them. XCancel offers a simpler, no-setup option for quickly viewing public profiles, but users have no control over its availability. Both tools serve overlapping but distinct needs, and experts suggest bookmarking multiple viewers since any service relying on public X data can break if the platform changes its access rules or rate limits.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How generateStaticParams Interacts With Next.js Cache Components: Key Findings

A developer built a test project to answer unresolved questions about how generateStaticParams behaves with Next.js Cache Components, after community members raised edge cases in a previous post. The tests showed that knowing route IDs at build time does not automatically exempt a route from the stream, cache, or block requirement enforced by Cache Components. Using a Suspense wrapper passes the build but leaves known static IDs marked as Partial Prerender, while replacing it with a 'use cache' directive bakes those paths into fully static output. When a layout and a page both access the same route params unguarded, fixing only the page component is insufficient — the layout must also be addressed independently. Additionally, the dynamicParams route config option is disabled when cacheComponents is active, meaning unlisted IDs are handled at request time rather than returning a 404.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

MonoLisa vs. Monaspace: How Two Popular Coding Fonts Compare

MonoLisa and Monaspace are two widely used monospace typefaces designed for coding, each optimized for different priorities. MonoLisa supports more languages and writing systems, offers more fixed weights, and features more distinctly redrawn italic forms compared to Monaspace. Monaspace, developed by GitHub, is free and open source, exposes three variable axes (weight, width, and slant), and includes five coordinated font families that can be mixed within a single codebase. A standout Monaspace feature called texture healing allows wider letters to borrow unused space from adjacent narrow letters, improving visual rhythm while preserving the monospace grid. Both fonts support coding ligatures, terminal symbols, and rich stylistic customization, making the choice largely dependent on budget, language needs, and personal preference.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to replace localhost port numbers with custom local domains using HAProxy and mkcert

Developers working with multiple local apps often juggle hard-to-remember port numbers like localhost:46176, which can be replaced with cleaner custom domain names such as omnideck.omni. The setup uses HAProxy as a reverse proxy, mkcert for local HTTPS certificates, and Homebrew for installation and service management on macOS or Linux. Custom hostnames are mapped to 127.0.0.1 via the /etc/hosts file, while HAProxy listens on port 80 and forwards requests to the correct local port based on the domain name. This approach improves readability, enables testing of production-like behavior for cookies, CORS, and OAuth redirects, and allows multiple apps to run simultaneously without port conflicts. A key security step involves restricting HAProxy's wildcard bind to loopback addresses only, preventing external devices on the same network from reaching the local apps.

0 comments Read more at DEV Community