ctf VS libsodium

Audio can contain dial tones, or it can contain binary/morse code on some particular frequency, or it's not really "audio" but radio-transmission which needs to be decoded, or the audio can contain sounds of keyboard typing or even 3d printer head moving (like https://github.com/p4-team/ctf/tree/master/2020-05-10-spam-and-flags-teaser/3d_printer ), or maybe audio has multiple sources interleaved and you need to separate them and one has the flag, or maybe the audio file itself has specific format and some information can be passed there. There are infinite possibilities and it's impossible to say anything without analysing the file.

It's hard to say anything without actually seeing the page. Was there something inside the CSS files? You can do some crazy stuff there :) You can also do some fancy stuff like bypassing CSRF with CSS injection like in: https://github.com/p4-team/ctf/tree/master/2018-01-20-insomnihack/web_css

One thing that immediately comes into mind is that archives are "weird", and an archive file can be also a totally different type of file at the same time. Just to clarify what I mean see: https://github.com/p4-team/ctf/blob/master/2016-04-15-plaid-ctf/web_pixelshop/README.md and specifically the magic file https://github.com/p4-team/ctf/blob/master/2016-04-15-plaid-ctf/web_pixelshop/exploit.png this is totally valid PNG file but at the same time it's also totally valid ZIP file with PHP shell inside.

Funny part is that even in CTF challenges made around this problem challenge authors were introducing some intentional bugs to account for this scenario, because they thought it would be too unrealistic otherwise :D See for example: https://github.com/p4-team/ctf/tree/master/2018-12-08-hxp/crypto_uff

See: https://github.com/p4-team/ctf/tree/master/2016-03-12-0ctf/peoples_square and also https://github.com/TFNS/writeups/tree/master/2020-06-05-DefenitCTF/spn (this one is not AES but some toy SPN, but the idea is exactly the same and maybe easier to understand)

If it's some serious interesting cryptography (just to give you an example: https://github.com/p4-team/ctf/tree/master/2019-11-02-google-ctf/fractorization ), then perhaps consider talking to some CTF team to feature your challenge during an upcoming CTF

Also what you need doesn't require that much code, it's very similar to: https://github.com/p4-team/ctf/tree/master/2017-09-02-tokyo/crypto_rsa

Libsodium has been around for a while, so probably the reason it was posted is that version 1.0.19 was just released: https://github.com/jedisct1/libsodium/releases/tag/1.0.19-RE...

Updated NuGet and Swift packages are going to be uploaded soon.

AEGIS-128X and 256X are not there yet, but if you need them, they are available in libaegis: https://github.com/jedisct1/libaegis

All the code from libaegis will eventually be merged into libsodium, including the incremental update API which is especially useful for TLS.

To version the dependency you can check the current stable tree in git and save the date and git hash.

To address both of these vulnerabilities, you should instead use a library that handles these sharp edges for you. A well received library in the security and cryptography communities is libsodium. It has high level functions that handle password hashing and data encryption for you, reducing the risk that you introduce vulnerabilities in your code, such as you have here.

In general, cryptography is really hard. So for example, an attacker could construct a message that if you signed would leak information, ie it reduces the space of possible keys such that it can be brute forced. I’m not entirely sure if you could do that with a transfer function. But it’s certainly possible. That said, there are a ton of smart devs trying to prevent that as well so I’m not assuming anything here. But prudent practices are likely good to follow. Be very careful calling anything from your cold wallet etc. Use disposable keys for anything a bit risky. I took a sec to google an example and this is the closest I could find. https://github.com/jedisct1/libsodium/issues/170

Hi everyone! I'm learning Rust while on a break between jobs, and as I'm particularly interested in interfacing Rust with C and in cryptography, I've decided to write a wrapper around libsodium (https://github.com/jedisct1/libsodium) in Rust. This is purely a hobby project and I probably won't ever release it as there are already some open-source Rust bindings available for the library.

Can anyone recommend between Librandombytes and libsodium ramdombytes?

https://github.com/jedisct1/libsodium/tree/master/src/libsod...