RESEARCH
TPM 2.0 disk encryption bypassed, prompt injection planted in forensic evidence
Hardware is undermining software guarantees: TPM 2.0 disk encryption falls on Windows and Linux, power analysis recovers the SLH-DSA seed, a single Rowhammer bit-flip slows LLM inference. The second thread is trust in critical systems, from Estonia's internet voting to backdoors in cipher designs. Also notable: prompt injections planted in forensic evidence.
1. Active and Passive Attacks against TPM 2.0-based Full Disk Encryption
IACR Cryptology ePrint Archive · Sven Freud, Lennart Hein, Dominik Klein · Hardware & Side Channels
In short: TPM 2.0-based full-disk encryption can be bypassed on Windows with BitLocker and on every current Linux implementation.
The authors attack TPM 2.0-based full-disk encryption. On the SPI bus linking a discrete TPM they mount passive and active attacks: the chip resists tampering, the communication does not. A QEMU prototype also hits firmware TPMs through UEFI. The authors report breaking BitLocker and every current Linux implementation, including those using parameter encryption.
Why it matters. Many companies treat TPM-only BitLocker as enough for lost or stolen laptops. Against an attacker with physical access it is not, and a pre-boot PIN is again a setting worth reviewing.
For insurers. Many underwriting questionnaires accept disk encryption as a mitigation for lost or stolen devices. If it relies on the TPM alone, protection is weaker than assumed, so it is worth asking whether a pre-boot PIN is enabled.
2. Reverse Engineering IVXV: A Specification and Security Analysis of Estonia’s Internet Voting System
IACR Cryptology ePrint Archive · Tingfeng Yu, Thomas Haines · Cryptography
In short: The first public specification of Estonia's IVXV internet voting system is reconstructed, revealing numerous vulnerabilities in ballot privacy and verifiability.
IVXV, Estonia's internet voting system, has no public protocol specification. The authors reconstruct one from source code, documentation and configurations, model it in TLA+, and analyse verifiability, privacy, coercion resistance and eligibility. They find numerous new vulnerabilities, caused by inconsistent validation and unchecked cryptographic parameters.
Why it matters. It is a rare independent audit of a national voting system in production, with concrete mitigations. The method, rebuilding a formal specification when the vendor publishes none, can be replicated.
For insurers. The direct impact on the insurance market is limited and mainly concerns public bodies and election system vendors.
3. Prompt Injection Through Forensic Evidence: A Taxonomy and Proof of Concept of Anti-Forensic Attacks on LLM-Assisted Digital Investigations
arXiv · Frank Breitinger, Jan Gruber, Christopher Hargreaves, Jan-Niclas Hilgert et al. · AI & LLM Security
In short: Seized digital evidence can carry prompt injections that manipulate the LLMs used in forensic investigations.
In digital forensics the evidence is attacker-controlled by definition. The authors extend the anti-forensics model to manipulation of LLM reasoning and propose a taxonomy of attacks. Using only text planted on the seized device, they change a report's conclusion, write files to the analyst's workstation and trigger outbound network traffic.
Why it matters. Anyone using LLMs or agents in incident response must treat every piece of evidence as hostile input for the model too. The risk goes beyond a wrong report: it reaches actions run on the analyst's machine.
For insurers. Forensic investigations underpin cyber claims handling. If the LLM tools of incident response providers can be manipulated by the evidence itself, the incident reconstruction may be wrong: a question to put to panel providers.
4. SHAKEing SLH-DSA with Non-profiled SCAs
IACR Cryptology ePrint Archive · Rafael Carrera Rodriguez, Jad Zahreddine, André Monthieu, Aurélien Vasselle et al. · Hardware & Side Channels
In short: Correlation power analysis recovers the full SLH-DSA-SHAKE secret seed, allowing any signature to be forged.
SLH-DSA is the hash-based post-quantum signature scheme standardised by NIST. The authors study side-channel leakage of its pseudorandom function with SHAKE and propose a correlation power analysis attack on every parameter set. In simulation and on a 32-bit microcontroller it needs 280 to 559 signatures on average; the final exhaustive search takes 45 minutes on 72 cores.
Why it matters. SLH-DSA is often chosen as the conservative post-quantum option because it relies only on hash functions. Embedded implementations still need side-channel protection like any other.
For insurers. Relevant for insurers of hardware and embedded device makers adopting post-quantum signatures: an implementation without side-channel protection is a possible product defect. For the rest of the portfolio the link is indirect.
5. Verifiable Post-Quantum TLS Handshake: Recognizing Implementation Errors of Cryptographic Verification Steps
IACR Cryptology ePrint Archive · Runze Zhao, Siqi Lu, Yijian Liu, Zhaoxuan Li et al. · Post-Quantum Cryptography
In short: PQCD-TLS binds confirmation codes into key derivation, so a bug in post-quantum signature verification makes the handshake fail instead of going unnoticed.
A flaw in verification logic, as "goto fail" showed, can leave a system interoperable but insecure. The authors build confirmation codes for ML-DSA, Falcon, ML-KEM, HQC and DAWN and design PQCD-TLS, a handshake in which any verification error yields mismatched keys and a visible failure. Across 48 configurations, latency overhead stays below 1%.
Why it matters. Migrating to ML-DSA and ML-KEM brings new code into TLS, and with it verification bugs that are hard to spot. A mechanism that exposes them at almost no cost matters to anyone implementing or certifying TLS stacks.
