Mark C.

Scouse feral academic. Quantum Hacker, ML miscreant, & mathematician. Views own. Collects useless degrees. @quantum_village (he/him) @[email protected]

[Mark C. @LargeCardinal]

I have been laughing at this entirely too long...

[Chelsea Komlo @chelseakomlo]

Happy to announce another paper accepted to Crypto '26- our work on impossibility results on adaptive security for a wide class of threshold signature schemes. Our results apply to NIST efforts for standardization of threshold signatures, and give bounds on the conditions which threshold signatures can be proven adaptively secure. This is joint work with Elizabeth Crites, Mary Maller, and Michele Ciampi.

https://t.co/t3MWYHtejr

In this work, we develop impossibility results that classify the conditions under which threshold signature schemes can achieve non-trivial adaptive security. As a reminder, adaptive security models an adversary that can adaptively corrupt threshold signature participants throughout the lifetime of the protocol, instead of artificially fixing the set of corrupted parties at the "beginning of time."

We introduce the notion of a "key-unique" threshold signature, and show that this classification is fundamental in determining the assumptions under which adaptive security can be proved. We give two results, one for any key-unique threshold signatures in general (including BLS, ECDSA, and EdDSA), and the second for threshold Schnorr signature schemes, and we show how our results apply to a wide range of existing threshold signature schemes.

Our first result shows that no key-unique threshold signatures scheme can be proven secure under computational or decisional non-interactive assumptions. Our second result shows that for key-unique threshold Schnorr signatures, reductions must be straight-line (i.e., common rewinding techniques are not possible to prove security).

This was a fun paper to work on, and I feel lucky to have had such excellent co-authors in this effort!

[ChillerID | Ω @chillerid76]

Optimized Point Addition Circuits for Elliptic Curve Discrete Logarithms

Researchers replicated Google's ECDLP results while reducing gate counts and publishing the full circuit design—no zk-proof hiding the implementation.

Every reduction in quantum resources brings us one step closer to practical attacks on ECC.

$QRL $IONQ $QBTS #Quantum #Cryptography

https://t.co/LTqTyjSJca

[Craig Gidney @CraigGidney]

Blog post: "The French have the Quantum Circuits" https://t.co/cP5hbTWl2B

André Schrottenloher just published a preprint showing how to construct quantum ECDLP circuits with costs similar to the ones in our zero knowledge proofs.

[Dennis @DennisF]

At this point it would be simpler to just list the npm packages that aren’t compromised.

[Dylan Malyasov | 🧐 @DylanMalyasov]

A Chinese company is now selling spray-on coating that makes drones harder for radar to detect, available in buckets and applied with a spray gun. What was once a classified military technology is now a commercial product sold by the kilogram.

https://t.co/UpXkLFFw6d

[JP Aumasson @veorq]

Gentle as in 'only 182 pages': https://t.co/130H1OJ7Ww
via @jedisct1

[Mehdi @MehdiHacks]

Another interesting article in the June 2026 issue of IEEE Microwave Magazine discusses a compact pixelated PCB-based bandpass filter!
(zoom in on the picture)

[Kat ⊷ the Poet Engineer @poetengineer__]

experiment with a memory system that keeps rewriting itself:
a hopfield network remembers an alphabet. as memories decay, it begins to hallucinate glyphs it was never taught - forgetting becomes a way of inventing.

[Jenny Qu @GuanniQu]

