# Ruben A. Gonzalez

> Personal Website of Ruben A. Gonzalez. Cryptographer with a focus on implementation security.

This file is a plain-text summary of https://ruben-gonzalez.de/ for language models and other automated agents. It mirrors the content of the website's single page.

## About

- Name: Ruben A. Gonzalez
- Summary: Cryptographer with a focus on implementation security.
- Website: https://ruben-gonzalez.de/
- Affiliation: Security Researcher, Neodyme AG (email: ruben@neodyme.io, PGP key: https://ruben-gonzalez.de/ruben@neodyme.io.asc)
- Affiliation: Visiting Researcher, Max Planck Institute S&P (email: mail@ruben-gonzalez.de, PGP key: https://ruben-gonzalez.de/mail@ruben-gonzalez.de.asc)
- GitHub: https://github.com/rugo
- LinkedIn: https://www.linkedin.com/in/rugond

### Research Interests

- Cryptography Engineering
- Post-Quantum Cryptography
- Advanced Crypto Constructions and Protocols
- Vulnerability Research & Hacking

## Select Publications

- Formal Security Analysis of the Olvid Messenger (ACM Conference on Computer and Communications Security (CCS))
  - Authors: N Terzo, C Cremers, R Gonzalez, P Schwabe, Y Yarom, Z Zhang
  - pdf: https://eprint.iacr.org/2026/1622.pdf
- Stateless Hash-Based Signatures for Post-Quantum Security Keys (Applied Cryptography and Network Security Conference (ACNS SCI))
  - Authors: Ruben Gonzalez
  - blog: https://neodyme.io/en/blog/pqc-fido/
  - code: https://github.com/rugo/fido-sphincs-experiments
  - pdf: https://eprint.iacr.org/2025/298.pdf
- High-assurance zeroization (Transactions on Cryptographic Hardware and Embedded Systems)
  - Authors: R Gonzalez, S Arranz Olmos, G Barthe, B Grégoire, V Laporte, J Léchenet, T Oliveira, P Schwabe
  - code: https://github.com/rugo/chacha20-demo
  - pdf: https://eprint.iacr.org/2023/1713.pdf
- Rambox TLS Plaintext Recovery - CVE-2023-43972 (MITRE)
  - Authors: Ruben Gonzalez
- KEMTLS vs. Post-quantum TLS: Performance on Embedded Systems (SPACE Conference)
  - Authors: R Gonzalez, T Wiggers
  - code: https://github.com/rugo/wolfssl-kemtls-experiments
  - pdf: https://eprint.iacr.org/2022/1712.pdf
- Croc Full Plaintext Recovery - CVE-2021-31603 (MITRE/RedRocket Blog)
  - Authors: Ruben Gonzalez, Aaron Kaiser
  - blog: https://redrocket.club/posts/croc/
- How to Hack a Satellite (German) (P.M. Magazin)
  - Authors: P.M., Ruben Gonzalez
  - web: https://pm-wissen.com/technik/wie-hackt-man-einen-satelliten/
- Kyber - How does it work? The Inner Workings of the Post-Quantum KEM (Blog Post)
  - Authors: Ruben Gonzalez
  - blog: https://blog.ruben-gonzalez.de/posts/kyber/
- Reversing and Hacking Age of Empires 2: Definitive Edition (Microsoft/RedRocket Blog)
  - Authors: Ruben Gonzalez, F. Stotz
  - blog: https://redrocket.club/posts/age_of_empires/
- TinyDTLS Full Key Recovery - CVE-2021-34430 (NIST/Eclipse)
  - Authors: Ruben Gonzalez
  - web: https://nvd.nist.gov/vuln/detail/CVE-2021-34430
- Verifying Post-Quantum Signatures in 8 kB of RAM (PQCrypto Conference)
  - Authors: R Gonzalez, A Hülsing, M Kannwischer, J Krämer, T Lange, M Stöttinger, E Waitz, T Wiggers, Bo-Yin Yan
  - code: https://git.fslab.de/pqc/streaming-pq-sigs/
  - pdf: https://eprint.iacr.org/2021/662.pdf
  - slides: https://ruben-gonzalez.de/nist_pres.pdf
  - video: https://youtu.be/L2P4dtes52U
- BigBlueButton Local File Inclusion/Privilege Escalation - CVE-2020-12112 (MITRE/RedRocket Blog)
  - Authors: L. Schauer, Ruben Gonzalez
  - writeup: https://github.com/mclab-hbrs/BBB-POC/blob/master/writeups/LFI_CVE-2020-12443.md

