Security Cryptography Whatever

Afleveringen

1. Everybody Is Losing Their Minds About AI Math And Crypto

   27 oktober 2026 · 51 min

   Afspelen
   The gang talks about what AI getting Good At Math might mean for cryptography, and why public-key cryptography probably isn’t ending. David is on a mission to civilize and claims a crisis of empiricism. He also wrote a blog post about this. Everyone agrees Nadia deserves tokens. Lees meer

   “I mean, you could claim that anything's real if the only basis for believing in it is that nobody's proved it doesn't exist!”

   Transcript: https://securitycryptographywhatever.com/2026/10/27/everybody-is-losing-their-minds-about-ai-math-and-crypto/

   Chapters:

   00:00 intro
   05:19 rumors swirl
   12:37 math etiquette
   17:11 magical math machines
   21:42 diffie-hellman
   29:50 finite field
   34:45 david aware
   42:36 complexity theory
   48:40 full disclosure

   Links:

   - David’s Blog: https://dadrian.io/blog/posts/everybody-is-losing-their-minds/
   - Similar opinions from virgi: https://people.csail.mit.edu/virgi/thoughts.txt
   - The OpenAI Math Drop: https://github.com/openai/math
   - Scientific American on the OpenAI math drop: https://www.scientificamerican.com/article/openai-unleashes-hundreds-more-math-results-upon-a-field-already-in-shock/
   - Derek Thompson on AI’s impact on math: https://www.derekthompson.org/p/i-know-why-the-mathematicians-weep
   - Sophie Schmieg’s blog connecting elliptic curves and finite field DH: https://keymaterial.net/2025/05/23/there-is-no-diffie-hellman-but-elliptic-curve-diffie-hellman/
   - Friend of the show Steve Weiss factored RSA-896 with spare Anthropic capacity: https://saweis.net/posts/rsa-896.html
   - Alex Clemmer’s tweet about the shortcomings of complexity theory: https://x.com/hausdorff_space/status/2107916908616175701
   - Ben Recht (Berkeley ECE) on the FFT improvements showing how complexity theory can be disconnected from real computers:: https://www.argmin.net/p/faster-fourier-transforms
   - State of the art number field sieve implementation (CADO-NFS): https://cado-nfs.gitlabpages.inria.fr/
   - Why 128-bits of symmetric security is enough for quantum resistance: https://words.f…

2. AI Lattice Proofs with Chris Peikert

   27 augustus 2026 · 51 min

   Afspelen
   The robots are at it again, and this time they’re solving, and breaking(?), math and cryptography! Things have been happening in the lattice corner including new leapfrogging complexity results in the closest vector problem (CVP), AND a possible poly-time quantum attack against the dihedral coset problem (DCP) that made everyone freak out for about a week (UPDATE: looks like it’s busted: https://eprint.iacr.org/2026/1693). ALSO, there was an important distinguisher attack against Classic McEliece, which on its face doesn’t sound like a big deal, unless you’re familiar with the track record of efficient distinguishers in the history of code-based cryptography… 😱 Lees meer

   To help us make sense of all this we are joined again by OG friend of the pod Chris Peikert! We had trouble with his audio but tried our best to fix it, apologies.

   Transcript: https://securitycryptographywhatever.com/2026/08/26/ai-lattice-proofs-with-chris-peikert/

   Links:
   - https://openai.com/index/ten-advances-in-mathematics/
   - https://cdn.openai.com/pdf/ten-proofs-oai.pdf
   - https://x.com/ChrisPeikert/status/2083534770403750025
   - https://bsky.app/profile/chrispeikert.bsky.social/post/3msp3boueis2z
   - https://en.wikipedia.org/wiki/Boolean_satisfiability_problem
   - https://knowyourmeme.com/memes/wordcel-shape-rotator-mathcel
   - Chen 2024: https://eprint.iacr.org/2024/555
   - https://eprint.iacr.org/2026/1630
   - https://eprint.iacr.org/2026/1693
   - CVP within n^(1/2-ɛ) - : https://eprint.iacr.org/2026/1655

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

3. An Odyssey of Lattice Cryptography with Mark Schultz-Wu

   27 juli 2026 · 1 uur 17 min

   Afspelen
   We invited Mark Schultz-Wu on the podcast to talk about the history of lattice cryptography. When lattices are explained in plain english, they are actually quite simple! I don't think any of us have ever seen Deirdre so happy. If you're watching the video version, there's a section that's 6.1 minutes long with no cuts and consists just of Deirdre vigorously agreeing with what Mark is saying while smiling. What a time to be alive. Lees meer

   Anyway, we are hosting another happy hour in Vegas between Black Hat and DEF CON! It's sponsored by Teleport! Thank you to Teleport, and dear readers, you should go check them out. Check out our socials or the podcast site to register.