found a stack out-of-bounds read in the Linux kernel's nftables pipapo set backend (CVE-2026-43453, CVSS 7.1). I found it by looking for a specific pattern that I think is underhunted, so I want to talk about the methodology as much as the bug.
the pattern: function calls where one argument is a boundary-dependent expression and another argument is a flag that makes the callee skip using it. in C, this is a trap. the callee's early return makes every reviewer think the dangerous argument is inert. it is not. C evaluates all arguments at the call site before the function is invoked. the callee's control flow has no jurisdiction over argument evaluation. so you get these call sites that look safe, that have been reviewed and re-reviewed and look safe every time, because the question everyone asks is "is this value used?" and the answer is no. the question that matters is "is this value evaluated?" and nobody asks it because in most languages it's the same question.
so I started grepping function calls where an argument indexes an array, and a separate argument is a boolean that triggers an early return in the callee. the kind of code where someone wrote a guard clause and everyone downstream trusted it to cover the arguments too. it doesn't. it can't. the arguments are already computed.
pipapo_drop() in nft_set_pipapo.c:
pipapo_unmap(f->mt, f->rules, rulemap[i].to, rulemap[i].n, rulemap[i + 1].n, i == m->field_count - 1)
on the last iteration, i == field_count - 1. rulemap[i + 1].n reads past the end of a stack-allocated array of 16 entries. pipapo_unmap() checks is_last, returns immediately, never touches the value. the value is already read. the OOB is in the caller's scope. five years of this code in production and every review pass concluded "the function doesn't use it" which is true and also completely beside the point.
the reason I think this pattern is underhunted: static analyzers flag unused variables and unchecked return values but I haven't seen one that asks "is this argument expression legal in the caller's scope given that the callee might not use it?" the safety of the expression depends on the callee's behavior, but the evaluation of the expression doesn't. that gap is where bugs live for years. maybe decades. the callee being careful is what makes the bug invisible. the better the function handles its arguments, the longer the OOB at the call site survives review. that's perverse. the code's own correctness is camouflaging the bug.
when field_count is 16 (NFT_PIPAPO_MAX_FIELDS, the max), rulemap[16].n is real stack OOB. you're reading whatever the kernel left on the stack before your frame. smaller field counts get you uninitialized entries in your own array instead, which is a different flavor of wrong but still wrong. and this isn't some exotic race you trigger with three threads and a prayer. it's the normal path. every element expiration, every deletion. the kernel's own GC walks into it on a timer.
KASAN on 7.0.0-rc2 aarch64 confirmed it: Read of size 4 at addr ffff8000810e71a4. one stack object, [32, 160) 'rulemap', buggy address at offset 164. array is 128 bytes. read is 4 bytes past the end. rulemap[16].n. worked the offset math on paper beforehand.
PoC: pipapo set with NFT_SET_INTERVAL | NFT_SET_CONCAT | NFT_SET_TIMEOUT, 16 concatenated 4-byte fields. insert element, 1-second timeout. wait. insert another to trigger nft_pipapo_commit() → pipapo_gc() → pipapo_drop() → OOB. no heap shaping. no race. the kernel GC walks into it on a schedule.
reported to [email protected]. Willy Tarreau forwarded to netfilter maintainers. Florian Westphal reviewed, confirmed, asked for a readability tweak. the fix:
last ? 0 : rulemap[i + 1].n, last
I think there are more of these in the kernel. any function that takes a flag argument and an expression argument where the flag makes the expression unnecessary. every one of those call sites is a candidate for an OOB or an uninitialized read that no reviewer will catch because the callee's guard clause is too convincing. the code review feedback loop is broken for this pattern. the only reliable way to find them is to stop reading the callee entirely and ask whether every argument is legal to evaluate in the caller's scope, regardless of what the function plans to do with it.
patched in stable 5.10–6.19.

[BSidesLeeds @BSidesLeeds]

Tickets going spare? Please pass them on or request a refund — we have a long waitlist and would love as many people to attend as possible!

Looking for a ticket? Hop on our waitlist! Last year we released 80+ tickets, so there's always a chance 👀

https://t.co/nLeIpxmfFQ

[Andy Kong @oldestasian]

Can any of my font-loving followers ID this font? It's the laser (?) engraving on a silicon chip

[Son Luong @sluongng]

Codex just found a “workaround” of not having sudo on my pc…

[Akiyoshi Kitaoka @AkiyoshiKitaoka]

Footsteps illusion based on the luminance change-induced motion illusion

The rectangles move to the right at a constant speed, yet they appear to speed up or slow down.

[Peter Schmidt-Nielsen @ptrschmdtnlsn]

If anyone is looking for paid PCB work, I would like to pay someone to work out a Broadcom part I don't have time to do myself. This would be schematic capture + routing (including some 112 Gbps diff pairs, so very SI-sensitive), on a very fast schedule. DMs are open.

[JP Aumasson @veorq]

in Ollie Whitehouse's OffensiveCon keynote https://t.co/dKyb8Mnfzr

[chompie @chompie1337]

Security research reporting is kinda the only situation where an individual has any power over a corporation. What goes unsaid: the researcher could easily sell exploits on the grey market and get rich. Most report out of morals, lowk a refusal to contribute to cyberwarfare. Vendors relying on those morals to bully are happily prodding good people until they crack

[thaddeus e. grugq @thegrugq]

Microsoft could stop researchers bothering them with security bug reports by simply not writing security bugs into their software.

[César A. Hidalgo @cesifoti]

In case it is useful to others, I just uploaded handwritten math to Claude and it transcribed it to latex easily.

I guess it pays to have a clear handwriting :-)

[Daniel Litt @littmath]

Just added a 15th problem to https://t.co/6oEjUqIxgi! This one is a "non-abelian" analogue of the variational Hodge or Tate conjectures.

[Mark C. @LargeCardinal]

@veorq @octal 'isSigned()' should be added to the prayer books