Blog
Cryptography
The Architecture of Time-Based One-Time Passwords: Inside RFC 6238 and HMAC Generation
A comprehensive mathematical and protocol analysis of RFC 6238 Time-Based One-Time Passwords (TOTP), exploring dynamic truncation, HMAC-SHA1 step counters, clock drift mitigation, and secure in-browser execution.
Anatomy of a QR Code: Reed-Solomon Error Correction and Matrix Encoding
A deep mathematical exploration of ISO/IEC 18004 QR codes, detailing Galois Field GF(2^8) arithmetic, generator polynomials, Reed-Solomon error correction, and in-browser matrix rendering.
Cryptographic Randomness in the Browser: Math.random vs crypto.getRandomValues
A deep architectural investigation into pseudo-random number generators (PRNG) versus cryptographically secure PRNGs (CSPRNG) in browser runtimes, detailing xorshift128+, state reconstruction attacks, and the Web Cryptography API.
Base32 vs Base64: Structural Differences, Padding Rules, and Cryptographic Usage
A deep technical specification of RFC 4648 binary-to-text encodings, contrasting Base32 and Base64 bitwise packing mechanics, padding matrices, alphabet ergonomics, and in-browser execution.
Passkeys vs TOTP: The Cryptographic Shift from Shared Secrets to Public Key Signatures
An architectural and security analysis comparing RFC 6238 Time-Based One-Time Passwords with FIDO2/WebAuthn Passkeys, exploring Adversary-in-the-Middle phishing resistance and origin binding.
Secure Browser Storage: Comparing LocalStorage, SessionStorage, and Encrypted IndexedDB
Technical security evaluation of browser storage mechanisms, detailing XSS exposure vulnerabilities, origin boundaries, cryptographic shredding, and ephemeral session hygiene.