Skip to content
Sign in
Artwork for Security Cryptography Whatever
TechnologyScienceMathematicsNewsTech NewsExplicit

Security Cryptography Whatever

Deirdre Connolly, Thomas Ptacek, David Adrian

Some cryptography & security people talk about security, cryptography, and whatever else is happening.

Play
Open in
  • 21 episodes
  • Avg 1 hr 1 min
  • English

Episodes 21

NewestOldestLongest
All20Unplayed20In progress0Played0
Counted on this page — what you have heard stays on this device, so it is not something the list can be paged by.
  • S6 · E1
    Wednesday · 50 min

    AI Lattice Proofs with Chris Peikert

    The robots are at it again, and this time they’re solving, and breaking(?), math and cryptography! Things have been happening in the lattice corner including new leapfrogging complexity results in the closest vector problem (CVP), AND a possible poly-time quantum attack against the dihedral coset problem (DCP) that made everyone freak out for about a week (UPDATE: looks like it’s busted: https://eprint.iacr.org/2026/1693). ALSO, there was an important distinguisher attack against Classic McEliece, which on its face doesn’t sound like a big deal, unless you’re familiar with the track record of efficient distinguishers in the history of code-based cryptography… 😱 To help us make sense of all this we are joined again by OG friend of the pod Chris Peikert! We had trouble with his audio but tried our best to fix it, apologies. Transcript: https://securitycryptographywhatever.com/2026/08/26/ai-lattice-proofs-with-chris-peikert/ Links: - https://openai.com/index/ten-advances-in-mathematics/ - https://cdn.openai.com/pdf/ten-proofs-oai.pdf - https://x.com/ChrisPeikert/status/2083534770403750025 - https://bsky.app/profile/chrispeikert.bsky.social/post/3msp3boueis2z - https://en.wikipedia.org/wiki/Boolean_satisfiability_problem - https://knowyourmeme.com/memes/wordcel-shape-rotator-mathcel - Chen 2024: https://eprint.iacr.org/2024/555 - https://eprint.iacr.org/2026/1630 - https://eprint.iacr.org/2026/1693 - CVP within n^(1/2-ɛ) - : https://eprint.iacr.org/2026/1655 "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S5 · E8
    July 27 · 1 hr 17 min

    An Odyssey of Lattice Cryptography with Mark Schultz-Wu

    We invited Mark Schultz-Wu on the podcast to talk about the history of lattice cryptography. When lattices are explained in plain english, they are actually quite simple! I don't think any of us have ever seen Deirdre so happy. If you're watching the video version, there's a section that's 6.1 minutes long with no cuts and consists just of Deirdre vigorously agreeing with what Mark is saying while smiling. What a time to be alive. Anyway, we are hosting another happy hour in Vegas between Black Hat and DEF CON! It's sponsored by Teleport! Thank you to Teleport, and dear readers, you should go check them out. Check out our socials or the podcast site to register. Transcript: https://securitycryptographywhatever.com/2026/07/27/lattices-with-mark-schultz-wu/ Links: Mark's IETF Post https://mailarchive.ietf.org/arch/msg/tls/HznE1IcCjstEjhh4M1p59qX1JlQ/ NTRU https://en.wikipedia.org/wiki/NTRU The original lattices are hard paper https://www.scirp.org/reference/referencespapers?referenceid=3401227 The original LWE for cryptography paper https://arxiv.org/abs/2401.03703 Entropic LWE https://eprint.iacr.org/2020/119 Dilithium round 3 submission: https://pq-crystals.org/dilithium/data/dilithium-specification-round3.pdf Recent attacks on Classic McEliece: https://eprint.iacr.org/2024/1694 Lectures on post-quantum cryptography from Alfred Menezes (an originator of elliptic curve cryptography) https://www.youtube.com/@cryptography101-alfred Falcon https://csrc.nist.gov/csrc/media/Presentations/2024/falcon/images-media/prest-falcon-pqc2024.pdf Regev: https://cims.nyu.edu/~regev/#research Tightness in Proofs: https://eprint.iacr.org/2016/360.pdf "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
  • S5 · E7
    July 2 · 56 min

    Trump's Golden Post-Quantum EO(s)

    The dear leader has actually bleated out some not-dumb executive orders (EOs) to accelerate adoption of post-quantum crypto for the US government! This looks to be in response to a flurry of advancements in quantum computing and quantum attack algorithms a few months ago. We cram legalize into our eyeballs— plus, ECDSA.fail! Watch on YouTube: https://www.youtube.com/watch?v=7ZwQpN_F6P8 Transcript: https://securitycryptographywhatever.com/2026/07/02/trumps-golden-post-quantum-eos Links: - The EO https://www.whitehouse.gov/presidential-actions/2026/06/securing-the-nation-against-advanced-cryptographic-attacks/ - CNSA2 https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/0/CSI_CNSA_2.0_FAQ_.PDF - https://media.defense.gov/2025/May/30/2003728741/-1/-1/0/CSA_CNSA_2.0_ALGORITHMS.PDF - https://www.ecdsa.fail/ - https://blog.google/innovation-and-ai/technology/safety-security/cryptography-migration-timeline/ - https://blog.cloudflare.com/post-quantum-roadmap/ - https://blog.google/innovation-and-ai/technology/research/neutral-atom-quantum-computers/ - https://en.wikipedia.org/wiki/FedRAMP - https://www.whitehouse.gov/presidential-actions/2026/06/ushering-in-the-next-frontier-of-quantum-innovation/ - https://blog.trailofbits.com/2026/04/17/we-beat-googles-zero-knowledge-proof-of-quantum-cryptanalysis/ - https://scottaaronson.blog/?p=9861 "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S5 · E6
    June 15 · 1 hr 11 min

