The accepted talks for Real World Crypto 2026 are now online: rwc.iacr.org/2026/accepte... Thanks to everyone who submitted, and we look forward to the discussions at the symposium.

Using an age keyserver as a demo, this article demonstrates how to add a transparency log to a centralized service step-by-step. We use Tessera for the tlog, VRFs for privacy, and the Witness Network. It all takes just 500 lines to integrate! The result of years of work making tlogs accessible.

Here's something that Claude Opus 3.5 can just do without even running code on my machine. This is all the prompting I did. It figured out the charset restriction and replaced characters with look-alikes all by itself. Kicked it off an went back to writing the article I wanted to use this in.

If you want to help seed the Certificate Transparency archive (github.com/geomys/ct-ar...), there is now an RSS feed for your BitTorrent client! Don't forget to set unlimited seed ratio ✨ raw.githubusercontent.com/geomys/ct-ar...

What we are working on right now: blog.exe.dev/meet-exe.dev We all need more virtual machines. We keep building software to work around the fact that VM infrastructure is clunky. Let's have good VM infrastructure instead.

litestream-vfs is exciting. Besides being FUSE-free, it hooks into SQLite at a far more solid point than the original Litestream, and has an amazing new power:

When I talk about professionalizing open source maintenance, and about the Geomys Standard of Care, this is what it is about. The solution is not blanket legal liability, nor making demands of volunteers. The solution is relying on, and funding, professionals. forum.syncthing.net/t/does-anyon...

New blog post: Why the Sanitizer API is just `setHTML()` - https://frederikbraun.de/why-sethtml.html

I finished archiving most CT logs I could find, and filippo.io/sunlight@main can now read local or archived logs. However, I ran out of time before finishing the last couple logs, and before reconstructing missing logs from community datasets. If anyone wants a CT-related entry project, this is it!

How your email finds me

Alright, I have a PDS backup in GitHub. I have a PLC rotation key. I set up a $25/month donation (not required!), picked to match my masto.host bill. I am ready to migrate to the @selfhosted.social PDS and see what this decentralization is all about :) Y'all should notice... nothing!

The AT Protocol PLC Directory allows a higher-priority rotation key to revert a key change for 72h. But what good is that window if you don't know about a change? Well, here's an Atom feed generator of PLC operations for any handle/DID. at.geomys.org/plc/

github.com/geomys/ct-ar... now has a list of archived historical Certificate Transparency logs, and tools to archive logs going forward!

Serious Cryptography is the current default answer to “how do I learn cryptography engineering from a book?”

PSA: if you set up a GitHub Actions backup of your ATProto PDS using bsky-backup-template, you need to update the goat command location in backup․sh. Like this: github.com/FiloSottile/.... There is no good way for me to distribute updates, unfortunately.

This Bernstein crap drives me up the wall because IT MAKES NO SENSE. Why would the NSA be picking weak crypto to protect US NatSec?! They have mathematicians and clusters in China, too! Dual_EC_DRBG was a NOBUS backdoor. There is NOWHERE to hide a NOBUS backdoor in ML-KEM.

Wow, QUIC Retry Packets use AES-GCM with a fixed key/nonce, empty plaintext, and associated data prefixed with a secret as a sort of MAC. That's... terrifying? They essentially do MAC(K, v) = AES-GCM(key=const, nonce=const, plaintext=empty, aad=K||v). Does that actually hold?

since the "google is now training gemini on your email contents" thing keeps bumping around here: it's _not happening_. I say this not to defend google but because I know a lot of people that have broken their filtering and made their lives much more annoying from sheer misinformation.

In August I delivered my traditional Go Cryptography State of the Union talk at @gophercon.com in New York. It goes into everything at the intersection of Go and cryptography from the last year. (Also, bragging t-shirts!) Watch the video or read the transcript of my performance review!

So tempted to write a troll thread on how this incident shows Rust has bad error handling and wouldn’t have happened in Go, where we actually handle errors 🫣🫢😜 blog.cloudflare.com/18-november-...

MacWhisper just transcribed a video with Parakeet v3 at 66.2x realtime on my 2022 MacBook Air. I know technology gets better but... excuse me? 66.2x locally on a laptop!? For context, when I bought this laptop, OpenAI's Whisper didn't exist yet.

The IETF/CFRG HPKE post-quantum hybrid KEMs ended up specified over four documents. I found it difficult to chase down definitions, disambiguate overlapping terms, ignore irrelevant alternatives, and cut through abstraction layers, so I wrote a condensed spec. It's 235 lines. filippo.io/hpke-pq

The Italian equivalent of the IRS sent me one paragraph of text (to tell me my audit passed!). It arrived as an email with a .eml attachment which in turn has a .p7m attachment, which contains a .pdf file.

I gave an opening keynote at the FIDO Alliance’s “Authenticate” conference a few weeks ago! My goal was to explain, as clearly as I can, why passkeys are important and how we should use them to reduce the harm that passwords cause. [1/2] YouTube link: www.youtube.com/watch?v=otOb...

Just killed the most annoying bug. I was doing SELECT v FROM t WHERE k = ? and then UPDATE t SET v = ? WHERE k = ? AND v = ? and the UPDATE was not applying? Turns out I was storing nil → NULL, and then reading []byte(stmt.GetText("v")) → []byte(""). NULL and the empty BLOB don't compare equal.

