TLS
Posts with this tag
Posts
-
A Post-Quantum Cryptography Primer: Shor, Grover, ML-KEM and the Hybrid Handshake
Which parts of today's cryptography a large quantum computer would break, what NIST standardised in FIPS 203, 204 and 205, how X25519MLKEM768 protects TLS 1.3 sessions, and how to try ML-KEM yourself with OpenSSL 3.5.
-
Trust Across Virtual Hosts: Resuming a TLS 1.3 Session Past mTLS, Then a Signed Plugin to RCE
A write-up of the web challenge Trust from WannaGame Championship 2025, where a TLS session cache shared between two nginx virtual hosts lets a ticket from the public site skip client-certificate checks on the employee site, and a plugin upload that verifies a signature but extracts appended data and symlinks plants a JSP shell.
