Tag
作者批评 ML-DSA 和 Ed25519 在签名时先对公钥哈希的做法，认为这破坏了验证端先哈希消息再逐个试验签名密钥的高效流程，并建议把公钥哈希拼接在消息末尾以保留流式哈希的优势。
Security researcher David Buchanan (retr0id) demonstrates a C2PA spec footgun allowing arbitrary byte-range "exclusions" in signed files, showing how timestamped Content Credentials can be forged to "hack time" — e.g. backdating winning lottery numbers — undermining C2PA as a trust anchor for image provenance.
The article advocates for mesh networks to use message signing instead of encryption in amateur radio, highlighting benefits like authenticity and easier legal operation, while noting drawbacks such as reduced privacy.
An educational blog post explaining Merkle's authentication tree and the Lamport-Diffie one-time signature scheme, covering the history of digital signatures and how one-way functions enable secure authentication.