Matteo Scarlata

We finally finished the universal signature forgery for 1024-bit RSA! 2^32 oracle queries, 1200 core years precomputation, 180 core years for an individual forgery, and 3 years of human labor (no AI involved) by Laura, Adam, Nadia, Emmanuel and me to pull of this computation against real HSMs.

Our latest “Crypto in the Wild” project, analysing secure email gateways. We give 29 cryptographic attacks on 4 different products, from SEPPmail, Cisco, Proton and CipherMail. Paper to appear at ACM CCS 2026.

"presenting a cornucopia of practical attacks". These are my favorite words ever to have occurred in a cryptography paper.

You mean Professor Matilda Backendal! 😉

Do you use a cloud-based password manager? So what's your threat model? Vendors like Bitwarden, Dashlane, LastPass and 1Password offer you "Zero Knowledge Encryption", with statements like: "Not even the team at Bitwarden can read your data (even if we wanted to)." We decided to test this… 1/n

The call for talks for CAW 2026 (a workshop affiliated with Eurocrypt) is out! This year's motto is "cryptography under real-world constraints and threat models", but other applied cryptography is also very welcome. All info is on: caw.cryptanalysis.fun.

This year, #CAW offers the option for remote participation to make our Eurocrypt workshop accessible to the members of our community that cannot or prefer not to travel to Madrid. Register on our website before May 2 (free): caw.cryptanalysis.fun The updated program is below.

Our latest work is out! Breaking and repairing Content-Defined Chunking, with impact across multiple backup systems. Read Kien Tuong Truong’s blog here: blog.ktruong.dev/breaking-cdc