flanfly

Yes, I'm a co-author of BoringPGP[1]. Sequoia itself will probably support it as soon as Marcus and I get around finishing the spec but it's not part of Sequoia and I only work on it in my free time.

1: https://github.com/boring-pgp/spec

Nettle implements most of the crypto needed for OpenPGP, it's small size and few dependencies makes it easy to wrap for Rust. I did review some, but not all of Nettle and it looks pretty solid[1]. GnuTLS uses Nettle, so you can expect there are people smarter than me trying to break it. Initially, I wanted to use Botan, but the fact that it's in C++ means you need to write two wrappers one from C++ to C and one from C to Rust.

1: I checked for proper RSA base blinding, a secure CPRNG, lack of Bleichenbacher Oracles and lack of invalid curve attack vectors. It uses GMP for bignum stuff so carry propagation bugs are unlikely. There are some things that aren't super nice. The CPRNG does not reseed on forks, the included AES doesn't look particularity time constant and the library doesn't use mlock() nor zeros secrets after use.

I only had a brief look at it but it seems that crypto_check doesn't verify whenever the signers public key is on the curve.

I not sure if I'm looking forward to a Renaissance of the 19th century <blink> tag.

Some years ago I started my day at 4 a.m. to exercise. While it worked, this kept me from having any social life outside from talking to coworkers. Getting a drink with friends in the afternoon is impossible if you want to keep this schedule, so I stopped. Being productive isn't everything in life. I'm only 30 but I doubt I will ever look back wishing I worked harder alone in my room instead of being with my friends.

Panopticon includes a simple disassembler framework. The basic idea is that you provide opcode patterns akin to regexp and write a function that emits mnemonics and code describing opcode semantics. There isn't much documentation, but you can take a look at the AVR and MOS 6502 disassemblers in lib/src/mos resp. lib/src/avr.

The README is a bit out of date. It support MOS 6502 and parts of x86_64 too. I currently writing the lifting code that translates x86 opcodes to a simpler intermediate language: https://github.com/flanfly/panopticon/blob/feature/rreil/lib...

Medusa: https://github.com/wisk/medusa

x64dbg: http://x64dbg.com/

Bindead: https://bitbucket.org/mihaila/bindead/overview

>Honestly, do we really need another static analysis tool?

Definitely. IDA Pro is proprietary software and the possibilities of IDAPython are limited. IDA Pro mostly ignores the last two decades of research done in the field of binary program analysis. It still relies on pattern matching compilers instead of using semantics driven methods that have been around for >10ys. While there exist tools like BAP, BitBlaze, Jackstab and Bindead. They are not really usable for people w/o graduate student level understanding of program analysis. This is where Panopticon fits in.

Btw, that guy isn't me.

Panopticon is libre software. You can improve it and use it as basis for your own research on program analysis.