Yes, the only real Go targets are linux/amd64 linux/arm64 darwin/arm64 windows/amd64 (“Things you should be very concerned about the crypto maintainer saying,” if you deploy to any others 😬)

As a final side-product of the new Go ML-DSA implementation, here is a set of messages that when signed cause a statistically representative distribution of rejections, allowing accurate benchmarking. github.com/C2SP/CCTV/tr... This is the same technique as words.filippo.io/rsa-keygen-b....

Ok, honest question: should I get a LinkedIn account and cross-post technical posts there, too? Are there actually useful professional conversations to be had, or people to be reached? (I don’t anticipate needing it for work, just asking how it is as an audience essentially.)

While implementing ML-DSA I found: - broken NIST test vectors groups.google.com/a/list.nist.... - a bug in a formally verified Rust library (!!) github.com/cryspen/libc... - missing test coverage in Wycheproof github.com/C2SP/wychepr... I'd like the TODO to start getting shorter instead of longer.

Sign44-8 494µ ± 74% Verify44-8 109µ ± 1% Keygen44-8 132µ ± 1% ± 74%... ah, right, ML-DSA signing does rejections (i.e. it tries again if the sig is not good a random no. of times). We'll need deterministic benchmark targets that reject a statistically avg. number of times, like for RSA keygen.

I had a bug in my new ML-DSA implementation that caused Verify to reject all signatures. I gave up after half an hour. On a whim, I threw Claude Code at it. Surprisingly (to me!) it one-shotted it in 5 minutes. A small case study of useful AI tasks that aren't generating code that requires review.

I am about to send a newsletter about how Claude Code debugged a very non-obvious issue in my new ML-DSA implementation. I trust everyone will be very normal about this, right?

Seeing AI turn my community first pro-copyright and now pro-defamation law is going to stick with me.

Aaaaaaaaa I found the bug that was causing ML-DSA signature generation to spin forever. Now I want to go back on the livestream recording to find how I generated the wrong constants. I blame Python.

So excited to finally share what we've been building at CUE Labs! Proud to be on this mission with @mpvl.io, @myitcv.io, @rog.bsky.social, @hylomorphism.bsky.social, and @dominikdm.bsky.social.

If I ever interact with the CFRG again or try to rely on it to get actually useful work done, somebody please slap me. I knew this. I managed to remember it for a year or so. And then. They are now re-re-re-re-litigating the invisible strings to hash with hybrid KEMs. age PQ is blocked on that.

New blog post: I'm Independently Verifying Go's Reproducible Builds: www.agwa.name/blog/post/ve...

This is the fantastic outcome of two decades of work by so many people. Firesheep used to be a thing! Your ISP used to know everything you did online! The web is so much safer than it was just 10 years ago. Especially happy that this will kill off invisible links to HTTP-to-HTTPS redirects.

Extremely happy to see Source Spotter, a Go Checksum Database monitor and Go toolchain reproducer by @agwa.name. These use the transparency logs we built into the Go supply chain to keep the Google-operated services honest.

I've added an appendix to my "Enough Polynomials and Linear Algebra to Implement Kyber" article with the little extra needed to implement Dilithium/ML-DSA. Maybe I'll stream an ML-DSA implementation tomorrow at www.twitch.tv/filosottile.

I got frustrated with how GitHub Actions lets workflows with read-only permissions poison the cache of read/write workflows (!!??!?), so yesterday night I put together an Action that runs commands in a gVisor sandbox.

As professional maintainers we can invest in making our projects safer and more reliable. To that end, here's a draft of the Geomys Standard of Care. It covers general maintenance, stability & reliability, dependency management, account and CI security, vulnerability handling, licensing, and more.

Serious take: the solution to Safe Browsing false positives like the Immich one is passkeys. Phishing regularly upends people's lives. The Safe Browsing cat-and-mouse with all its opaque false positives will be necessary until we roll out phishing-resistant auth.

This is a funny short story about contributing to internet standards in unexpected ways, like drawing ASCII art. Thanks to @filippo.abyssdomain.expert firstly for the work you do in cryptography and the opportunity to uniquely contribute to PQC :) Read more: sethmlarson.dev/drawing-an-a...

It's been 14 months since the ML-KEM spec was published. age still isn't PQ because it's waiting for trivial details of the HPKE hybrids to stabilize, but they are blocked on the CFRG. The TLS, SSHM, and LAMPS (X.509) IETF WGs are not waiting for CFRG. I just posted a plea for HPKE to do the same.

God, I am so tired of Bernstein. Every cryptography professional I know is ignoring him, but he's still managing to DoS important work by process objections and by leveraging his credibility with non-experts. TBH I'll remember this as an indictment of consensus-based specification venues.

To implement robust mitigations across Geomys, I did a survey of open source project compromises in 2024/2025. Three root causes dominate: phishing, control handoff, and unsafe GitHub Actions triggers. All three can be systematically avoided. words.filippo.io/compromise-s...

if the moderators were not applying discretion here a bunch of y'all who are yelling at and harassing Jay would be permanently gone. the issue with people being struck for ridiculing Kirk's death was not a trans specific thing, so let's not pretend it was.

I so want this to succeed. You’re telling me I can create an app and the whole persistence layer is owned by the user, and creates this immutable web of data that can be riffed on by other apps even when the original app is gone? I need to carve time out to build something in the atmosphere.