Browser-based key-commitment demo — invisible salamanders, DGRW 2019. One AES-GCM ciphertext decrypts to two different plaintexts under two different keys, both tags valid. AEAD never promised a ciphertext maps to one key. Real GF(2^128) collision, accepted by WebCrypto's own verifier. No backends.
cryptography cryptanalysis aead aes-gcm galois-field webcrypto authenticated-encryption crypto-lab ghash message-franking key-commitment invisible-salamanders
-
Updated
Sep 3, 2026 - TypeScript