We now know how the seeds of the NIST elliptic curves were generated: theyâre not the hash of some saucy sentence, but the output of drand48() seeded with the time, which was indeed in 1997â98.
In the tradition started by Colin Percival and Thomas Ptacek, a set of âCryptographic Right Answersâ updated for the accelerated post-quantum transition timeline.
I am publishing a production, pure-Python ML-DSA verifier. It's just 350 lines, and pretty readable and robust.
Passkey records are an interoperable format for WebAuthn credentials, similar to password hash strings. I propose a potential crypto/passkey Go API based on them.
We needed the insight and confidentiality to protect our users, but now that anyone can get the same results from LLM?
There is no need to update symmetric key sizes as part of the post-quantum transition, due to the details of how Grover's algorithm scales. Most authorities agree.
The risk that cryptographically-relevant quantum computers materialize within the next few years is now high enough to be dispositive, unfortunately.
I recommend turning Dependabot off and replacing it with a pair of scheduled GitHub Actions, one running govulncheck, and the other running CI against the latest version of your dependencies.
Code hosts like GitHub don't necessarily show the correct source of Go modules. pkg.geomys.dev is a new convenient viewer for module source.
In Go, go.mod acts as both manifest and lockfile. There is never a reason to look at go.sum.
We apply a transparency log to a centralized keyserver step-by-step, in less than 500 lines, with privacy protections, anti-poisoning, and witness cosigning.
I delivered my traditional Go Cryptography State of the Union talk at GopherCon US 2025 in New York. It goes into everything that happened at the intersection of Go and cryptography over the last year.
Surprisingly (to me) Claude Code debugged my new ML-DSA implementation faster than I would have, finding the non-obvious low-level issue that was making Verify fail.
Introducing the set of standards that Geomys maintainers strive to uphold in our professional activity as open source maintainers.
Project compromises have common root causes we can mitigate: phishing, control handoff, and unsafe GitHub Actions triggers.
Geomys sometimes acts as a maintainer of last resort for critical Go projects. Recently, we took over the bluemonday HTML sanitizer, and built upgrade paths for the gorilla/csrf library.
Cross-Site Request Forgery countermeasures can be greatly simplified using request metadata provided by modern browsers.
Test coverage of delicate Go cryptographic assembly through a new mutation testing framework.
Encrypting files with passkeys, using the WebAuthn prf extension and the TypeScript age implementation.
Maybe you, yes you, should run a Certificate Transparency log. Itâs cheaper, easier, and more important than ever.
RSA key generation is conceptually simple, but extremely tricky. Even benchmarking involves math: we generated a stable but representative âaverage caseâ instead of using the ordinary statistical approach.
My NAS is just one big initramfs containing a whole Alpine Linux system. Itâs delightful. Here's why and how.
Accumulated test vectors make it possible to run large sets of random known-answer tests without checking in large assets.
The FIPS compliance of HKDF is a somewhat confusing and controversial topic, partially because the normative reference is split over at least four separate documents, but in practice itâs approved for almost any purpose.
ML-KEM private key seeds are vastly preferable to expanded decapsulation keys as a storage format. A plea to standardize on them.
The age plugin system allows integrating third-party recipient types at the CLI level. A new framework makes it easy to implement plugins.
Announcing Geomys, a small firm of professional maintainers with a portfolio of critical Go projects.
XAES-256-GCM is a new AEAD extended-nonce algorithm designed for high-level APIs and FIPS 140 compliance.
A short document describing how I maintain open source projects. It talks about how I prefer issues to PRs, how I work in batches, and how I'm trigger-happy with bans. It's all about setting expectations.
Hardware secure elements make it possible to use low-entropy secrets like PINs for encryption.
filippo.io/mlkem768 is a pure-Go implementation of the post-quantum key exchange mechanism ML-KEM-768 optimized for correctness and readability.
How much linear algebra and polynomials do you need to know to implement Kyber? Turns out, very little!
Elliptic curves are standardized, instead of being generated like Diffie-Hellman parameters. There's good reasons!
Announcing a $12,288 bounty (tripled to charity) for cracking the five seeds selected by the NSA in the '90s for the NIST elliptic curve standard.
I want the extended-nonce 256-bit reduced-rounds XAES-256-GCM/11 AEAD. It has infinitely randomizable nonces, a comfortable margin of multi-user security, and nearly the same performance as AES-128-GCM. Only issue is that it doesnât exist.
A recent issue in scalar multiplication makes for a good case study of how unsafe interfaces, undocumented assumptions, and time lead to vulnerabilities.
Go 1.20 was a big release. Go 1.21 has some exciting API work on crypto/tls, and some follow-up work including crypto/rsa performance.
Protocols that use randomness should make it a deterministic function that takes a fixed-size string of random bytes, so it can be tested.
It works! I am now a full-time independent open-source maintainer. I'm announcing my first cohort of six clients, and sharing some details of how the model works.
I updated the whoami.filippo.io dataset! I explain how it works, and how I fetched the new data.
A lot of new cryptography is landing in Go 1.20, including the new crypto/ecdh package and math/big-less RSA and ECDSA backends!
A description of my password management solution based on passage, a fork of pass that uses age, and YubiKeys. Its main feature is resisting post-compromise exfiltration.
Go 1.20 is adding an interning cache for reused certificates. The entries are reference-counted with the help of the garbage collector and finalizers.
We look at how fuzzing should have caught the OpenSSL Punycode vulnerability, and why that code was even necessary in the first place.
Having a direct line to the maintainers of Open Source project is reciprocally valuable, and made possible by high-touch contractual relationships.
age currently only provides confidentiality. We look at how a couple small tweaks can introduce authentication, when you'd need it, and how it is different from signing.
My plans for Go 1.20 include landing the crypto/ecdh package, making progress on moving math/big out of the security perimeter, and a batch of crypto/tls work.
We look into a neat trick that allowed replacing the last bit of unreadable edwards25519 code, and learn about the structure and lineage of ECC implementations.
NIST selected a post-quantum cryptographic KEM. We look at how it works and how we can use it for file encryption with age.
To successfully fund Open Source projects, companies should: pay the maintainers; pay them real money; pay for maintenance; and keep paying them.
Open Source software runs the Internet, and by extension the economy. This is an undisputed fact about reality in 2021. And yet, the role of Open Source maintainer has failed to mature from a hobby into a proper profession.
This edition critiques cryptographic registries, advocating for fixed primitives in protocol design.
A common task in Go API design is returning a byte slice. In this post I will explore some old techniques and a new one. In particular, we'll see how the mid-stack inliner interacts with escape analysis to make it possible for the most natural API to be also the fastest.
@Benjojo12 and I are building an encryption tool that will support SSH keys as recipients. For Ed25519 keys that requires converting points between different elliptic curves. Let's see why and how.
Cryptography code could be understandable if only we commented it. This Poly1305 implementation is an attempt to prove it. It should be readable with just an idea of what MACs are for, a beginner level of Go, and high school math.