Ralf-Philipp Weinmann

Ralf-Philipp Weinmann is a German security researcher and cryptographer whose work spans practical cryptanalysis of deployed ciphers and low-level security research into mobile and embedded systems, particularly cellular baseband firmware. He holds a Diplom and a Ph.D. from the Technical University of Darmstadt, completing his doctoral thesis, "Algebraic methods in block cipher cryptanalysis," in 2009. He later worked as a postdoctoral researcher at the Laboratory of Algorithms, Cryptology and Security (LACS) within the Faculty of Sciences, Technology and Communication at the University of Luxembourg.

Early cryptanalysis and Chaos Communication Congress talks

Weinmann became known in the hacker and security-research community through a series of Chaos Communication Congress (CCC) presentations. At 23C3 in 2006 he presented "Unlocking FileVault," an analysis of Apple's encrypted disk storage system, with Jacob Appelbaum; this work produced VileFault, an early tool for decrypting Mac OS X FileVault images. At 25C3 in 2008 he co-presented an analysis of the DECT (Digital Enhanced Cordless Telecommunications) standard cipher, later formalized in the peer-reviewed paper "Cryptanalysis of the DECT Standard Cipher" (FSE 2010, with Erik Tews and Karsten Nohl).

Baseband and mobile security research

Weinmann's most-cited research concerns the security of cellular baseband processors — the low-level subsystems that handle a phone's radio protocol stack. At 27C3 in 2010 he presented "The Baseband Apocalypse" (subtitled "all your baseband are belong to us") alongside a related talk, "The Hidden Nemesis," on backdooring embedded controllers. This line of research was later published as the peer-reviewed paper "Baseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stacks" (USENIX WOOT 2012). In 2012 he also co-authored the "iOS Hacker's Handbook" (Wiley), together with Charlie Miller, Dion Blazakis, Dino Dai Zovi, Stefan Esser, and Vincenzo Iozzo, contributing coverage of baseband and low-level exploitation techniques.

Comsecuris and later work

Weinmann is a co-founder and director of Comsecuris GmbH, a Krefeld, Germany-based security research and consulting firm specializing in reverse engineering, vulnerability discovery, and cryptographic assessment of mobile and embedded platforms, including system-on-chip designs, bootloaders, trusted execution environments, and real-time operating systems. Researchers publicly associated with Comsecuris include Nico Golde, Kevin Redon, and Daniel Komaromy.

His academic output also includes anonymity-network research — "TorScan" (ESORICS 2012) and "Trawling for Tor Hidden Services" (IEEE Symposium on Security and Privacy 2013), both with Alex Biryukov and Ivan Pustogarov — and applied cryptography, notably "Practical Cryptanalysis of ISO/IEC 9796-2 and EMV Signatures" (CRYPTO 2009, with Jean-Sébastien Coron, David Naccache, and Mehdi Tibouchi). He was also part of the team behind "A Systematic Analysis of the Juniper Dual EC Incident" (ACM CCS 2016) and the follow-up Communications of the ACM article "Where Did I Leave My Keys? Lessons from the Juniper Dual EC Incident" (2018), which examined the backdoored Dual_EC_DRBG-based VPN implementation found in Juniper firewalls.

No standalone encyclopedia article on Weinmann was located, and biographical details such as an exact birth date are not documented in publicly verifiable sources; this summary is drawn from his academic publication record, his company's website, and conference archives.

Timeline

• 2006Presented "Unlocking FileVault" at 23C3 with Jacob Appelbaum, an analysis of Apple's encrypted disk storage, producing the VileFault decryption tool.
• 2008Co-presented cryptanalysis of the DECT cordless-phone standard cipher at 25C3.
• 2009Completed Ph.D. thesis, "Algebraic methods in block cipher cryptanalysis," at TU Darmstadt.
• 2009Co-authored "Practical Cryptanalysis of ISO/IEC 9796-2 and EMV Signatures" at CRYPTO 2009.
• 2010Published "Cryptanalysis of the DECT Standard Cipher" at FSE 2010.
• 2010Co-authored "A Framework for Automated Architecture-Independent Gadget Search" at USENIX WOOT 2010.
• 2010Presented "The Baseband Apocalypse" and "The Hidden Nemesis" at 27C3, on cellular baseband and embedded-controller security.
• 2012Co-authored the "iOS Hacker's Handbook" (Wiley), covering iOS and baseband exploitation.
• 2012Published "Baseband Attacks: Remote Exploitation of Memory Corruptions in Cellular Protocol Stacks" at USENIX WOOT 2012.
• 2012Co-authored "TorScan: Tracing Long-Lived Connections and Differential Scanning Attacks" at ESORICS 2012.
• 2013Co-authored "Trawling for Tor Hidden Services: Detection, Measurement, Deanonymization" at IEEE Symposium on Security and Privacy.
• 2016Co-authored "A Systematic Analysis of the Juniper Dual EC Incident" at ACM CCS 2016.
• 2018Co-authored "Where Did I Leave My Keys? Lessons from the Juniper Dual EC Incident" in Communications of the ACM.