Verification of Safety-Critical Systems · Information Security

I work on the verification of safety-critical systems and on information security (M.Sc. in Computer Science & Engineering, TH Köln) and have published a refereed paper setting out a verification methodology for retrofitted anti-skid systems in European public transport. My work concerns the conditions under which a system can be trusted: the verification and validation of safety-critical systems, identity and access management, the hardening of enterprise infrastructure toward Zero Trust, and cryptographic architectures that make the integrity and authenticity of digital artifacts provable. I read these problems through the established assurance literature (functional-safety, software-verification, and security-evaluation standards), treating their methods as a shared vocabulary rather than a checklist. The orienting question across these domains is the same: under what conditions a system's claimed properties can be demonstrated rather than asserted.

A second commitment runs through this work: that engineering claims should be reproducible and independently checkable. I operate self-hosted, privacy-respecting infrastructure end to end and cryptographically sign the commits and tags I push to the repositories under this account, my email and the documents I issue. I treat reproducibility as a property of the engineering itself, and self-hosting as its consequence: the provenance and integrity of an artifact are only as trustworthy as the chain that produced and serves it.

The repositories below are work under this account, together with the upstream extension I contribute to: the repositories of the works listed under Publications, the conventions the other projects are built to, and archives of completed academic and engineering work, most of them student team projects, among them web platforms, a multi-tier Java desktop application, humanoid robotics, and cryptographic education. The archived projects are preserved as records rather than maintained as living tools, documented so that their methods and results remain legible after the work has closed.

• Ensuring Functional Equivalence in Retrofitted Anti-Skid Systems for European Public Transportation: A Hybrid Two-Layer Verification Methodology. Working Paper, refereed, Kölner Beiträge zur technischen Informatik, 2/2026. https://doi.org/10.57684/COS-1494 · URN urn:nbn:de:hbz:832-cos4-14942 · CC BY-NC-ND 4.0
• Design and Implementation of a Modular Architecture for the Transparent Integration of Containerized Execution Environments for Heterogeneous Open-Source Binaries in OneWare Studio. Master's thesis, Technische Hochschule Köln, 2026. https://doi.org/10.57683/EPUB-3597 · URN urn:nbn:de:hbz:832-epub4-35974 · CC BY 4.0
• Password- / Keyless authentication. Bachelor's thesis, Technische Hochschule Köln, 2021, published 2026. https://doi.org/10.57683/EPUB-3598 · URN urn:nbn:de:hbz:832-epub4-35985 · CC BY 4.0

All three are open access and listed with their DOIs and URNs on my ORCID record.

• anti-skid-verification: two-layer functional-equivalence verification for safety-critical FPGA rail retrofits; the repository of the paper listed under Publications.
• thesis-fentwums-container-extension: the repository of the Master's thesis listed under Publications, with its LaTeX sources, the version of record and the cross-platform evaluation apparatus for the container extension below, benchmarking synthesis, place-and-route and simulation across iCE40 and ECP5 with the upstream sources pinned as submodules.
• raven-one-simulink: educational cryptographic simulator tracing every RSA intermediate step, with a from-scratch MD5 engine (RFC 8017 / RFC 1321); the practical part of the Bachelor's thesis listed under Publications.

• FEntwumS.ContainerExtension: OneWare Studio plugin that runs FPGA toolchains such as GHDL, Yosys and nextpnr in containers (opt-in per tool, with a native-host fallback) and records the image digest of each run; the extension the Master's thesis evaluates, contributed to the FEntwumS project.

• template: the project template the repositories here are built to, with the meta-file family, licensing information as REUSE defines it, a tokenized README skeleton, one script that runs every check, and the CI, release and secret-scanning workflows.

• component-lending-system: PHP/MySQL lending platform for an embedded-systems lab, with tiered role-based access and stock recalculated by schema triggers.
• coupon-management: Django platform run against two storage engines, with a reproducible PostgreSQL/MongoDB benchmark.
• nao-ball-pickup: vision-guided ball detection and head tracking, with a fixed-pose pickup motion, for the SoftBank NAO 6 humanoid.
• warehouse-management-system: multi-tier Java Swing warehouse client over JPA/MySQL.

