securitylab_nJuly 16, 2026🇷🇺Translated from Russian

DNA Origami Turns Secrets into Molecular Morse Code: Multi-Key Nano-Safe Resists Single-Party Attacks

Mathematics has protected banking operations, government communications, and personal correspondence for decades. Modern cryptography converts plain text into unreadable data without the correct key. However, growing computational power and the rise of quantum computers are driving the search for new methods of storing secrets. Chinese researchers have now proposed using DNA for this task.

Scientists created a multi-level encryption system based on DNA origami. Molecules assemble into tiny rectangular plates where the message is written using dots and dashes in Morse code. After encoding, the flat structure folds into a tube that physically hides the pattern. The data can only be read with the correct molecular key that unfolds the tube.

DNA has long attracted information-storage specialists. The molecule can hold enormous volumes of data, and its base sequence can be programmed with high precision. In biomolecular cryptography, protection relies not on conventional computer algorithms but on the properties of DNA, proteins, bacteria, and their reactions.

The researchers chose DNA origami for the new system. This method folds a long single-stranded molecule into a desired shape using hundreds of short helper strands called staple strands. Each staple binds to a specific region of the main molecule and forces it to bend at the right location.

The device is built from flat DNA rectangles. Researchers placed elements representing dots and dashes on their surfaces. Dots were created from small DNA loops resembling dumbbells. Dashes were formed through a chain hybridization reaction in which short molecules sequentially connect to create a long double-stranded track.

The arrangement of dots and dashes encoded letters according to a pre-defined table. After writing the message, scientists attached special locking strands to the edges of the rectangle. Complementary sections found each other, joined, and pulled the plate into a tube.

Once folded, the pattern was hidden inside the structure. A scanning instrument could no longer detect the positions of dots and dashes, so the contents remained concealed even with physical access to the sample.

All messages were divided into blocks of equal size. This ensured that the length and shape of the DNA construct did not reveal the number of characters or the structure of the original text. An observer saw identical tubes regardless of the data inside.

Decryption required a verification key, denoted Vk, consisting of six types of unlocking DNA strands. Their sequences matched the locking regions exactly and bound more strongly than the tube edges bound to each other.

Adding the key caused the locking connections to break apart and the tubular structure to unfold back into a flat rectangle. Reaction efficiency reached 99.7 percent. Folding took about eight hours, while the reverse process completed in several minutes.

The unfolded surface was examined using atomic force microscopy. The method does not use ordinary light; a thin probe scans the sample and records minute height changes, allowing the instrument to build images of objects only a few nanometers in size.

The resulting image clearly showed the dots and dashes. Researchers compared the pattern with the code table and reconstructed the original message. The full cycle was tested on the phrase “JUNE6 INVASION NORMANDY”.

Transitioning between flat and tubular forms provides 2,576 possible key variants. Without the correct set of unlocking strands, the structure does not unfold and the internal pattern remains inaccessible to scanning.

Protection operates on multiple levels. First, content is converted into a sequence of dots and dashes. The elements are then recorded on a DNA nanostructure. The surface folds to hide the pattern physically. Recovering the message requires both the correct molecular key and equipment capable of resolving the pattern on the unfolded plate.

The entire encryption and decryption process took approximately ten hours. Electronic systems perform similar operations far faster, so DNA origami is not yet suitable for everyday correspondence or real-time data transmission.

The main value of the experiment lies not in speed. The scientists demonstrated that DNA molecules can be programmed to perform several cryptographic operations: recording a message, changing the carrier’s shape, concealing data, and revealing it only after the correct key is added.

The DNA system remains a laboratory prototype requiring sophisticated equipment and lengthy chemical reactions. Nevertheless, the work shows that future information-protection tools may rely not only on mathematical algorithms but also on the physical properties of programmable molecules.

Related articles

HabrOther

OAuth Authorization Server Built Without Storing User Profiles

The article details the evolution of an OAuth Authorization Server that deliberately avoids storing user profiles, relying instead on external identity providers for authentication. It addresses three core constraints: hundreds of dynamically created isolated APIs, a public SPA client without a BFF, and the inability of resources to query the AS on every request. The design separates concerns so the AS handles only clients, tenants, grants, audiences, scopes, keys, sessions, and token issuance while the Main API owns profiles and roles. Tokens are managed securely inside a Service Worker using a custom FedCM grant, eliminating races across tabs and reducing XSS exposure. The approach minimizes blast radius, simplifies compliance, and keeps the AS replaceable without affecting product domain logic.

HabrOther

Why a 202-Character License Key Uses ECDSA P-256 Instead of Ed25519 or RSA

A developer building offline license verification for a .NET desktop application evaluated Ed25519, RSA, and ECDSA P-256 before selecting the last option. The decision was driven by the requirement for zero external dependencies, keys short enough for manual entry from email, and support for key rotation without breaking existing licenses. Although Ed25519 offers faster verification and a smaller public key, it is absent from System.Security.Cryptography in both .NET 8 and .NET 10, with API approval only targeted for version 11. RSA-2048 produces signatures too long for practical use, resulting in a 571-character Base32 string that users would find cumbersome. ECDSA P-256 with SHA-256 delivers a fixed 64-byte signature that becomes a manageable 202-character key when encoded in Base32, while remaining fully available in the runtime. The article also covers performance measurements, the risks of ECDSA nonce generation, and the deliberate choice of the IEEE P1363 signature format to guarantee fixed-length output.

HabrOther

Pilcrow Publishes Free Comprehensive Guide on Web Authentication

Author Pilcrow has released a detailed, ad-free handbook covering authentication and authorization practices for web applications. The resource draws on personal experience and includes practical examples in JavaScript and Go. It examines password-based methods, email verification, multi-factor authentication, passwordless flows, and passkeys while highlighting associated risks and usability trade-offs. The book also provides in-depth guidance on session management, token security, expiration policies, and email address handling as account identifiers. Recommendations emphasize choosing methods that match application security requirements and user expectations. Additional context is given on OWASP resources and community support channels.

HabrOther

redb 3.4.0 Adds Replay Checkpoints, Shared Runtime Layer and Declarative Secrets Handling for .NET Ecosystem

redb 3.4.0 delivers operational improvements for the .NET integration platform that includes typed storage over Postgres, MSSQL and SQLite, the redb.Route engine modeled after Apache Camel, the Tsak runtime with dashboard and clustering, and redb.Identity for OIDC and OAuth 2.1. The release focuses on post-deployment resilience with replay checkpoints that capture message state at named points inside routes, allowing safe re-execution of downstream steps without duplicating side effects. A shared runtime layer moves framework assemblies into a separate Libs/shared directory so that individual DLLs can be replaced without rebuilding or redeploying the entire Tsak or Identity packages. Secrets are now declared with a [Sensitive] attribute on endpoint options, ensuring URIs containing passwords or keys are sanitized before they reach logs, metrics or health checks. Additional controls include role-based access to management APIs, persistent audit trails and cryptographic signing of dynamically loaded modules. All Pro features remain free on the entire 3.x line with no licensing server required.