Bernstein's main achievements, by decade: 1990s: Bernstein v. United States 2000s: ChaCha20, Poly1305, Curve25519, Ed25519 2010s: SPHINCS 2020s: sabotaging the post-quantum transition This is so f***ing frustrating. And sad. But mostly frustrating.

securitycryptographywhatever.com/2026/03/25/a... is very very good. If you read my vulnerabilities post, this podcast episode is much more worth listening to.

We know vulnerability reports are not like ordinary issues. But why? It comes down to needing the scarce insight and temporary confidentiality to protect users. However, now that LLMs can find more or less the same bugs for everyone, none of that matters, and vuln reports are not special anymore.

There we go. US Gov tightens post-quantum cryptography transition deadlines for high-value systems to 2030 for key exchange and 2031 for signatures. Also, speeding up the CMVP (FIPS 140 validation) processes. That’s how you know the rush is real. The quantum computers are (potentially) coming.

Nuclear opinion: I don’t care if you use AI to write code,¹ but making a human review a change before an LLM is disrespectful. Why am I catching your bugs if a computer could have done it? It’s like asking to review code that doesn’t compile or pass CI. ¹ As long as you do it responsibly.

In 2020, OpenSSL had a vuln related to the signature_algorithms_cert ext. openssl-library.org/news/secadv/... Palo Alto apparently "solved" this in their IPS by blocking connections with "unknown" algs in sigalg_cert. Six years later, we can't add ML-DSA to sigalg_cert in Go. sigalg_cert is dead.

"but where are all the bluesky instances?" i've heard this so many times that i wrote an explainer

Cryptography is changing faster than ever - and Go is evolving with it. 🔐 Join @filippo.abyssdomain.expert for a State of the Union on Go cryptography, post-quantum readiness, new crypto packages, and the work happening behind the scenes to keep Go applications secure. 🚀 🎟️ gophercon.com #golang

I had this one sitting in my draft queue before I went on vacation, and forgot to hit publish. I hope nobody starved. So please enjoy my rant on hybrid signatures. https://keymaterial.net/2026/06/18/on-hybrid-signatures/

I released Graviola 0.4.0 yesterday, with a new and quite quick ML-KEM-768 implementation. More perf work to do on this, but it is already quicker than libcrux-ml-kem, and competitive with mlkem-native on ARM64. And still builds mega fast! Consider supporting this work on github.com/sponsors/ctz

I am trying to transfer from an iPhone 17e to a clearly superior iPhone 13 mini. However, the 13 is on iOS 26.5 while the 17e is on iOS 26.5.1, which is a 17-only bugfix release, so the transfer flow fails silently. I think the only solution is flashing iOS 26.6 beta 2. This is so stupid.

It's Friday! What better way to start your weekend than applying to RC? The application takes about an hour, but the community will stay with you for so much longer. The Summer 2 batch starts June 29th, and the window's closing soon. Apply below:

The state of extensions security may be my greatest professional regret. The antivax-like backlash and disinformation regarding MV3 was shockingly effective. I worry that the many years of hostility and delays have killed any appetite for the broader security work that MV3 was designed to enable.

That is completely false. The declarative block is applied in-process at the resource load, but without the Rube Goldberg mess of the old webRequest API that added multiple process hops, JS execution, and a giant hole in the same origin policy. It is literally a more robust block than the old API.

Clickbait title: uBlock Origin is officially dead for Chrome Mastodon dude: Whatever they say about "loving the Web", the Chrome team will choose Google's ad business over everything else Me: uses uBlock Origin Lite to securely block all ads on Chrome I wish reality still mattered to discussions.

I'm impressed with Apple's Private Cloud Compute and its extension to Google Cloud. Servers with a verified boot chain, attesting to their verified status to clients. Stateless computation. Hardened supply chain. This is a massive investment in privacy. security.apple.com/blog/expandi...

There's been some confusion around BRs non-compliant X.509 chains that OpenSSL accepts but Go rejects. We're not going to introduce complexity in crypto/x509 for them, but I realized you could re-encode the issuer as an unsigned root to work around it. So I made a little web tool to make it easy.

A few weeks ago I realized our websites accidentally disabled post-quantum key exchange because our haproxy had an old version of the modern ssl-config.mozilla.org config. Imagine how long it will take for everyone to realize this and fix their configs. This is not a scalable way of doing things...

Ugh, apparently neither @github.com, nor @fastmail.com, nor @slack.engineering support post-quantum TLS key exchanges, making everything sent and received over these connections vulnerable to harvest-now-decrypt-later attacks, maybe as early as 2029.

We've upgraded the Tuscolo CT log to Debian Trixie. Took 3m of downtime. Tuscolo is a single machine and currently has better uptime than multiple distributed high-availability CT logs. "One big, good box" is a terribly underestimated architecture.

The list at www.secretservice.gov/prohibitedit... is all generic stuff you'd expect and then - Flipper Zero - Pineapple Wi-Fi router - Raspberry-Pi enabled devices Huh.

I’m annoyed by people blaming every issue on “vibecoding” but I don’t know how else to explain the free fall in quality of WhatsApp Desktop on macOS. Every week it has a different UI or performance issue. It just froze my laptop allocating 81 GB. I’m having to downgrade it to a Chrome tab.

I wanted to query a locate(1) database of my NAS from my laptop. plocate is much faster than the alternatives, but it doesn't compile for macOS. So I just... had Claude make me a Go implementation, with the extra benefits of being memory safe and having tests. Still getting used to this new world.

Can you see how to use a test vector that provides (seed, public key, message, µ, signature) to test a deterministic signing API that does (seed, message) → (signature) or a key generation API that does (seed) → (public key)? Cryptographer D. J. Bernstein can't, certainly in good faith. *sigh*

I will never understand iCloud eviction logic, and I wonder if any product manager ever thought about. My iPad stores 11 GB of Photos, but evicts all my 10 MB of Books all the time. Today I created a file in Downloads, and then went to open it from another app 30s later, and it had been evicted?!?!

