Repeated signing reveals whether output varies. Across a population, repeated ECDSA values can expose nonce reuse, compromise and implementation anomalies.
Sign the same message twice.
read more...
Research
The ciphertext does not say which mode produced it.
Format-preserving ciphertext carries no mode, key or tweak metadata. That convenience makes FF1 and FF3 migration difficult to scope from the data alone.
SMS OTP is now a restricted authenticator. The hard part is what replaces it.
Leaving SMS removes the telephony channel, but phishing resistance depends on origin binding and on every recovery path that can create a session.
Audit the attributes, not the datasheet.
PKCS #11 key policy is expressed through attributes and mechanisms inside the token. An inventory can reveal permissions that a product datasheet cannot.
The verifier and the parser disagree.
Signature verification fails as a security boundary when the verifier and the application resolve different meanings from the same document.
A face fits in 960 bytes.
A signed QR can carry an offline face credential, but signature, encoding and card geometry leave roughly one kilobyte for the image.
What survives the print, the scan and the phone.
Error correction can recover exact codewords from a damaged symbol. It cannot recover biometric detail removed before the credential was printed.
Colour buys capacity in exchange for illumination.
Polychrome barcodes can multiply payload density, but they exchange binary contrast for dependence on inks, cameras and uncontrolled light.
A COSE_Sign1 object is not its signing input.
Four transmitted fields become a different CBOR structure before signature verification.
Verification is not authorization.
A valid signature answers a narrower question than most applications need to decide.