TIL I cannot listen to @lcamtuf.coredump.cx at 3x speed. It's never bothered me with other voices I already know from conversation (including the hosts on @scwpod.bsky.social). But I had to slow everything down below 2x to get him out of the uncanny valley.

Is all software fucked bc LLMs are so good at finding bugs? Or are LLMs secretly this generation's fuzzers? We invited American Fuzzy Lop's creator and special guest @lcamtuf.coredump.cx on to debate the VuLnPoCaLyPsE www.youtube.com/watch?v=uI9C... securitycryptographywhatever.com/2026/06/14/f...

I wrote something: sockpuppet.org/blog/2026/03...

NEW EPISODE! The gang learns a bitter lesson about AI and bug finding! Returning champion Nicholas Carlini is back to talk about Claude for vulnerability research. securitycryptographywhatever.com/2026/03/25/a... www.youtube.com/watch?v=_IDb...

Extremely psyched about two upcoming SCW guests, one of them this week. We've got very crunch vulnerability research and cryptography stuff coming.

I finally reached the end. This was a super good episode and it gave me all the warm fuzzies about my internal reactions to getting started with Ossl3 for PQC. As a former windows NCrypt provider maintainer, I really thought all my “magic strings to throw at a generic API” was behind me 😭

obviously you have to do a string compare to load a nonce key in openssl 3

NEW EPISODE! The maintainers of py/cryptography declared that after many years of trying to make it work, they would be moving away from OpenSSL when supporting new functionality and exploring adding other backends: securitycryptographywhatever.com/2026/02/01/p... www.youtube.com/watch?v=dEKB...

Just recorded the premiere episode of Season VIII of Security Cryptography & W/evs, this time with Alex Gaynor and Paul Kehrer, who have a momentous announcement about pyca/cryptography and OpenSSL.

Threshold decryption.... I struggled with that one and still do. Obviously it's a point of fragility to allow one lost share to cancel the election. But true DKG with parties spread across the world is also not obviously easy to implement.

Yes, it's finite fields, in large part because implementing over elliptic curves, especially with proper hashing for NIZKs, was more complexity than I could handle. Would likely make sense to upgrade to EC at some point but also probably not a huge priority? Happy to hear counter arguments!

Yes, Helios definitely uses NIZKs to prove proper ballot form. Implemented in 2008 browser JavaScript, which was a fun challenge.

I abandoned mixnets in Helios v2+ in favor of homomorphic aggregation because of the operational complexity of mixnets. Explained in the 2009 paper: csrc.nist.gov/csrc/media/e...

Final SCW of 2025! We had Matt Bernhard on to talk about cryptographic voting systems, in the wake of the IACR election. (Everybody I voted for in the new election won! Woo!)

@scwpod.bsky.social did the impossible and converted me to a podcast gxrlie

NEW EPISODE! The IACR lost the keys to decrypt their encrypted election results. We welcome Matt Bernhard who works on secure voting systems to explain which Helios bits are homomorphically additive or not and more: securitycryptographywhatever.com/2025/12/30/i... www.youtube.com/watch?v=euw_...

NEW EPISODE! Apple did a new security thing for their latest phones with memory integrity enforcement, we did a deep a dive as we could given that we couldn't get anyone from Apple to come on our podcast 😭 podcasts.apple.com/us/podcast/a... open.spotify.com/episode/0DhC... youtu.be/9FJwOI2PliU

yw

I have just today discovered that podcasts can be chapterised, and that apparently @scwpod.bsky.social is painstakingly broken into chapters with often-joke names

Come for the PGP dunks, stay for the broader discussion of why encrypted email doesn’t make sense

NEW EPISODE! An OpenPGP.js bug gave us an excuse to tear encrypted email via PGP to shreds. William Woodruff joined us to explain the vuln & indulge our gnashing of teeth on why email was never meant to be encrypted: securitycryptographywhatever.com/2025/08/22/s... www.youtube.com/watch?v=IoL3...

The first part of this interview with my ex-colleague Alex is a great listen if you're a software engineer (or otherwise technical) and are interested in what we were working on as technologists at the Federal Trade Commission.