I am live with Alex Gaynor to talk about the Geomys model of professional open source maintenance and how it helps projects face challenges, like the recent influx of LLM vulnerability findings! Join us live on www.twitch.tv/filosottile right now or catch the recording soon!

This might be what vexes me most of the unforced GitHub Actions minefield. Commenting on PRs is PUBLIC. Any registered account can do it without permissions!! And yet if you want an automation to comment, you’re encouraged to run it as a privileged, dangerous pull_request_target job.

"Why don't you just add a setting to do X? It's easy!" Ten years of settings later: github.com/golang/go/is...

“Expose memory safe languages on the network and use real sandboxes or VMs for security boundaries” is—so far—weathering the storm. Honestly curious if it will hold.

Have we already moved on from the fact that the infrastructure we entrusted with basically all software supply chain security had a staggeringly simple unmitigated RCE two weeks ago? Did GitHub publish a longer post-mortem with deep root cause analysis and long-term mitigations? Will they?

I am not enjoying my October survey having so much predictive value. The TanStack compromise was pull_request_target + not there being such a thing as a read-only or isolated GitHub Actions workflow. These are unforced shortcomings of GitHub Actions! words.filippo.io/compromise-s...

I truly can’t get over the fact that we chose YAML-interpolated shell scripts as the default CI programming language. It’s so bad that we forgot how to handle untrusted inputs! (pull_request_target and issue_comment triggers should not be that unsafe! It’s just attacker controlled input.)

Someone should make a reverse DNSSEC test that checks if your resolver validates, and if not shows a reassuring “you have good mitigations against DNSSEC misconfigurations.” Anyway, Quad9 has unsecured versions of their UDP and DoH resolvers, which is what I use: quad9.net/service/serv...

I'm working to aggregate some common questions about #passkeys, both from non-technical and technical perspectives. These will be used in an end user facing site in the future. Any and all feedback is welcome. forms.gle/wmaydkzmUp2e... (also would appreciate some reposts to widen the audience)

I continue to be so confused by people not liking passkeys. I love the UX, such an improvement. Do y'all have a magical password manager that works without 15 taps in mobile apps? Or are you self-defeating by not using the built-in (Chrome or iCloud) authenticator? Is this a Linux desktop issue?

Copy Fail? Also looks like memory safety, but is actually complexity. xint.io/blog/copy-fa... I am going to link to this while rejecting changes to Go crypto for years. Anyway, feeling pretty validated in my "ssh in as root, only gVisor or Firecracker are an actual security boundary" approach.

… are fucking kidding me. A github.com cross-account RCE due to the most pedestrian of injection attacks along the obvious exposed surface… and they actually have a globally shared “git” UNIX user!! This is not what taking the role of supply chain stewards seriously looks like.

Today I renamed a type in the exported API of one of my packages by writing this short diff. Then I ran “go fix”, and it updated my code. Of course, IDEs have rename. But with the type alias, all dependencies keep working. And users can run “go fix” to update their code too! go.dev/blog/gofix

Looks like GitHub silently corrupted some index. PR #237 definitely exists and is closed (github.com/C2SP/C2SP/pu...) but is just... not in the list (github.com/C2SP/C2SP/pu...) regardless of filters. I briefly doubted my own sanity. This is bad.

Damn, that felt good.

A bit over two years after starting to work on it... Go is officially FIPS 140-3 certified 💥 csrc.nist.gov/projects/cry... I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

I think it's important to triage failed predictions and I was wrong about this one. It looks like it's more organizational dysfunction and neglect than the "embrace, extend, extinguish" I was told to be worried about but the acquisition did not work out well for GitHub. xcancel.com/FiloSottile/...

Serving a Bluesky “For You” feed with one Go binary on a home PC: SQLite (419GB) as primary store, heavy in-process LRU cache, OVH VPS + Nginx proxy/dispatch over Tailscale. ~72K daily users (15–25 QPS) plus Parquet logs + DuckDB analytics.

How much storage / bandwidth / CPU / memory does it take to run a production Sunlight CT log? Surprisingly little! There's now a public stats page, pulled every 5m from our Tuscolo prod metrics. stats.sunlight.geomys.org Less than 2 cores, 300 MB of memory, ~250 Mbps of bandwidth, 260 GiB of SSD.

Hey, if you think you're justified in being an anti-social ass to Why, could you block me? It's ok, no need to discuss it. I'm not looking for a fight and we're not going to converge. I know you think you are justified by that very good reason. Good for you.

NIST is updating SP 800-133, which details the "FIPS approved" ways to generate keys. There's a lot of good news in it, it approves a lot of stuff we were doing, like X-Wing seed derivation and c2sp.org/det-keygen. Here are my comments: leaflet.pub/f6fc0b3b-161...

With growing focus on the threat quantum computing poses to crucial and widely used forms of encryption, @filippo.abyssdomain.expert wants to make one thing clear: Contrary to popular mythology that refuses to die, AES 128 is perfectly fine in a post-quantum world arstechnica.com/security/202...

There are no technical or compliance reasons to double the size of symmetric keys in response to the threat of quantum computers. This common misunderstanding of Grover's algorithm risks wasting limited resources that should go towards deploying actually urgent post-quantum algorithms.

It's April 2026, 1 year 8 months since FIPS 204. The IETF TLS WG is busy debating the concept of ML-DSA hybrids, and whether they should be composite, concatenated, or separate. The complexity of hybrid auth is, however, firmly denied. In the distance, sounds of a pure ML-DSA PKI being built.