## Trainings, Seminars and further Academic Work

- [Head Coach: National Hacking Team Germany](https://youtu.be/zTuemdp5jkw?si=0P167iDiN6-jXRtP&t=406): European Cyber Security Challenge
- [Hacking Cryptography](https://training.defcon.org/): DEFCON Trainings
- [Black Hat Cryptography](https://blackhat.com/trainings/): Black Hat Trainings
- [Cry.College](https://crycollege.ruben-gonzalez.de): Online Lecture on Modern Cryptography
- Cryptography in the Real World: devSec Conference
- Cryptography: Hacking and Cracking: Hack in the Box Conference
- Modern Authentication: Heise Academy
- Crypto Basics: Golem Karrierewelt
- [WebSecSeminar](https://websecseminar.github.io/): Research Seminar on Web Security: Bonn UAS
- HookFTW: A Windows Hooking Library: Master Project Supervision, Bonn UAS
- Syntax Aware Fuzzing For Indentifying Parser Differentials: Bachelor Thesis Supervision, Bonn UAS
- Reviewer: Paper on Improving Schindler Style Error Correction, CARDIS
- [Offensive Security](https://teach.redrocket.club): Online Lecture on Hacking Techniques: Bonn UAS
- Tutor for Lecture Operating Systems: Constance UAS

## Public Presentations (Selection)

- Hacking Corporations: A Defender's Guide: SecIT, Hannover
- Better Information Security Management in Hospitals: DMEA
- Post-Quantum Migration: BDEW Bundesverband der Energie- und Wasserwirtschaft/German Association of Energy and Water Supply
- Cyber Security for Judges and Prosecutors : Deutscher Juristentag/German Attorneys Association
- Web Application Security: Malta Information Technology Agency
- [Kyber and Post-Quantum Crypto - How does it work?](https://media.ccc.de/v/rc3-2021-cwtv-230-kyber-and-post-quantum): Chaos Communication Congress
- [Foundations of Modern Cryptography](https://www.cybersicherheit.fraunhofer.de/de/kursangebote/basics-it-sicherheit/grundlagen-der-it-sicherheit-kryptographie.html): Fraunhofer Academy Training.
- Laymen's Guide to Information Security : Fraunhofer Academy Training.
- Information Security for Endusers: German Farmers Day
- Supply Chain Attacks in Reality: SecIT Digital
- Curveball - Mircosoft's Crypto Screwup: Cooleleute.live.
- Real World Crypto in The Actual Real World: DS Lunch Colloquium, Radboud University.
- [How to Learn (and Teach) Hacking](https://www.youtube.com/watch?v=p6IC-7Nx3r4): OWASP AppSec.
- News On Error Correction Methods for SPA on Blinded Modular Exponentiation: JIL Hardware-Related Attacks Subgroup, Brussels
- AI, Heuristics and NP in Laymen's Terms: Datenburg
- [Hosting CTFs with Berlyne](https://media.ccc.de/v/froscon2017-1941-hosting_ctfs_with_berlyne): FrOSCon, 2017.

## Selection Of Interviews And Press Coverage

- [Spiegel Article about Car Hacking (German)](https://www.spiegel.de/netzwelt/gadgets/bmw-mercedes-porsche-krankenwagen-hacker-konnten-auf-kundendaten-und-autos-zugreifen-a-bcfe7b40-a365-4802-832d-c520c5a4b446): Spiegel
- [Gamestar Podcast about RedRocket and Game Hacking (German)](https://www.gamestar.de/artikel/podcast-aoe-2-cheat-hack,3372066.html): Gamestar
- [How to Hack a Satellite (German)](https://www.pm-wissen.com/wie-hackt-man-einen-satelliten/): PM Wissen
- [US Competition: Hackerteam of Bonn UAS Wins (German)](https://www.ksta.de/region/rhein-sieg-bonn/sankt-augustin/us-wettbewerb-hackerteam-der-hochschule-bonn-rhein-sieg-gewinnt-preis-37486952?cb=1633163057596): Cologne Messenger
- [Nobody hears you hack in space (German)](https://www.spiegel.de/netzwelt/web/hack-a-sat-hacker-wettbewerb-im-weltraum-a-fc848b4a-5f0f-4fce-8ca1-14968eff17ee): Der Spiegel
- [Competetive Hacking Team from Bonn (German)](https://ga.de/news/wissen-und-bildung/regional/sankt-augustiner-spueren-im-wettbewerb-it-sicherheitsluecken-auf_aid-53482371): Generalanzeiger Bonn
- [THIRD PLACE: FLUXREPEATROCKET AT HACK-A-SAT (German)](https://www.h-brs.de/de/inf/news/hack-sat): Press Release Bonn UAS
- [RedRocket Hacks at ProCTF in Abu Dhabi (German)](https://www.h-brs.de/de/inf/news/team-redrocket-hacken-beim-proctf-abu-dhabi): Bonn UAS Press Release
- [RedRocket Team finding Vulnerabilities (German)](https://www.ksta.de/region/rhein-sieg-bonn/red-rocket-team-hacker-gruppe-der-hochschule-bonn-rhein-sieg-sucht-sicherheitsluecken-32382012): Cologne Messenger
- [Sauercloud Qualifies for DEFCON CTF (German)](https://www.h-brs.de/de/inf/news/team-sauercloud-qualifiziert-sich-fuer-defcon-ctf): Bonn UAS Press Release
- [TV Report about RedRocket winning the CyberSecRumble (German)](https://wolke.redrocket.club/s/Yb46M3qwwfWgoA3): WDR Lokalzeit Bonn
- [Team RedRocket Rocks Cyber Security Rumble In Bonn (German)](https://www.h-brs.de/de/inf/news/redrockets-rocken-cyber-security-rumble-bonn): Bonn UAS Press Release

