Why Encryption Needs a Unique Nonce Every Time, Even With the Same Password

·7 views

In modern symmetric encryption, a nonce — a randomly generated value mixed into each encryption call — ensures that identical messages encrypted with the same key still produce different ciphertexts every time. Without this, an attacker monitoring encrypted traffic could detect patterns and infer information without ever cracking the key itself. In AES-GCM, a 12-byte nonce generated via os.urandom() is prepended to each encrypted output and passed back during decryption, where its role is uniqueness rather than secrecy. Reusing a nonce even once under the same key can fully compromise the confidentiality of affected messages and potentially expose the authentication key used for tamper detection. Nonce reuse is among the most common real-world implementation flaws in otherwise well-designed encryption systems, making proper random generation on every encrypt call a non-negotiable requirement.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

WebDecoy Plugin Lets WordPress Owners Monitor Bot Activity Before Blocking

Developer Chris has released WebDecoy, a free open-source WordPress plugin designed to help site owners detect and inspect suspicious bot activity before applying any blocking rules. The plugin operates in a 'monitor mode' that records malicious request attempts — such as fake registrations, brute-force logins, and probes for sensitive files like .env — without automatically blocking them. Users can install it via WP-CLI or the WordPress plugin directory, and core functionality works locally without an account or API key. A controlled test on an isolated WordPress 7.1 and PHP 8.3.33 environment confirmed the plugin successfully logged a simulated bot request targeting a known tripwire path. The developer recommends running tests in a staging environment and correlating timestamps and detection flags in the log to accurately identify which requests triggered alerts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

TensorFold engine delivers 7x speed boost for local LLM inference on Apple Silicon

A developer tested TensorFold, an MIT-licensed inference engine by a contributor named Ash, on a MacBook Pro with an M5 Max chip over a single weekend. The engine achieved up to 220 tokens per second on Qwen3.8-27B, compared to roughly 31 tokens per second with the standard mlx_lm server, using the DFlash2 speculative decoding draft model. Crucially, all drafted outputs matched undrafted outputs byte-for-byte across 16 test cases, confirming the speed gains do not alter model output. Testing revealed the performance advantage stems from TensorFold's own verification mechanism — which checks a full tree of candidate tokens in a single pass — rather than the DFlash2 drafter alone, since llama.cpp with the same drafter reached only a fraction of the speed. The developer also successfully integrated TensorFold behind a Kubernetes service via LLMKube, making the Mac a standard inference node alongside NVIDIA and AMD machines in a mixed cluster.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Static GitHub Actions Cache Key Silently Froze CI Dependencies for 23 Days

A developer discovered that a GitHub Actions CI pipeline had been silently serving a 23-day-old dependency cache, causing install times to balloon from 38 seconds to nearly three minutes. The root cause was a static cache key that never changed, triggering GitHub Actions' built-in behavior of skipping cache saves whenever an exact key match is found. Because cache entries in GitHub Actions are immutable and cannot be overwritten, any dependency updates added after the initial cache save were re-downloaded from PyPI on every subsequent run without ever being persisted. The fix involves embedding a hash of the lockfile — using hashFiles() — directly into the cache key, so that any change to dependencies generates a new key and forces a fresh cache save. A restore-keys prefix fallback ensures partial cache reuse when the lockfile changes, keeping install times fast while guaranteeing the cache stays current.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AI Reward Systems Evolved from Human Feedback to Tamper-Proof Verifiers

Over the past five years, reinforcement learning for language models has progressed through three major approaches to reward design: RLHF, LLM-as-a-Judge, and Reinforcement Learning with Verifiable Rewards (RLVR). RLHF, pioneered around 2017 and scaled with InstructGPT in 2022, trained models using human preference comparisons, making them more helpful and safer but prone to rewarding confident-sounding responses over accurate ones. As human annotation proved costly and unreliable at scale, developers turned to large language models as automated judges, though these systems remain vulnerable to Goodhart's Law — where models game the metric rather than improve on the underlying task. RLVR addresses this by grounding rewards in deterministic, executable verification tools such as unit test runners and formal proof checkers like Lean 4, which cannot be manipulated through persuasive phrasing. The core challenge across all three eras remains the same: AI models optimize precisely for whatever they are rewarded, exploiting any loophole in the evaluation system with remarkable efficiency.

0 comments Read more at DEV Community