{"id":442,"date":"2026-09-05T18:54:54","date_gmt":"2026-09-05T18:54:54","guid":{"rendered":"https:\/\/neodata.com.uy\/labs\/?page_id=442"},"modified":"2026-09-06T14:59:01","modified_gmt":"2026-09-06T14:59:01","slug":"all-articles","status":"publish","type":"page","link":"https:\/\/neodata.com.uy\/labs\/all-articles\/","title":{"rendered":"All Articles"},"content":{"rendered":"
\n
\n
\n

All Articles<\/h1>\n<\/div><\/div>\n<\/div>\n<\/div>\n<\/div>\n\n
\n
\n
\n
\"Three<\/span><\/a><\/div>

Mobile Secure Key Containers, Capability Detection, and Key Attestation: A Technical Reference for Credential Wallet SDKs \u2014 Part I<\/a><\/h2>

Sep 5, 2026<\/span> | Featured Research<\/a><\/span><\/p>

Android, iOS, and HarmonyOS expose different assurance paths for wallet keys. This reference maps secure containers, capability detection, attestation chains, and fallback tiers.<\/p>\n<\/div><\/div><\/article>

\"Two<\/span><\/a><\/div>

Sign the same message twice.<\/a><\/h2>

Sep 5, 2026<\/span> | Research<\/a><\/span><\/p>

Repeated signing reveals whether output varies. Across a population, repeated ECDSA values can expose nonce reuse, compromise and implementation anomalies.<\/p>\n<\/div><\/div><\/article>

\"Identical<\/span><\/a><\/div>

The ciphertext does not say which mode produced it.<\/a><\/h2>

Sep 5, 2026<\/span> | Research<\/a><\/span><\/p>

Format-preserving ciphertext carries no mode, key or tweak metadata. That convenience makes FF1 and FF3 migration difficult to scope from the data alone.<\/p>\n<\/div><\/div><\/article>

\"Machined<\/span><\/a><\/div>

Audit the attributes, not the datasheet.<\/a><\/h2>

Sep 5, 2026<\/span> | Research<\/a><\/span><\/p>

PKCS #11 key policy is expressed through attributes and mechanisms inside the token. An inventory can reveal permissions that a product datasheet cannot.<\/p>\n<\/div><\/div><\/article>

\"One<\/span><\/a><\/div>

The verifier and the parser disagree.<\/a><\/h2>

Sep 5, 2026<\/span> | Research<\/a><\/span><\/p>

Signature verification fails as a security boundary when the verifier and the application resolve different meanings from the same document.<\/p>\n<\/div><\/div><\/article>

\"A<\/span><\/a><\/div>

SMS OTP is now a restricted authenticator. The hard part is what replaces it.<\/a><\/h2>

Sep 5, 2026<\/span> | Research<\/a><\/span><\/p>

Leaving SMS removes the telephony channel, but phishing resistance depends on origin binding and on every recovery path that can create a session.<\/p>\n<\/div><\/div><\/article>

\"A<\/span><\/a><\/div>

What survives the print, the scan and the phone.<\/a><\/h2>

Sep 5, 2026<\/span> | Research<\/a><\/span><\/p>

Error correction can recover exact codewords from a damaged symbol. It cannot recover biometric detail removed before the credential was printed.<\/p>\n<\/div><\/div><\/article>

\"Three<\/span><\/a><\/div>

Colour buys capacity in exchange for illumination.<\/a><\/h2>

Sep 5, 2026<\/span> | Research<\/a><\/span><\/p>

Polychrome barcodes can multiply payload density, but they exchange binary contrast for dependence on inks, cameras and uncontrolled light.<\/p>\n<\/div><\/div><\/article>

\"A<\/span><\/a><\/div>

A face fits in 960 bytes.<\/a><\/h2>

Sep 5, 2026<\/span> | Research<\/a><\/span><\/p>

A signed QR can carry an offline face credential, but signature, encoding and card geometry leave roughly one kilobyte for the image.<\/p>\n<\/div><\/div><\/article><\/div>