## Involved Projects

- Board Member - Nachwuchsförderung IT-Sicherheit e.V.
  - website: https://nfits.de/
- Chairman - RedRocket Hacking Club
  - website: https://redrocket.club/
- Co-Organizer - Cyber Security Rumble
  - website: https://cybersecurityrumble.de/
- Hackfest - Problem Based Learning Platform for Interactive Course Work
  - code: https://github.com/rugo/berlyne/tree/docker_compose
  - website: https://hackfest.redrocket.club/pages/
- Organizer - German Hacking Championship
  - website: https://hacking-meisterschaft.de/
- Edu25519 - Curve25519 Implementation Optimized For Readability
  - code: https://github.com/rugo/Edu25519
- Cry.College-Lib - Python Library implementing many crypto primitives.
  - code: https://github.com/cry-college/Cry.College
- eccfun - Python Library For Interactively Exploring Elliptic Curves
  - code: https://github.com/rugo/eccfun

## Hacking Challenges Authored

- BfLol (CyberSecurityRumble)
  - Category: Binary Exploitation, Brainfuck Interpreter PWNing, 300/500
  - challenge: https://github.com/redrocket-ctf/csr-2020-tasks/tree/master/03_P%F0%9F%92%80Spoopy/bflol
  - writeup: https://github.com/fab1ano/csr-20/tree/main/bflol
- Blow (CyberSecurityRumble)
  - Category: Crypto, Inavlid Curve Attack On Faulty JWT Usage, 500/500
  - challenge: https://github.com/redrocket-ctf/csr-2020-tasks/tree/master/05_2Spooky/blow
  - writeup: https://github.com/linnaea/csr2020_blow
- CyberWall (CyberSecurityRumble)
  - Category: Web, Code Injection, 100/500
  - challenge: https://github.com/redrocket-ctf/csr-2020-tasks/tree/master/01_Not%F0%9F%8E%83Spooky/cyberwall
  - writeup: https://cryptax.github.io/2020/10/30/cyberwall.html
- DLog (CyberSecurityRumble)
  - Category: Crypto, Invalid Point Submission Attack, 200/500
  - challenge: https://github.com/redrocket-ctf/csr-2020-tasks/tree/master/02_Sp00py%F0%9F%91%BB/dlog
  - writeup: https://a-kooli.me/post/cybersecurityrumble-ctf-2020-dlog/
- DTlS (CyberSecurityRumble)
  - Category: Crypto, Exploit Faulty DTLS Implementation, 400/500
  - challenge: https://github.com/redrocket-ctf/csr-2020-tasks/tree/master/04_Sp%F0%9F%85%BE%EF%B8%8F%F0%9F%85%BE%EF%B8%8Fky/dtls
- EzDSA (CyberSecurityRumble)
  - Category: Crypto, EcDSA Nonce Reuse Attack, 200/500
  - challenge: https://github.com/redrocket-ctf/csr-2020-tasks/tree/master/02_Sp00py%F0%9F%91%BB/ezdsa
  - writeup: https://github.com/thomasf0x/ctfwriteups/blob/master/CyberSecurityRumblectf/crypto/ezdsa/README.md
- Secure Secret Sharing (CyberSecurityRumble)
  - Category: Web, NoSQL Injection Attack, 300/500
  - challenge: https://github.com/redrocket-ctf/csr-2020-tasks/tree/master/03_P%F0%9F%92%80Spoopy/SecureSecretShare
  - writeup: https://ctftime.org/writeup/24766
- CityRSA (P.W.N. University CTF)
  - Category: Crypto, Exploit Faulty RSA-CRT Implementation, 300/500
  - writeup: https://github.com/ldruschk/ctf-writeups/blob/master/2018_pwnctf_cityrsa.md
- Converter (P.W.N. University CTF)
  - Category: Crypto, Exploit CBC Padding Oracle, 200/500
  - writeup: https://blog.pspaul.de/posts/pwn-ctf-2018-converter/
- H!pster Startup (P.W.N. University CTF)
  - Category: Web, ArangoDB Injection Attack, 300/500
  - writeup: https://0day.work/p-w-n-university-web-200-h-pster-startup-writeup/
- Whistle (P.W.N. University CTF)
  - Category: Crypto, Exploit Invalid Padding via Coppersmith Attack, 300/500
  - writeup: https://nars1st.tumblr.com/post/179527220982/whistle-crypto-250-220