Series

How It Breaks in Real Life

11 parts of 11

1. Part 1 How AES Breaks in Real Life: The Attacks That Never Touched the Cipher

   Jul 17, 2026 · 44 min read

   AES-the-cipher has never been broken in the field -- its deployments have. KRACK, repeated GCM nonces, and cache timing broke the wrapper, never the block.

2. Part 2 How the Hash Functions Broke in Real Life: MD5, Flame, SHATTERED, and the Long Death of SHA-1

   Jul 17, 2026 · 41 min read

   MD5 and SHA-1 were genuinely, mathematically broken -- yet every real breach still needed a second failure: a deployment still trusting the dead hash.

3. Part 3 How RSA Breaks in Real Life: ROCA, Bleichenbacher's Ghosts, FREAK, and the Keys That Shared a Prime

   Jul 17, 2026 · 44 min read

   No one has ever factored a strong, deployed RSA key -- yet ROCA, Bleichenbacher's oracle, DROWN, and FREAK broke real RSA anyway. The break was never the factoring.

4. Part 4 How Elliptic Curves and Diffie-Hellman Break in Real Life: The Discrete Log Never Fell

   Jul 18, 2026 · 45 min read

   No one has solved the discrete log on a strong curve or a 2048-bit group -- yet PS3, Android wallets, TPMs, CurveBall, and Logjam all fell. Here is exactly how.

5. Part 5 Q-Day Has Not Happened. The Incident Already Has: Harvest Now, Decrypt Later

   Jul 18, 2026 · 46 min read

   No quantum computer can break RSA in 2026, yet long-lived secrets encrypted today may already be lost. Harvest now, decrypt later is a deployment failure.

6. Part 6 How ML-KEM Breaks in Real Life: The Machine Leaked While the Math Held

   Jul 18, 2026 · 42 min read

   ML-KEM shipped with a machine-checked security proof, yet its reference code leaked secret keys through a division instruction. Why every break missed the math.

7. Part 7 How the NIST Finalists Broke: Rainbow in a Weekend, SIKE in an Afternoon, and the Graveyard of Post-Quantum Candidates

   Jul 19, 2026 · 46 min read

   In 2022 two vetted NIST post-quantum candidates fell to classical math -- Rainbow in a weekend, SIKE in ten minutes. That is the process working, not failing.

8. Part 8 How the Wiretap Became the Backdoor: Salt Typhoon and the Thirty-Year Warning That Came Due

   Jul 20, 2026 · 53 min read

   For thirty years cryptographers warned a mandated wiretap is a backdoor. Salt Typhoon proved it: a nation-state walked through CALEA lawful-intercept plumbing.

9. Part 9 When Prompts Become Shells: How Prompt Injection Turned AI Agents Into Remote Code Execution

   Jul 21, 2026 · 42 min read

   Prompt injection is not a content-safety nuisance. In tool-using AI agents it is a remote-code-execution class -- traced through four disclosed 2025-2026 CVEs.

10. Part 10 Ransomware Without the Ransom: How Snowflake and the Extortion-Only Era Rewrote the Playbook

    Jul 23, 2026 · 52 min read

    Between 2024 and 2026 the biggest ransomware attacks stopped encrypting. Attackers just logged in or exploited a zero-day, copied the data, and extorted.

11. Part 11 How Zero-Knowledge Broke in Real Life: Under-Constrained Circuits and the Bugs That Minted Money

    Jul 24, 2026 · 50 min read

    Every time production zero-knowledge has publicly broken, the cryptography held. The real failures are soundness bugs in circuits, verifiers, and transcripts.

← All series · Start here