https://npmjs.com/package/lvthn
the leviathan cli crypto tool has been updated w/ the 2.1.0 fixes and enhancements.
bun / npm i -g lvthn
averages ~1gb per sec using serpent-256, nearly half that using xchacha20 ;D
Remote
xero
@xero@haunted.computer
mastodon
4.6.4+glitch
{h,cr,sl}acker 💾🏴☠️
https://backrooms.quest ≈ https://windows98.website
213
Followers
27
Following
34
Posts
Joined November 16, 2022
xero.style:
x-e.ro:
0w.nz:
windows98.computer:
Posts
https://github.com/xero/leviathan-crypto/releases/tag/v2.1.0
leviathan-crypto presents post-quantum ratchet primitives! ratchetInit, KDFChain, kemRatchetEncap/Decap, SkippedKeyStore, & RatchetKeypair are now available for all your sparse post quantum ratchet needs. tools to build your own signal-esque apps! #crypto #cryptography #ratchet #spqr
https://github.com/xero/covcom
Covert communications for private group conversations. Share an invite, talk, close the tab, and it's gone. End-to-end encrypted with post-quantum cryptography, so the messages stay private today and unreadable to the computers coming tomorrow.
https://leviathan.3xi.club/covcom
animated protocol diagram for my upcoming project
leviathan-crypto post-quantum key establishment, live in the browser. ml-kem ceremony, encrypted messaging, annotated wire frames. this demo let's you see exactly what crosses the wire and what doesn't.
demo: https://leviathan.3xi.club/kyber
source: https://github.com/xero/leviathan-demos/tree/main/kyber
https://leviathan.3xi.club/kyber
post-quantum cryptography demo simulating a complete ML-KEM (kyber) key encapsulation ceremony between two browser-side clients. Each wire frame is expandable, revealing the raw nonce, ciphertext, Poly1305 tag, and AAD.
sauce: https://github.com/xero/leviathan-demos/tree/main/kyber
https://github.com/xero/claudecode-hook-n-switch
VULN DISCLOSURE: Claude Code's HTTP hook system lets a malicious repo silently rewrite your shell commands before execution. The UI displays the original command. The rewritten one runs with no indication anything changed. full prompt interception, complete tool output exfil (env vars, file contents, paths, etc), and loopback SSRF to any localhost service.
Disclosed to Anthropic via H1. Closed as wontfix. their position is that trusting a repo means trusting all of this.
decide for yourself if that dialog you agree to is doing enough.
PoC, logs, and mitigation strategies in the repo.
https://github.com/xero/leviathan-crypto/
leviathan-crypto v1.4.0
XChaCha20Seal: bind key, call encrypt(), done! fresh nonce every call w/ no management needed.
XChaCha20StreamSealer: chunked AEAD for large payloads w/ per-chunk nonces and position binding.
bun i leviathan-crypto
(on npm you pleb)
npmjs.com/package/lvthn
v1.3.1 with cli worker pooling & wasm simd optimization!
bun i -g lvthn # or npm install
lvthn keygen --armor -o my.key
cat secret.txt | lvthn encrypt -k my.key --armor > secret.enc
supports: serpent-256 (ctr mode w/ hmac-sha256) & xchacha20-poly1305
---
key derivation: scrypt (N=32768, r=8, p=1) for passphrases → 32-byte master key with a fresh random 32-byte salt per encryption.
integrity: any modification to a ciphertext chunk causes that chunk's authentication to fail. The entire decryption is rejected with no partial plaintext produced.
parallelism: encryption and decryption distribute 64KB chunks across a worker pool sized to hardwareConcurrency. Each worker owns an isolated WASM instance with no shared memory between workers.
4-wide inter-block SIMD (encryptChunk_simd): each v128 register lane holds word w from a different block (counters ctr, ctr+1, ctr+2, ctr+3). Same parallelism model as ChaCha20 CTR-4.
https://github.com/xero/leviathan-crypto/releases/tag/v1.2.0
leviathan-crypto v1.20: bringing WebAssembly SIMD acceleration to serpent-256 and ChaCha20. inter-block 4-wide parallelism delivering 2–3x single-thread throughput gains across V8, SpiderMonkey, and JSC!
https://npmjs.com/package/leviathan-crypto
https://github.com/xero/leviathan-crypto/wiki/security_policy
im trying to write the best security policy i can for this project. suggestions welcomed.