For insurers. The insurance link is indirect for now: the paper is a reminder that in post-quantum migration the risk lies in the code implementing the algorithms, not only in the algorithms.
6. JANUS: Agentic Cross-Language Fuzzing Harness Generation for Android Native Libraries
arXiv · Xiangyu Zhang, Yucheng Su, Lingling Fan, Yinan Li et al. · AI for Security
In short: JANUS uses an LLM agent to generate fuzzing harnesses for Android native libraries across the JNI boundary and finds 6 unknown vulnerabilities.
Native C/C++ libraries linked to Android apps through JNI are an attack surface with a history of exploitation. JANUS uses an agent to resolve cross-language dependencies and assemble arguments for JNI methods. On 44 popular apps it produces over 5.9 times more valid harnesses than existing tools; on pre-installed apps from five vendors it finds 6 new vulnerabilities.
Why it matters. LLM agents extend fuzzing coverage where static analysis stops. Native libraries pre-installed by vendors remain an under-explored weak point in mobile security.
For insurers. A vulnerability in a library pre-installed by an Android vendor affects many devices at once: an example of accumulation risk tied to a single software component.
7. FVQKD: A Formal Verification of Quantum Key Distribution Security in Rocq
arXiv · Ruixuan Deng, Zhengfeng Ji, Jiayu Zhang, Li Zhou · Formal Methods & Verification
In short: FVQKD gives the first end-to-end formal verification in Rocq of BB84 quantum key distribution security and finds a missing branch in the published proof.
The security of quantum key distribution (QKD) rests on delicate proofs checked by hand. The authors present FVQKD, a Rocq library that machine-checks composable finite-key security for BB84, rebuilding the required tools from first principles. The work exposes conditions left unstated in the published argument, one of which reveals a missing proof branch.
Why it matters. QKD is moving into standardisation and commercial products, so the correctness of its proofs has practical consequences. The library is designed for reuse on other variants.
For insurers. The insurance link is limited: it is a formal methods result on a technology that is still niche.
8. Amplifying Latency and Cost of LLM Inference via Rowhammer Attack
arXiv · Mrityunjay Shukla, Shubham Roy, Biswabandan Panda · Hardware & Side Channels
In short: A single Rowhammer bit-flip in the Triton compiler persistently slows down LLM inference on NVIDIA and AMD GPUs.
LLVMhammer uses Rowhammer to flip a bit in CPU DRAM while Triton compiles GPU kernels. The resulting kernel works but runs less efficiently, and because Triton caches it on disk the effect persists. The Karnage tool finds exploitable locations. On four LLMs and NVIDIA and AMD GPUs latency rises by 4-16%; in some cases the attack also corrupts outputs.
Why it matters. Rowhammer moves from stealing secrets to silently sabotaging the cost and performance of inference services. The compiled kernel cache becomes an artefact whose integrity needs checking.
For insurers. For insurers of AI inference providers, the loss here is not data theft but a silent, persistent rise in operating costs, hard to attribute to an attack and therefore to prove in a claim.
9. SoK: Design-Level Backdoors in Block Ciphers Constructions, Detection, and Key Recovery
IACR Cryptology ePrint Archive · Shah Fahd · Cryptography
In short: A SoK on backdoors hidden in block cipher designs gives an algorithm to detect them from S-boxes and attacks KG-DES, BEA-1 and LowMC-M.
A design-level backdoor exploits trust in a cipher that passes standard tests. The author brings the four published backdoors into one taxonomy and gives an algorithm that recovers partition trapdoors from S-boxes with no false positives. In KG-DES the 56-bit key falls in minutes. LowMC-M's backdoor, in the linear layers, leaves no trace detectable on the primitive.
Why it matters. The work gives concrete tools to anyone assessing third-party ciphers, for example proprietary or national ones. LowMC-M is a reminder that some backdoors do not show up in tests.
For insurers. The insurance link is indirect: it concerns products using proprietary or little-studied ciphers, where a design backdoor would escape the usual checks.
10. PQ-Vault: Provably Quantum-Safe Asset Custody for Unmodified Ethereum
arXiv · Hassan Khodaiemehr, Khadijeh Bagheri, Chen Feng · Blockchain & DeFi
In short: PQ-Vault shields Ethereum funds from quantum computers without changing the protocol and proves that bridges and sidechains alone are not enough.
A quantum computer could recover the key of any Ethereum account whose public key is on chain. The authors prove that no sidechain or bridge is enough: funds must move into a contract using only quantum-safe primitives. PQ-Vault pairs it with a proof-of-stake sidechain. With classical parameters, certificate security drops from 128 to about 60 bits.
Why it matters. Post-quantum migration of blockchains is an open problem with a lot of value at stake. The impossibility result clarifies what cannot work.
For insurers. For insurers of digital asset custodians and exchanges, quantum risk on already exposed public keys is a potentially very large accumulation scenario. It remains a long-term risk, not an immediate one.
How this digest is made
New papers are collected every day and selected every week from arXiv, the IACR ePrint archive and the main security conferences and journals (IEEE S&P, USENIX Security, ACM CCS, NDSS, CRYPTO, PoPETs, IEEE TIFS and others). A score based on source, topic and early signals picks the candidates; an AI model assesses them and writes the summaries. Summaries are based on the abstracts: the original paper is the reference for details.
New papers assessed for this edition: 132.