   Transcript: https://securitycryptographywhatever.com/2026/07/27/lattices-with-mark-schultz-wu/

   Links:

   Mark's IETF Post https://mailarchive.ietf.org/arch/msg/tls/HznE1IcCjstEjhh4M1p59qX1JlQ/

   NTRU https://en.wikipedia.org/wiki/NTRU

   The original lattices are hard paper https://www.scirp.org/reference/referencespapers?referenceid=3401227

   The original LWE for cryptography paper https://arxiv.org/abs/2401.03703

   Entropic LWE https://eprint.iacr.org/2020/119

   Dilithium round 3 submission: https://pq-crystals.org/dilithium/data/dilithium-specification-round3.pdf

   Recent attacks on Classic McEliece: https://eprint.iacr.org/2024/1694

   Lectures on post-quantum cryptography from Alfred Menezes (an originator of elliptic curve cryptography) https://www.youtube.com/@cryptography101-alfred

   Falcon https://csrc.nist.gov/csrc/media/Presentations/2024/falcon/images-media/prest-falcon-pqc2024.pdf

   Regev: https://cims.nyu.edu/~regev/#research

   Tightness in Proofs: https://eprint.iacr.org/2016/360.pdf

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

4. Trump's Golden Post-Quantum EO(s)

   2 juli 2026 · 57 min

   Afspelen
   The dear leader has actually bleated out some not-dumb executive orders (EOs) to accelerate adoption of post-quantum crypto for the US government! This looks to be in response to a flurry of advancements in quantum computing and quantum attack algorithms a few months ago. We cram legalize into our eyeballs— plus, ECDSA.fail! Lees meer

   Watch on YouTube: https://www.youtube.com/watch?v=7ZwQpN_F6P8

   Transcript: https://securitycryptographywhatever.com/2026/07/02/trumps-golden-post-quantum-eos

   Links:

   - The EO https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/
   - CNSA2 https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF
   - https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF
   - https://www.ecdsa.fail/
   - https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/
   - https://blog.cloudflare.com/post-quantum-roadmap/
   - https://blog.google/innovation-and-ai/technology/research/neutral-atom-quantum-computers/
   - https://en.wikipedia.org/wiki/FedRAMP
   - https://www.whitehouse.gov/presidential-actions/2026/06/ushering-in-the-next-frontier-of-quantum-innovation/
   - https://blog.trailofbits.com/2026/04/17/we-beat-googles-zero-knowledge-proof-of-quantum-cryptanalysis/
   - https://scottaaronson.blog/?p=9861

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

5. Facing the Vulnpocalypse with lcamtuf

   15 juni 2026 · 1 uur 11 min

   Afspelen
   We talk to Michał Zalewski (lcamtuf) about the vulnpocalypse and if we even need fuzzers anymore. This episode may be export controlled at a future date. Lees meer

   Watch on YouTube: https://www.youtube.com/watch?v=uI9CSgB4p9o

   Transcript: https://securitycryptographywhatever.com/2026/06/14/facing-the-vulnpocalypse-with-lcamtuf

   https://github.com/google/afl

   https://www.reddit.com/r/claude/comments/1tqtenf/anthropic_said_today_that_mythos_is_coming_to_all/

   https://github.com/google/clusterfuzz

   https://en.wikipedia.org/wiki/Jevons_paradox

   https://en.wikipedia.org/wiki/XZ_Utils_backdoor

   https://en.wikipedia.org/wiki/Brighton_hotel_bombing

   https://curl.se/

   https://ftp.openbsd.org/pub/OpenBSD/patches/7.8/common/025_sack.patch.sig

   https://www.wired.com/story/last-pass-vulnerability-password-safe/

   https://nostarch.com/tangledweb

   https://nostarch.com/silence.htm

   https://nostarch.com/practical-doomsday

   https://nostarch.com/secret-life-of-circuits

   https://www.youtube.com/c/3blue1brown

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

6. AI Finds Vulns You Can't With Nicholas Carlini

   26 maart 2026 · 1 uur 16 min

   Afspelen
   Returning champion Nicholas Carlini comes back to talk about using Claude for vulnerability research, and the current vulnpocalypse. It's all very high-brow stuff, and the gang learns some bitter lessons. Lees meer

   Watch on YouTube: https://www.youtube.com/watch?v=_IDbFLu9Ug8

   Transcript: https://securitycryptographywhatever.com/2026/03/25/ai-bug-finding/

   Links:

   - https://red.anthropic.com/2026/zero-days/
   - https://unpromptedcon.org/
   - Black-hat LLMs
   - https://red.anthropic.com/2026/firefox/

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

7. Standardizing Pure PQC

   10 maart 2026 · 8 min

   Afspelen
   Standardizing cryptography involves a lot of opinions. Luckily, the gamer presidents are on it. Come on, you all know the drill. Lees meer

   This is the last time I do this.