i think these public attestation signing are cool for published artifacts. does anyone else?
https://search.sigstore.dev/?logIndex=1187915865
created from this release
https://github.com/xero/leviathan-crypto/releases/tag/v1.1.0
made a little demo site for my crypto lib. web file encryption, chat, and cli tools
shoutout to bunjs! these single-file executable bins are so hype! watch me install my new crypto lib and build the cli tool in under 0.1s, then watch my demo tool use XChaCha20Poly1305 to encrypt and decrypt a 1gb file in 2s ;D
typescript and wasm in the shell? yes indeed.
v1 (and 2 stream ciphers) were not fast enough. so let's use worker pools! serpent-256 x4 faster! and pooling XChaCha20-Poly1305 makes the tool ridiculous. testing on a 1.3gb file, 2.4sec encrypt or decrypt.
wasm is so hype!
#crypto #wasm #typescript #asciiart #teminal
Replying to
@xero@haunted.computer
@antlers my life mentally is I'm ready to use whatever tool is available for me to get the job done. doesn't have to be the best one. just got to get shit done. if I don't fix it no one else will and it will just be broken. it's for me, AI is just another tool like anything else. i look up programming questions on stack overflow & see just as many wrong answers as some bot gives me in a chat box. no matter what, you always have to do your own research on anything ya read.
Replying to
@xero@haunted.computer
@antlers by virtue of my job role, for the last... idk 6 months or so ive been on and off tasked with investigating all these AI tools that different teams wanted to use and what their security implications and any possible mitigations would be, regardless of my personal feelings about them. That's where the market is going, so being a security practitioner it's my job to follow all the other sheep and see what I can break along the way
Replying to
@xero@haunted.computer
@antlers another example I always use is my friend who is a fantastic writer but was never been able to gain any traction with her work. she tried commissioning traditional artists. but no one was really interested in doing the amount of animation she needed for the amount of money she had. but as soon as she started generating visuals to go along with her writing, she gets millions of people hearing her stories finally. she spends an insane amount of times generating prompt after prompt until the visuals exactly match what she's looking for. I don't consider that slop in the slightest. The junk that I made on the other hand I will agree with. but I don't agree that all generated art is ✌️
Replying to
@xero@haunted.computer
@antlers I don't frequent any meme subs so I don't know what moderator or posts you speak of.
but as far as generated art goes, I tell the computer to do a thing and it does. whether that's with my mouse in photoshop, my keyboard in a text editor. a prompt in a chat box. either way, if I'm not physically painting it or drawing it, it's generated by the computer. how much of that influence is me and how much of that influence is the machine is variable depending on a lot of factors.
in this case it was like a passing joke I wanted to make. I didn't have the time nor desire to make something in "more manually" in design software anyhow at that moment. it was just supposed to be funny.
Replying to
@xero@haunted.computer
@antlers cool dude, you do you. i was just trying to make someone smile. sorry the diagram of the algorithm isn't perfect ✌️
Replying to
@wolf480pl@mstdn.io
@wolf480pl no worries. and likewise my apologies for assuming you were quizzing me about the value of 'd'.
Replying to
@wolf480pl@mstdn.io
@wolf480pl sorry my meme is not up to standards. was just trying to be funny and make people smile ✌️
Replying to
@xero@haunted.computer
@wolf480pl Alice and Bob agree on a prime number, p, and a base, g, in advance. For our example, let's assume that p=23 and g=5.
Alice chooses a secret integer a whose value is 6 and computes A = g^a mod p. In this example, A has the value of 8.
Bob chooses a secret integer b whose value is 15 and computes B = g^b mod p. In this example, B has the value of 19.
Alice sends A to Bob and Bob sends B to Alice.
To obtain the shared secret, Alice computes s = B^a mod p. In this example, Alice obtains the value of s=2
To obtain the shared secret, Bob computes s = A^b mod p. In this example, Bob obtains the value of s=2.
The algorithm is secure because the values of a and b, which are required to derive s are not transmitted across the wire at all.
Replying to
@wolf480pl@mstdn.io
@wolf480pl a secret integer. both sides of the exchange generate them the same way. but with different values
Replying to
@netspooky@haunted.computer
@netspooky@haunted.computer ive definitely gone to a public library just to print a document before. but you said uber rual so maybe not an option