Paragon Initiative Enterprises Blog
The latest information from the team that develops cryptographically secure PHP software.
Celebrating Three Years of PIE on Pi Day
Paragon Initiative Enterprises (P.I.E.) got its name on March 14, 2015. How have things changed in three years?
Paseto is a Secure Alternative to the JOSE Standards (JWT, etc.)
This is a follow-up to our 2017 blog post that made the case for avoiding JSON Web Tokens (JWT) and its related standards.
Many developers responded to our post with the same question: "What should we use instead of JWT?" Today, I'm happy to announce a viable replacement.
Our Ambitious Plan to Make Insecure PHP Software a Thing of the Past
Last month we published our guide to building secure PHP software in 2018. It provides clear and accessible guidance to writing secure PHP software. If you're a web developer, that page should serve as a great starting point for writing secure software going forward.
However, that guide only solves half the problem.
The other half is the abundance of outdated blog posts and PHP tutorials littered across the Internet that demonstrate bad security practices. And we'll need your help (yes, yours!) to clean up the ecosystem.
The 2018 Guide to Building Secure PHP Software
As the year 2018 approaches, technologists in general—and web developers in particular—must discard many of their old practices and beliefs about developing secure PHP applications. This is especially true for anyone who does not believe such a feat is even possible.
This guide should serve as a complement to the e-book, PHP: The Right Way, with a strong emphasis on security and not general PHP programmer topics (e.g. code style).
Assuring Ciphertext Integrity for Homomorphic Cryptosystems
When an encryption scheme is said to be homomorphic, what that means is that if you perform some mathematical operation on the ciphertext, you affect the plaintext in a useful way once it's decrypted.
While this sounds neat, there are three major problems with current homomorphic encryption designs:
- Performance: Homomorphic encryption is unbearably slow.
- Distinguishability: There is an underlying algebraic structure to ciphertexts encrypted with homomorphic schemes, unlike non-homomorphic encryption schemes, which produce ciphertext that look like random noise.
- Integrity: Homomorphic encryption is not impervious to chosen-ciphertext attacks.
While research into solving the performance and distinguishability problems of homomorphic encryption schemes is ongoing, there has been very little attention given towards preventing chosen-ciphertext attacks.
If you're interested in homomorphic encryption because you want to be able to search encrypted database fields in a web application you're developing, see the linked article instead.
Need Technology Consultants?
Will tomorrow bring costly and embarrassing data breaches? Or will it bring growth, success, and peace of mind?
Our team of technology consultants have extensive knowledge and experience with application security and web/application development.
We specialize in cryptography and secure PHP development.
Our Security Newsletters
Want the latest from Paragon Initiative Enterprises delivered straight to your inbox? We have two newsletters to choose from.
The first mails quarterly and often showcases our behind-the-scenes projects.
The other is unscheduled and gives you a direct feed into the findings of our open source security research initiatives.