Security

Test Data Compliance Boundary: Why Copying Real User Data Into Test Environments Is Already Illegal

Using real user data in test environments violates purpose limitation under PIPL and GDPR: testing is a brand-new processing purpose. The four legal alternatives (anonymization/synthetic/public test ranges/hand-made), how format-valid-but-random works (national checksum standards), and the red-line list. With checksum algorithm tables for CN IDs, phones, and credit codes.

PIPL PIA Self-Check: The Five Triggering Scenarios, Three Assessment Elements, and a Working Framework

China's Personal Information Protection Law (Articles 55-56) requires a prior Personal Information Protection Impact Assessment (PIA) for five categories of processing. This post covers the triggers, the statutory three-element report structure, the three-year retention requirement, and a data-map → risk-matrix → controls framework. With the MLPS/miping/PIA three-pillar relationship.

MLPS 2.0 (China's Cybersecurity Multi-Level Protection Scheme) Self-Check: GB/T 22239, Layer by Layer

A practical self-check framework before China's MLPS level-protection evaluation (dengbao ceping): the filing workflow, high-frequency items across the five technical and five management layers, level-2 vs. level-3 differences, how MLPS relates to the cryptographic assessment (miping), and a remediation order ranked by points-per-effort.

China Generative AI Filing Checklist: Algorithm Registration vs. Large-Model Launch Filing

Offering generative AI services to the public in China means passing two filings: the algorithm registration under the Deep Synthesis Provisions and the large-model launch filing under the Interim Measures for Generative AI Services. This post maps the trigger conditions, the materials framework, the corpus and security-assessment pain points, and a self-check order. Practical guidance; always defer to the latest CAC templates.

PGP Encryption Complete Guide: Protect Your Private Communications

Learn PGP / OpenPGP hybrid encryption, how to verify public-key fingerprints, and how a browser PGP-style tool differs from GnuPG mail interop.

SM3 vs SHA-256: Comparing the Chinese and NIST Hash Algorithms

SM3 versus SHA-256: same 256-bit digest strength, structural similarities (Merkle-Damgård), the standard test vectors for integration debugging, hardware acceleration differences, when Chinese compliance mandates SM3, and HMAC's algorithm-agnostic construction.

SM2 vs RSA: How to Choose Between Chinese and International Public-Key Crypto

SM2 versus RSA compared: security strength (256-bit SM2 ≈ 3072-bit RSA), performance (signing vs verification tradeoffs), key sizes, the C1C3C2/C1C2C3 ciphertext format pitfall, Chinese compliance requirements, and how to verify with an online SM2 tool.

Chinese National Cryptography (SM2/SM3/SM4/SM9/ZUC): A Developer's Introduction

Introduction to China's commercial cryptography: what SM2, SM3, SM4, SM9 and ZUC each do, how they map to RSA/SHA/AES, a selection decision tree, TLCP vs RFC 8998 boundaries, compliance drivers, and what browser tools can and cannot verify.

JWT Decoded Shows "signature invalid" / Verification Failed — Is That Normal?

JWT decoded but shows signature invalid or verification failed? Learn the difference between decode and verify, why it fails, and when you should just read the payload vs. actually verify.

TOTP Two-Factor Authentication Guide: otpauth URI, Algorithms, and Local Debugging

How RFC 6238 TOTP works: algorithms, digits, period, otpauth URIs, countdown windows, and debugging 2FA with a browser-local generator.

Password Strength Checker: Evaluate and Improve Passwords

Length, charset, weak-pattern penalties, and effective entropy: check passwords locally in the browser, then link to the generator and bcrypt storage.