In practical cryptography, failures often occur in the design—combining randomness, key management, operating modes, error handling, and authentication—rather than in the algorithms themselves. This post outlines criteria for auditing cryptographic implementations from the perspective of security assessors and reversers.
Representative Foreword
After the Code, the Structure Remains
The representative foreword of this blog: security now fails less at finding issues than at absorbing, sustaining, and acting on what has already been found.
This essay frames the entire site first. The posts on technical analysis, method, and governance all start from this same problem statement.
Detection, Method, Governance
🔥 A Mind That Dissects Systems
🔥 Trust and Culture Beyond Technology
🔥 Code That Fixes, Not Just Runs
From a Security Development Spec for Small LLMs to Regression Tests and Fuzzing Validation
This article explains how I split an XSS security development specification for small local models into core/verify/dev/test overlays, and what I learned while connecting LLM-based judgment to regression-test generation and Jazzer/Jazzer.js fuzzing seeds.
A Critical Reading of Structural Ethics in Cybersecurity Policy: Korea's 2025 Whole-of-Government Information Protection Plan
A reading of Korea’s 2025 whole-of-government information protection plan through the structural parallel between the Nightingale myth and the white-hacker discourse. Policy is moving from dependence on individual ethics toward structural accountability, but the transition is not complete.
The Moment AI Truly Becomes New: Not When It Finds the Answer, but When It Rewrites the Problem
Through the Nightingale myth, the white-hacker discourse, the Sterbenz lemma, and browser exploit reasoning, this essay argues that the real change LLMs bring lies not in knowledge retrieval but in problem reframing.
The Real Battleground of National AI Strategy Is Not Just GPU Count
The decisive front in national AI strategy is not GPU count alone, but who controls and can prove the flow of data, models, agents, permissions, logs, and verification running on top of those GPUs.
An Audit Workflow Survives Only When It Absorbs Misses — Eight Reinforcements to sec-audit-static v2.0
I designed sec-audit-static workflow v2.0, ran it against a real auth-server codebase, and missed two things. This is the record of how those misses were folded back into the tool — through v2.8.
Security Controls Aren't Lacking — They're Inconvenient: Why Security Needs Customer Context
Security controls already exist. The real problem is that we cannot decide which customer, at which moment, deserves how much friction. As the closing chapter of the CAPTCHA·ATO series, this post is about moving from quantity of controls to context of controls — adaptive security as an operational discipline.
Can the Market Move Governance?
Policy is not the only thing that creates change. Once external actors — insurers, customers, supply chains, evaluation services, security SaaS — start pricing the cost, governance eventually follows.
MCP Is Repeating the History of RPC Security
MCP security risks are not about prompt injection. They stem from the same configuration-to-execution escalation pattern that has plagued RPC, local security software, and CI/CD pipelines for decades.
How Do We Measure Adaptive Capability?
To move from compliance capability to adaptive capability, what do we measure? This post proposes MTTA, MTTP, MTRS, and a minimal execution template for the field.