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

8. Python Cryptography Breaks Up with OpenSSL with Paul Kehrer and Alex Gaynor

   2 februari 2026 · 1 uur 13 min

   Afspelen
   The Python cryptography module, pyca/cryptography, has mostly been a sane wrapper around a pile of C, so that users get performant cryptography on the many, many platforms Python targets. Therefore its maintainers, Alex Gaynor and Paul Kehrer, have become intimately familiar with OpenSSL. Recently, they declared that after many years of trying to make it work, they announced pyca/cryptography would be moving away from OpenSSL when supporting new functionality and exploring adding other backends instead. We invited them on to tell us about what has happened to OpenSSL, even after the investments and improvements following Heartbleed. No guests on this pod represent anyone besides themselves. Lees meer

   Watch on YouTube: https://www.youtube.com/watch?v=dEKBHI3rodY

   Transcript: https://securitycryptographywhatever.com/2026/02/01/python-cryptography-breaks-up-with-openssl

   Links:
   - https://cryptography.io/en/latest/statements/state-of-openssl/
   - Py Cryptography: https://cryptography.io
   - https://archive.openssl-conference.org/2025/presentations/Alex_Gaynor_Paul_Kehrer_The_Python_Cryptographic_Authoritys_OpenSSL_Experience.pdf
   - https://securitycryptographywhatever.com/2025/08/16/alex-gaynor/
   - https://packages.gentoo.org/packages/media-libs/libsdl
   - https://www.youtube.com/watch?v=RUIguklWwx0
   - https://datatracker.ietf.org/doc/rfc9180/
   - https://docs.openssl.org/3.3/man3/OSSL_PARAM/
   - https://openssl.foundation/
   - https://github.com/openssl/openssl/issues/17064
   - https://www.feistyduck.com/newsletter/issue_132_openssl_performance_still_under_scrutiny
   - https://github.com/topazproject/topaz
   - https://github.com/actions/runner/issues/1069
   - https://crystalhotsauce.com/
   - https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467
   - https://en.wikipedia.org/wiki/Ship_of_Theseus
   - https://boringssl.googlesource.com/boringssl/+/aa202db1d7091b88b80f0a58c630c5c1aefc817d
   - https://www.ibm.com/products/open-sdk-for-rust-aix
   - https://dadrian.io/blog/posts/corporate-support-xz/
   - htt…

9. The IACR Can't Decrypt with Matt Bernhard

   31 december 2025 · 57 min

   Afspelen
   The International Association of Cryptologic Research held their regular election using secure voting software called Helios…and lost the keys to decrypt the results, leaving them with no choice but to throw out the vote and call a new election. Hilarity ensues. We welcome special guest Matt Bernhard who actually works on secure voting systems to explain which bits are homomorphically additive or not. Lees meer

   Watch on YouTube: https://www.youtube.com/watch?v=euw_yqAQFI8

   Transcript: https://securitycryptographywhatever.com/2025/12/30/iacr-helios

   Links:

   - NYT: https://www.nytimes.com/2025/11/21/world/cryptography-group-lost-election-results.html
   - IACR Memo: https://www.iacr.org/news/item/27138
   - https://www.iacr.org/elections/
   - https://vote.heliosvoting.org/faq
   - https://github.com/Election-Tech-Initiative/electionguard
   - https://www.usenix.org/legacy/events/sec08/tech/full_papers/adida/adida.pdf
   - https://www.iacr.org/elections/eVoting/about-helios.html
   - https://www.iacr.org/elections/eVoting/
   - https://crypto.ethz.ch/publications/files/CrGeSc97b.pdf
   - https://electionguard.vote/
   - https://eprint.iacr.org/2025/1901
   - https://freeandfair.us/blog/open-free-election-technology/
   - https://www.starvoting.org/
   - https://mbernhard.com/

   "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

10. Apple’s Memory Integrity Enforcement

    31 oktober 2025 · 57 min

    Afspelen
    Apple announced its new suite of memory security improvements from the top of the stack all the way to the bottom, so we dug through what they did and how they did it (performantly). Lees meer

    Watch on YouTube: https://www.youtube.com/watch?v=9FJwOI2PliU

    Transcript: https://securitycryptographywhatever.com/2025/10/31/apple-mie

    Links:

    - https://security.apple.com/blog/memory-integrity-enforcement/
    - Secure Page Table Monitor and Trusted Execution Monitor: https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/1/web/1#secd022396fb
    - https://security.apple.com/blog/towards-the-next-generation-of-xnu-memory-safety/
    - https://developer.apple.com/documentation/xcode/adopting-type-aware-memory-allocation
    - https://security.apple.com/blog/what-if-we-had-sockpuppet-in-ios16/
    - https://arxiv.org/pdf/2510.09272
    - https://googleprojectzero.blogspot.com/2023/11/first-handset-with-mte-on-market.html
    - https://developer.apple.com/documentation/xcode/adopting-type-aware-memory-allocation
    - https://arxiv.org/pdf/2510.09272
    - https://spectreattack.com/spectre.pdf

    "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

Alle 68 afleveringen →