Independent cybersecurity researcher in Tokyo, publishing as ba-cybersecurity.com.
Main line — web application firewalls. How OWASP CRS and managed WAFs produce false positives, and how to predict the effect of a configuration change before it is deployed. Prospective validation is in preparation. Meanwhile WAF Rule Watch tracks public WAF rule updates daily and is listed in Awesome-WAF.
Errors found in two IETF documents already approved for publication (SUIT, CRI) and in one individual draft (ASRA), each shown with a counterexample and answered by an author on the IETF list; flaws reported to widely used software and fixed; published cryptanalysis values improved or corrected.
| SUIT (IETF) | A firmware version condition for a final release also accepted its pre-releases. Hand-checkable counterexample; an author confirmed the error, and revision -17 (2 Nov 2026) changed the encoding. Code |
| CRI (IETF CoRE) | One reference could resolve to two different addresses: 3 mismatches with RFC 3986, with counterexamples and fixes. An author replied that the necessary corrections will be made. Code |
| ASPA and ASRA (IETF SIDROPS) | ASPA route-leak detection proved correct in Lean 4 for paths of any length; the proposed ASRA extension can mark a correct route Invalid. Counterexample and proved fix; the lead author replied that the algorithms will be re-checked. Code |
| FreeRADIUS | TEAP could accept a client without verifying any MAC. Reproduced and reported; fixed in source (v3.2.x), credited in the commit. |
| Langfuse | Any member, whatever their role, could invite users into the organization by naming a project of another organization. Reported; fixed and listed in the Hall of Fame on Langfuse's responsible-disclosure page. |
| ARADI (NSA cipher) | In CLAASP's model, the best six-round differential trail has weight 82, not the 84 that Table 4 of CLAASPing ARADI prints as optimal; lower bound from 945 DRAT-checked subproblems. Not an attack. Code |
| Ascon | Characteristics with fewer active S-boxes than the best published ones we found: 42 over 4 rounds (was 43), 68 over 5 (was 72). Not an attack. Code |
| ECDSA weak-key rule (CA/B Forum draft ballot) | The proposed rule rejects private scalars below 256 but accepts n − k and k⁻¹, recovered by the same search at the same cost. Keys derived from the eight eMudhra incident keys; Lean 4 proof. The drafter agreed they are as easy to attack but declined the change, citing no real-world cases. Code |
All results and their status: ba-cybersecurity.com/research
| What the Inbox Remembers: Receiver-Side Longitudinal Measurement of Email Authentication and Inbound TLS, 2005–2026 | Preprint, SSRN, October 2026 |
| Hidden to Whom? Invisible Text in Ordinary HTML Email and the Rules Against It | Preprint, Research Square, November 2026 |
| How Often Do Spam Filters' Hidden-Text Rules Flag Current Benign HTML Email? | Talk, IEICE Technical Committee on Internet Architecture (IA), 3 December 2026 |
| Japanese municipal websites: hosting and RPKI | Dataset, Zenodo, doi:10.5281/zenodo.23692415 |
| Cyber Defense Observatory | Daily radars built from public sources: breaches disclosed in Japan and the US, ransomware, WAF rule updates, PHP2Shell, web infrastructure. Data archive: ba-radar-data (CC BY 4.0) |
| What an AWS WAF log can and cannot tell you | Article |
| Exposed endpoint? Assess it. Don't scope it out. | Article |
| PHP's two critical RCEs (CVE-2026-109618, CVE-2026-109619) | What a WAF can and cannot do |
Research · ORCID 0009-0001-1445-3612 · Google Scholar · SSRN