Crypto 2019 Takeaways

Summary: At the 2019 IACR Crypto conference, researchers reported breaking deployed cryptographic systems through small sub-component failures, including attacks on the ISO-standard OCB2 authenticated encryption scheme that enabled signature forgery and full plaintext recovery, and nonce-recovery attacks that extracted private keys for over 300 Bitcoin accounts and several dozen Ethereum accounts. Jonathan Katz's keynote described a class of vulnerabilities affecting nearly all secure multiparty computation implementations, where the common optimization of fixed-key AES undermines the protocol's privacy guarantees.
Why it matters: The nonce attacks recovered keys for over 300 Bitcoin accounts that mostly held nonzero balances, meaning active users were running libraries with broken randomness - and Katz showed that an optimization widely deployed in MPC systems voids their privacy proof entirely.

Read the original at Trail of Bits Blog ↗