Hello, I am Laszlo

Cryptographic Signatures with a TPM

09/11/2026

In my previous post, I compared different signature algorithms listed primarily in RFC 9421, extended with MLDsa44. The focus of that comparison was performance rather than cryptographic strength. I ran the tests on multiple hardware configurations and operating systems, but performed the signing in software.

In this post, I use Windows and a TPM to sign data. The TPM protects the private key and performs the private key operation, while public key operations may be handled by the provider or operating system The test setup matches the previous tests as closely as possible.

Message sizes:

• A small message, roughly the size of a single JSON property value.
• A medium message, where the plaintext is roughly the size of a few properties (93 bytes).
• A 1 KB message.

Find out more »

Crypto Signatures

09/08/2026

In this post, I look at the different signature algorithms available to .NET developers. I am going to compare these algorithms from a performance point of view. However, I am not going to focus on their security strength.

Signature algorithms are used to provide integrity and authenticity for data. At the network level, a TLS connection provides encryption, but this is often not enough because some environments may terminate TLS connections. For example, load balancers and ingress proxies often terminate the TLS connection (and sometimes even downgrade the HTTP protocol version) before forwarding requests to the actual server instance. By signing each request or response message individually, a receiver can validate the signature of the sender. It can confirm that a message has not been tampered with and that it originates from the sender rather than from a man-in-the-middle attacker.

What it does not do:

• It does not protect against replay attacks by itself, unless a nonce, idempotency key, or timestamp is included in the signed data.
• Signatures do not encrypt the message. Anyone with access to the message can still read it. This means TLS is still required at the connection level.

Find out more »

SIMD Gather and Scatter Anagram

08/25/2026

Introduction

One of the most difficult problems with SIMD is handling non-contiguous memory access. To address this challenge AVX-512 adds gather and scatter instructions to load and store memory in an array at non-adjacent indexes. These instructions enable a whole new set of algorithms to be vectorized using SIMD operations.

Gather is a single instruction that loads data from non-adjacent indexes of an array into a Vector register. Scatter is a single instruction that stores data at non-adjacent indexes to an array from a Vector register.

Both instructions have a source/destination register parameter, a reference to an array parameter, and another vector parameter containing the indexes for each lane to be loaded or stored.

Find out more »

Using Prioritized Channel

08/01/2026

In .NET 9, a new UnboundedPrioritized channel type has been introduced to System.Threading.Channels. This feature has been available since version 8 of the Channel's NuGet package and is compatible with older .NET versions.

Channels provide thread-safe data structures for producer/consumer scenarios. In this pattern, one or more producers add items to a channel while one or more consumers read from it independently.

Two types of channels exist:

• Bounded channels: Have a maximum size limit with customizable behavior when full
• Unbounded channels: Have no size limit (beyond system memory constraints)

Find out more »

Input Parsing to Known Value

07/26/2026

A common task for Line of Business (LOB) applications is parsing an input string into an internal identifier. This blog post uses .NET 10 code samples. For simplicity, let's assume the inputs are non-malicious in terms of length, values, culture, etc.

Suppose you have a string input that needs to be parsed into one of the following enums:

public enum AccessLevel
{
    NONE,
    READONLY,
    READWRITE,
    CREATE,
    DELETE,
    MANAGE_USER,
    CONFIGURE_SYSTEM,
    FULL_CONTROL
}

I chose the enum names to be in uppercase ("shouting"). While this casing is not typical for C#, many applications define domain-specific terms in uppercase to match business terminology. If business analysts use uppercase names, the enums often follow suit.

Find out more »