~/blog / security
Security
6 posts tagged Security.
-
The Cyber Resilience Act's Reporting Clock Starts September 11 — Before Your Upstream's Does September 11, 2026 is the Cyber Resilience Act's first hard deadline. A plain technical walkthrough for embedded teams: what the CRA actually requires, why it lands in two phases, how Zephyr handles its half as an open-source steward, what's left for manufacturers, the real pain points, and a worked example of a compliant report from advisory to close-out. -
Constant-time isn't enough: why WPA3-SAE had to abandon Hunting-and-Pecking for Hash-to-Element WPA3-SAE turns your password into an elliptic-curve point, and the old Hunting-and-Pecking method leaked it through timing. Padding the loop didn't fix it — and neither does SSWU alone. A deep look at constant-time crypto as a property of the silicon: why the leak channel changes across Cortex-M, Cortex-A and x86, why DIT/DOITM and your compiler matter, and how you'd actually measure it. -
Three Ways to Fake Wi-Fi, One Merged: Zephyr's New hwsim Linux has had mac80211_hwsim for years; Zephyr had nothing like it — you couldn't test the Wi-Fi supplicant without a radio on the bench. Three different fixes landed on the table at once; an RFC and a Wi-Fi telco sorted out which does what, and I built and merged the in-process one: N virtual radios in a single image, running real WPA2 and WPA3 handshakes with zero hardware. Here's the design call, the one problem that makes it hard on Zephyr specifically, and the war story of getting SAE green. -
Wi-Fi Crypto Can't Go Fully PSA: Inside the Mbed TLS 4.x Migration Wi-Fi security can never be fully PSA-compliant — the standards mandate legacy algorithms PSA won't touch. Here's what porting hostap's crypto to Mbed TLS 4.x and PSA actually took: a deleted DH module, dropped curves, deliberate hacks, and a detour through the bootloader — all riding into nRF Connect SDK 3.4.0 LTS. -
Linux 7.2 Kills strncpy() — What the Kernel's 6-Year Exorcism Means for Your C Codebase strncpy() is gone from the Linux kernel after 362 patches and 6 years. The real story isn't the removal — it's the five replacements, the forced audit of intent, and why your firmware probably still has the same bug. -
Your Wi-Fi WPA3 network has a quantum problem. Here's the fix coming in IEEE 802.11bt. WPA3's SAE handshake rests on elliptic-curve cryptography that Shor's algorithm breaks retroactively. A look at the Harvest-Now-Decrypt-Later threat, why MLWE is quantum-resistant, and what IEEE 802.11bt actually defines.