Author's Latest Posts


Airbus A320 Recall: Rethinking Fault Testing In Aerospace


Fault injection is usually discussed in the context of security, where adversaries deliberately induce faults to bypass protections or extract sensitive information. In safety engineering, by contrast, faults are often treated as rare, random events driven by natural or environmental factors. The recent Airbus A320 recall is a good example of how a primarily safety incident can still benefit fr... » read more

How The Cyber Resilience Act Shifts Open-Source Responsibility To Vendors


The EU Cyber Resilience Act (CRA), adopted last year, aims to strengthen product security in several ways. One of its most ambitious goals is the elimination of exploitable vulnerabilities from digital products. Vendors are now obligated to identify vulnerabilities, resolve them before delivery, and continue addressing them throughout the product’s lifecycle. The scale of the challenge The ... » read more

How Security Regulation Can Help Grid Stability


Grid stability is at risk. The advent of Distributed Energy Resources (DERs), such as solar, wind, and batteries, has increased the attack surface of energy generation. While cities once had few power plants, they now host thousands of smaller, intermittent sources. These DERs are often managed by entities without uptime requirements. At the same time, traditional energy sources face greater de... » read more

Secure Implementation Of Post-Quantum Crypto In The Spotlight


The US-based NIST body takes a leading role in the migration to Post-Quantum Crypto (PQC). After a multi-year selection process, in 2022 they preliminarily identified a number of Post Quantum algorithms, which were recommended to replace the current public key algorithms (RSA, ECC). While the process of scrutiny is still ongoing, they now took another important step by putting emphasis on imple... » read more

Security Highlight: Ascon


The contest for standardization of a lightweight crypto (LWC) algorithm has just finished. US standards body NIST selected Ascon as the winner. Ascon is an algorithm proposed by an international team of scientists that delivers strong performance and security at a low cost. How does that work? Lightweight crypto is symmetric encryption technology, that runs well on constrained systems, lik... » read more

Security Highlight: Exploiting Persistent Faults In Crypto


At the most recent CHES workshop, Hossein Hadipour of the Graz University of Technology presented an important step forward in exploiting persistent faults in crypto. Differential Fault Analysis (DFA) is a well-known attack class that can lead to the compromise of a secret key when faults are injected during the execution of a cryptographic implementation. However, injecting transient fault... » read more

Security Highlight: Evil Never Sleeps


Recently, Apple introduced a useful but potentially dangerous feature to its iPhones. Most of us would assume that a phone becomes inactive when switched off by the user or due to low power. Surprisingly, newer phones continue limited functionality for several hours in low power mode or even if it is off. This includes cards in your Wallet and the Find My service. This feature caught the attent... » read more