{"id":297,"date":"2026-09-04T22:44:14","date_gmt":"2026-09-04T22:44:14","guid":{"rendered":"https:\/\/neodata.com.uy\/labs\/?page_id=297"},"modified":"2026-09-09T20:11:18","modified_gmt":"2026-09-09T20:11:18","slug":"research","status":"publish","type":"page","link":"https:\/\/neodata.com.uy\/labs\/research\/","title":{"rendered":"Research"},"content":{"rendered":"
\n
\n
\n
\r\n
\r\n
\r\n

\/\/ Research<\/p>\r\n

Where cryptography meets implementation.<\/h1>\r\n

We study the questions that arise when cryptographic designs meet constrained devices, secure hardware and operational environments.<\/p>\r\n

Browse series<\/a>Find an article<\/a><\/div>\r\n
41<\/strong> research articles<\/span>10<\/strong> public series<\/span><\/div>\r\n <\/div>\r\n <\/section>\r\n

\/\/ In focus<\/p>

Selected research.<\/h2><\/div>

Questions with consequences for implementation, migration and trust.<\/p><\/div>

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Featured<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

Toward an open cryptographic workbench.<\/a><\/h3>\r\n

Cryptographic tools explain algorithms, transform data and visualise workflows. A protocol workbench could connect those strengths while keeping exact bytes visible.<\/p>\r\n

\r\n \r\n \"Transparent <\/a>\r\n
\r\n
\r\n Featured<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

What post-quantum migration costs at the edge.<\/a><\/h3>\r\n

Post-quantum algorithms change the size and shape of protocols. At the edge, bytes, memory, latency and update paths become part of the cryptographic decision.<\/p>\r\n

\/\/ Research archive<\/p>

Latest research.<\/h2><\/div>

Primers, analysis and reviews, with series and article type made explicit.<\/p><\/div>

\r\n \r\n \"Three <\/a>\r\n
\r\n
\r\n Cryptography Education \u00b7 Part 2<\/a>\r\n Analysis<\/span>\r\n <\/div>\r\n

The other three questions.<\/a><\/h3>\r\n

Most cryptography education for children begins and ends with confidentiality. Integrity, authentication and credentials can be modelled with simple roles and objects, even as age-assurance systems make those properties part\u2026<\/p>\r\n

\r\n \r\n \"Paper <\/a>\r\n
\r\n
\r\n Cryptography Education \u00b7 Part 1<\/a>\r\n Review<\/span>\r\n <\/div>\r\n

Cryptography can start before algebra.<\/a><\/h3>\r\n

Children can learn the questions cryptography answers before they can learn the mathematics behind its algorithms. Existing school materials teach secrecy well, but leave integrity, authentication, identity and trust comparatively\u2026<\/p>\r\n

\r\n \r\n \"Seven <\/a>\r\n
\r\n
\r\n Key Containers on Mobile Devices \u00b7 Part 3<\/a>\r\n Analysis<\/span>\r\n <\/div>\r\n

Seven containers, ranked by what you can prove.<\/a><\/h3>\r\n

Mobile key containers form a degradation ladder ordered by what an issuer can prove, not only by resistance to attack. Below the policy cut line, fallback changes the custody model\u2026<\/p>\r\n

\r\n \r\n \"Two <\/a>\r\n
\r\n
\r\n Key Containers on Mobile Devices \u00b7 Part 2<\/a>\r\n Primer<\/span>\r\n <\/div>\r\n

The certificate has two lists.<\/a><\/h3>\r\n

Android key attestation records a key's security level and separates authorizations enforced by hardware from those enforced by software. A verifier must validate the certificate chain, revocation status, boot state\u2026<\/p>\r\n

\r\n \r\n \"Three <\/a>\r\n
\r\n
\r\n Key Containers on Mobile Devices \u00b7 Part 1<\/a>\r\n Primer<\/span>\r\n <\/div>\r\n

What “hardware-backed” means on Android.<\/a><\/h3>\r\n

Android exposes software, TEE-backed and StrongBox-backed keys through one keystore API. The effective security level, mandated algorithm set and available attestation evidence vary by device and release.<\/p>\r\n

\r\n \r\n \"Three <\/a>\r\n
\r\n
\r\n Biometrics in 2D Barcodes \u00b7 Part 3<\/a>\r\n Analysis<\/span>\r\n <\/div>\r\n

Colour buys capacity in exchange for illumination.<\/a><\/h3>\r\n

Polychrome barcodes can multiply payload density, but they exchange binary contrast for dependence on inks, cameras and uncontrolled light.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Biometrics in 2D Barcodes \u00b7 Part 2<\/a>\r\n Analysis<\/span>\r\n <\/div>\r\n