NEW EPISODE! We chat with friend of the pod and special guest Alex Gaynor, former deputy chief technologist at the FTC and all around good Security Person™. Join for nerdery about WebAuthn, stay for accidentally melting down GitHub APIs around November 2020! youtu.be/gBoGvyvsSi4

First round of invites going out tonight!

Transcript: securitycryptographywhatever.com/2025/07/29/v...

Come to SCWPodCon, sponsored by Teleport! securitycryptographywhatever.com/events/black...

New episode! Come to SCWPodCon, sponsored by Teleport! www.youtube.com/watch?v=tbnh...

New episode! Come to SCWPodCon, sponsored by Teleport! www.youtube.com/watch?v=tbnh...

pew pew pew www.youtube.com/watch?v=vtt8...

Signups are still open! Sponsored by Teleport!

We're throwing another SCWPodCon in Vegas! It's in the liminal space between BlackHat and DEF CON. Be there, or have FOMO. We'll provide the drinks, you provide the conversation. Sign up here: securitycryptographywhatever.com/events/black...

Should we throw another BlackHat party?

Wrote some words about memory safety and JITs. Basically, there are things we want out of hardware, but it's not MTE and it still involves migrating to memory safe languages dadrian.io/blog/posts/m...

Still have one more slot for a sponsor for our annual Vegas event, poke @dadrian.io if you have money.

NEW EPISODE! It seems like everyone that deploys E2EE encrypted cloud storage seems to mess it up, often in new and creative ways. Our special guests Matilda Backendal, Jonas Hofmann, & Kien Tuong Trong give us a tour & discuss how to actually build one securely: www.youtube.com/watch?v=sizL...

This one was super fun. We talked with Jonas Hofmann, Kien Tuong Trong, and Matilda Backendal about a cross-section study of "E2EE" secure storage (not messaging, storage). Backendal is working to formalize that problem (it wasn't already!) Fun bugs! securitycryptographywhatever.com/2025/05/19/e...

Our guest Nicholas Carlini and his coauthors just won Best Paper at Eurocrypt 2025: eprint.iacr.org/2024/1580.pdf

Migrating the US government to quantum-resistant cryptography is hard, luckily the gamer presidents are on it. This episode is very not safe for work, nor does it reflect the political opinions of, well, anybody. podcasts.apple.com/us/podcast/p... securitycryptographywhatever.com/2025/03/23/p...

I’ve been working on webauthn and passkeys on and off for > 1 year, and I can’t believe I missed this @scwpod.bsky.social with Adam Langley from Google, dating back to … 2022 🤯 If you’re interested in technical details about passkeys, it’s very good! securitycryptographywhatever.com/2022/08/11/p...

(limited time only)

Send us a voicemail. securitycryptographywhatever.com/voicemail/

Remembering 18F’s alum @konklone.com quote on the @scwpod.bsky.social podcast “If you want to see change in a large organization, you need to have someone around to pick up the phone” Having just started in a large organization at the time, that quote really stuck with me.

The SCW podcast team does it again and breaks down a newish, complex and alarming topic into palatable and informative pieces. Excellent questions from @durumcrustulum.com and @dadrian.io expertly answered by @josephhall.org and @matthewdgreen.bsky.social. Listen to it if you have time!

I was invited to an episode of Security, Cryptography, Whatever to talk about Apple encryption with Joe Hall. podcasts.apple.com/us/podcast/a...

Wow @durumcrustulum.com really not messing around with this one: the episode we recorded with @matthewdgreen.bsky.social and @josephhall.org about Apple pulling Advanced Data Protection from the UK, right here on SCW: securitycryptographywhatever.com/2025/02/24/a...

This is really important. And fun to watch @matthewdgreen.bsky.social and @josephhall.org explain this really important issue. Co-sign – the UK needs to stop weakening digital security for the whole world.

Podcast podcasts.apple.com/us/podcast/a...

Is the UK trying to block all end-to-end encryption on the Internet? Or are they just becoming increasingly irrelevant? We asked @matthewdgreen.bsky.social and Joe Hall to come on @scwpod.bsky.social to talk about it. youtu.be/LAn_yOGUkR0