The Gospel of Crypto Is Written in Shadows

 

They told us it was freedom.

They told us it was the end of kings and bankers.

They told us no one could steal from us again.

But the truth is older than blockchain:

Where there is gold, there are thieves.

Where there is power, there are tyrants.

And where there is no law, betrayal becomes the law.

Crypto is not a revolution.

It is the mirror of our greed, coded into ledgers we do not understand, governed by hands we cannot see.

You think you are sovereign with your wallet, your keys, your tokens.

But sovereignty without protection is just exposure.

And exposure in a world of wolves is an invitation to be eaten.

The faithful will keep chanting "decentralization".

The whales will keep harvesting sheep.

And the founders will keep preaching freedom while building empires of sand.

This is not liberation.

It is the same empire, reborn in code - only darker, only faster, only more merciless.

The collapse is certain.

The only question left is not if - but who will still be standing when it does?

The only defense is not in systems, but in people.

Build trust where the code cannot reach. That's the seed that might survive the fire.

Also visit: https://quangntenemy.substack.com/p/the-gospel-of-crypto-is-written-in

🔐 Encryption ≠ Security

 

Just because something’s encrypted doesn’t mean it’s secure.

We saw that play out - painfully clearly - during Google CTF 2025.

🕒 Last month, our team took on a challenge called crypto-numerology.

At first glance, it looked solid: a stream cipher modeled after ChaCha20. It had proper constants, key/nonce structure, and ciphertext that looked convincingly random.

But there was one critical detail.

👉 It only used one round of mixing.

That one shortcut changed everything.

With a known key and a few plaintext/ciphertext pairs, we could fully recover keystream blocks. From there, it only took a small brute-force over a 32-bit counter to reveal the flag.

No fancy math. No deep exploit chain.

Just a cipher that looked like encryption - but offered none of its guarantees.

🔍 What struck me most was how realistic this failure felt.

This wasn’t just a broken CTF challenge.

It was a reflection of how real-world systems break:

“One round should be fine.”

“Nobody will reuse this nonce.”

“It’s just for internal use.”

Security doesn't usually break in dramatic ways - it rots quietly, through shortcuts and assumptions that go unchallenged until it’s too late.

🧠 Takeaway:

In cryptography, almost secure means completely broken.

True security means refusing to compromise—even when it’s tempting.

📖 If you're interested in the technical breakdown, we shared the full write-up here:

🔗 https://ctftime.org/writeup/40328

Also visit: https://quangntenemy.substack.com/p/encryption-security

The world isn’t ready. Not for what’s coming

 

While we obsess over the latest app, chase AI buzzwords, and plug holes in broken systems, a real storm is quietly brewing: quantum computing. It’s not science fiction anymore - it’s becoming real. And when it arrives, it won’t politely knock. It will shatter the cryptographic foundations we naïvely trust to secure our banks, governments, and digital lives.

Post-quantum cryptography isn’t some optional upgrade. It’s a lifeline. A chance to rebuild the crumbling fortress before it collapses under the weight of tomorrow’s tech. Lattice-based, hash-based, multivariate - all still experimental, all still fragile - but they’re what we’ve got. And they’re better than blind faith in outdated encryption.

The industry needs to wake up. We can’t keep pretending business as usual will save us. Post-quantum security is not a future problem - it’s a present responsibility. The threat is real. The timeline is unknown. And the consequences of inaction? Catastrophic.

We’re running out of time. Start acting like it.

https://quangntenemy.substack.com/p/the-world-isnt-ready-not-for-whats

RuCTF Quals 2014

Another great CTF with many challenges in all categories just ended. Our team was #7. Nana. Not too bad, but it was so annoying that without a network specialist we could not solve admin 200 task "Troubleshooting" which 97 other teams solved with ease.

Below are some write-ups. Hopefully they can give new players an introduction to steganalysis.

stegano 100: Cat's eye

This is an easy GIF stegano, but it took me quite a while analysing the image until I noticed it contained 8 similar frames which wasn't easy to notice in GIMP by default (note to myself: next time check the frames first). It is common sense to combine them and find the differences. The positions of the different pixels are as marked below:

It isn't very straightforward, but the flag is hidden here in binary representation. Using black pixels as 0s and green pixels as 1s give you the flag: RUCTF_e4dd9f5cee307b322c3a27abe66e3df9

stegano 300: Nyan-task

This is a very famous image. By finding and comparing it with the original image it can be concluded that there is no information hidden visually. Analysis with Caesum's StegSolve brought me to the conclusion that the only place to hide the flag is inside the palette. It is also suspicious to see only 14 colors used for the image while the palette contains 256 colors with a lot of repetition.

After extracting the palette I found out that this is actually a DataMatrix barcode (thanks stypr). The rest is easy. The hidden text is u.to/P4JUBg, which is a link to the flag: RUCTF_ca8250c2b4b50581afc9ffd1f403f3f2

crypto 200: Mary Queen

The task is to decipher a message written in Chinese characters. The title suggests that this is similar to the cipher used by Mary Queen of Scots, which is a cryptosystem in which simple substitution is used. This cipher is so weak that many tools have been created to solve it automatically, SCBSolvr is one of them. The decrypted text is chapter I of Alice's Adventures in Wonderlands by Lewis Carroll. The name of the book is also the flag.