What survives the print, the scan and the phone.<\/a><\/h3>\r\n

Error correction can recover exact codewords from a damaged symbol. It cannot recover biometric detail removed before the credential was printed.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Biometrics in 2D Barcodes \u00b7 Part 1<\/a>\r\n Analysis<\/span>\r\n <\/div>\r\n

A face fits in 960 bytes.<\/a><\/h3>\r\n

A signed QR can carry an offline face credential, but signature, encoding and card geometry leave roughly one kilobyte for the image.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Authentication Ceremonies \u00b7 Part 2<\/a>\r\n Primer<\/span>\r\n <\/div>\r\n

SMS OTP is now a restricted authenticator. The hard part is what replaces it.<\/a><\/h3>\r\n

Leaving SMS removes the telephony channel, but phishing resistance depends on origin binding and on every recovery path that can create a session.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Authentication Ceremonies \u00b7 Part 1<\/a>\r\n Primer<\/span>\r\n <\/div>\r\n

Six digits are not the authentication ceremony.<\/a><\/h3>\r\n

An OTP output is short and temporary. Its real security depends on seed custody, moving-factor state, verification policy, session binding and recovery.<\/p>\r\n

\r\n \r\n \"One <\/a>\r\n
\r\n
\r\n Signed Bytes and Parser Differentials \u00b7 Part 2<\/a>\r\n Primer<\/span>\r\n <\/div>\r\n

The verifier and the parser disagree.<\/a><\/h3>\r\n

Signature verification fails as a security boundary when the verifier and the application resolve different meanings from the same document.<\/p>\r\n

\r\n \r\n \"Several <\/a>\r\n
\r\n
\r\n Signed Bytes and Parser Differentials \u00b7 Part 1<\/a>\r\n Primer<\/span>\r\n <\/div>\r\n

Signatures are over bytes, not meaning.<\/a><\/h3>\r\n

Two messages can express the same data and still produce different signatures. Verification begins with the exact bytes a protocol chooses to protect.<\/p>\r\n

\r\n \r\n \"Machined <\/a>\r\n
\r\n
\r\n PKCS #11 Key Policy \u00b7 Part 2<\/a>\r\n Analysis<\/span>\r\n <\/div>\r\n

Audit the attributes, not the datasheet.<\/a><\/h3>\r\n

PKCS #11 key policy is expressed through attributes and mechanisms inside the token. An inventory can reveal permissions that a product datasheet cannot.<\/p>\r\n

\r\n \r\n \"Translucent <\/a>\r\n
\r\n
\r\n PKCS #11 Key Policy \u00b7 Part 1<\/a>\r\n Primer<\/span>\r\n <\/div>\r\n

The handle is not the key.<\/a><\/h3>\r\n

PKCS #11 gives applications a common view of cryptographic devices. The key's policy, lifecycle and operational meaning still depend on what lies behind the handle.<\/p>\r\n

\r\n \r\n \"Identical <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

Entropy arrives late.<\/a><\/h3>\r\n

Correct algorithms can still generate related keys when identical devices ask for randomness before their environments have diverged.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Analysis<\/span>\r\n <\/div>\r\n

Twenty-six years from break to scheduled retirement.<\/a><\/h3>\r\n

SHA-1's long retirement measures inventory, artifact lifetime and the unreachable tail of deployed systems more than cryptanalysis.<\/p>\r\n

\r\n \r\n \"Translucent <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Analysis<\/span>\r\n <\/div>\r\n

The handshake has a budget of fourteen kilobytes.<\/a><\/h3>\r\n

Post-quantum authentication can cross transport limits before application data begins. The real budget is measured in bytes, flights, fragments and buffers.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

A random output can carry a proof.<\/a><\/h3>\r\n

A verifiable random function produces a unique, random-looking output and evidence anyone can check. It proves origin and uniqueness, not fairness in deciding which outputs are revealed.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

Removing a member creates a new epoch.<\/a><\/h3>\r\n

Messaging Layer Security makes membership part of shared cryptographic state. A removal takes effect when the remaining group commits and derives a new epoch.<\/p>\r\n

\r\n \r\n \"Identical <\/a>\r\n
\r\n
\r\n Format-Preserving Encryption \u00b7 Part 2<\/a>\r\n Analysis<\/span>\r\n <\/div>\r\n

The ciphertext does not say which mode produced it.<\/a><\/h3>\r\n

Format-preserving ciphertext carries no mode, key or tweak metadata. That convenience makes FF1 and FF3 migration difficult to scope from the data alone.<\/p>\r\n

\r\n \r\n \"Identically <\/a>\r\n
\r\n
\r\n Format-Preserving Encryption \u00b7 Part 1<\/a>\r\n Primer<\/span>\r\n <\/div>\r\n

Preserving the format preserves the leakage.<\/a><\/h3>\r\n

Format-preserving encryption keeps ciphertext compatible with narrow legacy fields. It also keeps domain size, length, structure and often equality visible.<\/p>\r\n