The documents I issue, my email, and the commits and tags I push to the repositories under this account are cryptographically signed, so a recipient can check their integrity and authenticity. Two independent mechanisms are used, each verifiable on its own.

Documents & email: official PDF documents and email are signed with an S/MIME certificate. A document signature is detached CMS (RFC 5652): it travels beside the document as DOCUMENT.p7s, never inside it, so a PDF reader shows no signature and none is expected. Checked offline with openssl cms -verify -binary -inform DER -content DOCUMENT -in DOCUMENT.p7s -purpose smimesign -CAfile chain.pem.

• Verify: offline with the command above. The S/MIME certificate is supplied on request to the email address under Contact.

• chain.pem: the certificate chain of the issuer in PEM, that is the root D-Trust SBR Root CA 1 2022 and the intermediate D-Trust SBR CA 1-22-1 2022. Both also travel inside each .p7s, and openssl pkcs7 -inform DER -in DOCUMENT.p7s -print_certs lists them; a root taken from there is trusted only after its SHA-256 fingerprint has been compared with an independent source.

• After expiry: the command checks the certificate at the current time, so it fails once the certificate has expired on 2027-06-21. To check a signature made before that date, add -attime followed by the time of signing in seconds since 1970-01-01 UTC.

• Certificate fingerprint: confirm the certificate for info@mtorun0x7cd.com (issued by D-Trust SBR CA 1-22-1 2022) against its SHA-256 fingerprint before trusting it:

  11:BC:CF:B3:93:93:06:17:E5:95:87:8A:00:B3:82:43:AC:76:13:00:3E:3A:76:0E:98:B2:AA:05:BF:AD:55:A5
  

Code: the commits and tags I push to the repositories under this account are signed with an SSH key; GitHub renders these as Verified. A change merged on github.com itself carries GitHub's own signature instead, and a fork under this account keeps the commits of its upstream authors.

• Signing-key fingerprint: the Ed25519 signing key is published at /users/mtorun0x7cd/ssh_signing_keys; confirm it against its SHA-256 fingerprint:

  SHA256:h0XIy0K+hRkQ921LjtoKu/jSPvvlP0r4BiAMuyEPIrI
  

• Verify: in a clone of this repository or of any repository of this account listed above, with curl, jq and Git, which checks SSH signatures since 2.34. The second command prints the fingerprint above; the third answers Good "git" signature and ends with 0 for a commit I pushed, or ends with 1 for a commit the key did not sign, such as a change merged on github.com. verify-tag checks a release tag the same way.

  curl -s https://api.github.com/users/mtorun0x7cd/ssh_signing_keys | jq -r '"* " + .[].key' > allowed_signers
  ssh-keygen -lf allowed_signers
  git -c gpg.ssh.allowedSignersFile=allowed_signers verify-commit HEAD

If you find my work valuable, you can support it:

• GitHub Sponsors: recurring or one-time support.

• Buy Me a Coffee: one-time or monthly contribution.

• Cryptocurrency:

  View Bitcoin (BTC) & Monero (XMR) Addresses

  
  

  Bitcoin (BTC):

  bc1qysjvx7h5dcrxvrzj6mpdrccs0qmescrkqrgzsm
  

  Monero (XMR):

  4397wSjVyk5C7LR2BB3xLUQZeE8M1UBEJhSZ9KRCryFU7HDBZXnSQZHeK4fTUL8FhFXF9cLcTrg9GiY5agqSF7DKKEj8bcP
  

Mert Torun, M.Sc.: Verification of Safety-Critical Systems · Information Security
mtorun0x7cd · Research & Development

• Website: mtorun0x7cd.com
• Email: info@mtorun0x7cd.com
• LinkedIn: linkedin.com/in/mtorun0x7cd
• ORCID: orcid.org/0009-0003-7932-9043
• GitHub: github.com/mtorun0x7cd
• Reddit: reddit.com/user/MTORUN0X7CD