\r\n \r\n \"Three <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

A compact handshake still has a transcript.<\/a><\/h3>\r\n

EDHOC compresses authenticated key exchange into three concise CBOR messages. Its efficiency still depends on exact transcript bytes, credential profiles and state transitions.<\/p>\r\n

\r\n \r\n \"Blue <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

Two key exchanges still make one protocol.<\/a><\/h3>\r\n

A hybrid key exchange combines a traditional contribution with a post-quantum one. Its guarantee depends on the combiner, transcript, negotiation and every failure path around both components.<\/p>\r\n

\r\n \r\n \"Two <\/a>\r\n
\r\n
\r\n Signature Nonces \u00b7 Part 2<\/a>\r\n Analysis<\/span>\r\n <\/div>\r\n

Sign the same message twice.<\/a><\/h3>\r\n

Repeated signing reveals whether output varies. Across a population, repeated ECDSA values can expose nonce reuse, compromise and implementation anomalies.<\/p>\r\n

\r\n \r\n \"One <\/a>\r\n
\r\n
\r\n Signature Nonces \u00b7 Part 1<\/a>\r\n Primer<\/span>\r\n <\/div>\r\n

Determinism is not a substitute for entropy.<\/a><\/h3>\r\n

Deterministic signing prevents catastrophic dependence on fresh random nonces. Hedged signatures add new randomness to reduce repeated traces and faults without trusting that randomness completely.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

No intermediary should see the whole request.<\/a><\/h3>\r\n

Oblivious HTTP partitions network identity and request contents between a relay and a gateway. Padding, discovery, metadata and collusion still determine the privacy of the complete system.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

Evidence is not a verdict.<\/a><\/h3>\r\n

Remote attestation authenticates evidence about a target environment. Endorsements, reference values and appraisal policy are what turn that evidence into a decision.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

A key directory should be accountable.<\/a><\/h3>\r\n

Key transparency gives public-key distribution a consistent, auditable history. Its proofs expose silent substitution only when clients, monitors or witnesses compare committed views.<\/p>\r\n

\r\n \r\n \"Blue <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

The aggregate can be known without collecting each value.<\/a><\/h3>\r\n

VDAFs let several aggregators verify and combine hidden client measurements. The result protects individual values only when non-collusion, batching and query policy hold.<\/p>\r\n

\r\n \r\n \"Unmarked <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

Authorization does not require identity.<\/a><\/h3>\r\n

Privacy Pass separates token issuance from token redemption. The token can prove prior authorization without carrying a stable client identity.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

The server does not need the password.<\/a><\/h3>\r\n

OPAQUE lets a client and server establish a mutually authenticated key without disclosing the password to the server. Registration, recovery and server-key custody still define the system's real boundary.<\/p>\r\n

\r\n \r\n \"Several <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

The signature is ordinary. The ceremony is not.<\/a><\/h3>\r\n

FROST turns distributed authority into one ordinary Schnorr signature. The difficult security work remains in share generation, nonce state, participant coordination and recovery.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

The statement must enter the hash.<\/a><\/h3>\r\n

A zero-knowledge proof can verify correctly while authorizing the wrong statement. Fiat-Shamir security begins with the exact public instance, transcript order and domain separation absorbed by the hash.<\/p>\r\n

\r\n \r\n \"Layered <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

Selective disclosure is not unlinkability.<\/a><\/h3>\r\n

BBS signatures support selective disclosure and randomized derived proofs. Unlinkability still depends on disclosed values, proof context, revocation and the surrounding protocol.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

A blockchain can preserve a claim. It cannot make it true.<\/a><\/h3>\r\n

Hashes, signatures and consensus can preserve an ordered claim. They cannot establish the external truth, authority or intent behind it.<\/p>\r\n

\r\n \r\n \"A <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

Algorithm agility is an operational property.<\/a><\/h3>\r\n

Supporting a second algorithm is easy. Moving a running system from one cryptographic regime to another is the real test of agility.<\/p>\r\n

\r\n \r\n \"Transparent <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

The transcript is the protocol.<\/a><\/h3>\r\n

A secure session depends on more than fresh keys. The negotiation, participants and intended operation must be bound to the same cryptographic result.<\/p>\r\n

\r\n \r\n \"Two <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

A nonce is not a footnote.<\/a><\/h3>\r\n

A secure cipher can fail when nonce state does not survive writers, restarts and rollbacks. Uniqueness is a property of the operating system around the primitive.<\/p>\r\n

\r\n \r\n \"Four <\/a>\r\n
\r\n
\r\n Research<\/span>\r\n Primer<\/span>\r\n <\/div>\r\n

The curve is only part of the choice.<\/a><\/h3>\r\n

P-256, secp256k1, Ed25519 and X25519 name different layers, purposes and ecosystems. Selecting a curve never selects the complete construction.<\/p>\r\n