    Facing the Vulnpocalypse with lcamtuf

    We talk to Michał Zalewski (lcamtuf) about the vulnpocalypse and if we even need fuzzers anymore. This episode may be export controlled at a future date. Watch on YouTube: https://www.youtube.com/watch?v=uI9CSgB4p9o Transcript: https://securitycryptographywhatever.com/2026/06/14/facing-the-vulnpocalypse-with-lcamtuf https://github.com/google/afl https://www.reddit.com/r/claude/comments/1tqtenf/anthropic_said_today_that_mythos_is_coming_to_all/ https://github.com/google/clusterfuzz https://en.wikipedia.org/wiki/Jevons_paradox https://en.wikipedia.org/wiki/XZ_Utils_backdoor https://en.wikipedia.org/wiki/Brighton_hotel_bombing https://curl.se/ https://ftp.openbsd.org/pub/OpenBSD/patches/7.8/common/025_sack.patch.sig https://www.wired.com/story/last-pass-vulnerability-password-safe/ https://nostarch.com/tangledweb https://nostarch.com/silence.htm https://nostarch.com/practical-doomsday https://nostarch.com/secret-life-of-circuits https://www.youtube.com/c/3blue1brown "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
  • S5 · E5
    March 26 · 1 hr 16 min

    AI Finds Vulns You Can't With Nicholas Carlini

    Returning champion Nicholas Carlini comes back to talk about using Claude for vulnerability research, and the current vulnpocalypse. It's all very high-brow stuff, and the gang learns some bitter lessons. Watch on YouTube: https://www.youtube.com/watch?v=_IDbFLu9Ug8 Transcript: https://securitycryptographywhatever.com/2026/03/25/ai-bug-finding/ Links: - https://red.anthropic.com/2026/zero-days/ - https://unpromptedcon.org/ - Black-hat LLMs - https://red.anthropic.com/2026/firefox/ "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
  • S5 · E4
    March 10 · 8 min

    Standardizing Pure PQC

    Standardizing cryptography involves a lot of opinions. Luckily, the gamer presidents are on it. Come on, you all know the drill. This is the last time I do this. "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
  • S5 · E3
    February 2 · 1 hr 12 min

    Python Cryptography Breaks Up with OpenSSL with Paul Kehrer and Alex Gaynor

    The Python cryptography module, pyca/cryptography, has mostly been a sane wrapper around a pile of C, so that users get performant cryptography on the many, many platforms Python targets. Therefore its maintainers, Alex Gaynor and Paul Kehrer, have become intimately familiar with OpenSSL. Recently, they declared that after many years of trying to make it work, they announced pyca/cryptography would be moving away from OpenSSL when supporting new functionality and exploring adding other backends instead. We invited them on to tell us about what has happened to OpenSSL, even after the investments and improvements following Heartbleed. No guests on this pod represent anyone besides themselves. Watch on YouTube: https://www.youtube.com/watch?v=dEKBHI3rodY Transcript: https://securitycryptographywhatever.com/2026/02/01/python-cryptography-breaks-up-with-openssl Links: - https://cryptography.io/en/latest/statements/state-of-openssl/ - Py Cryptography: https://cryptography.io - https://archive.openssl-conference.org/2025/presentations/Alex_Gaynor_Paul_Kehrer_The_Python_Cryptographic_Authoritys_OpenSSL_Experience.pdf - https://securitycryptographywhatever.com/2025/08/16/alex-gaynor/ - https://packages.gentoo.org/packages/media-libs/libsdl - https://www.youtube.com/watch?v=RUIguklWwx0 - https://datatracker.ietf.org/doc/rfc9180/ - https://docs.openssl.org/3.3/man3/OSSL_PARAM/ - https://openssl.foundation/ - https://github.com/openssl/openssl/issues/17064 - https://www.feistyduck.com/newsletter/issue_132_openssl_performance_still_under_scrutiny - https://github.com/topazproject/topaz - https://github.com/actions/runner/issues/1069 - https://crystalhotsauce.com/ - https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467 - https://en.wikipedia.org/wiki/Ship_of_Theseus - https://boringssl.googlesource.com/boringssl/+/aa202db1d7091b88b80f0a58c630c5c1aefc817d - https://www.ibm.com/products/open-sdk-for-rust-aix - https://dadrian.io/blog/posts/corporate-support-xz/ - https://peps.python.org/ - https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ed448/ - https://go.dev/blog/fips140 - https://dadrian.io/blog/posts/roll-your-own-crypto/ "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S5 · E2
    Dec 31, 2025 · 56 min

    The IACR Can't Decrypt with Matt Bernhard

    The International Association of Cryptologic Research held their regular election using secure voting software called Helios…and lost the keys to decrypt the results, leaving them with no choice but to throw out the vote and call a new election. Hilarity ensues. We welcome special guest Matt Bernhard who actually works on secure voting systems to explain which bits are homomorphically additive or not. Watch on YouTube: https://www.youtube.com/watch?v=euw_yqAQFI8 Transcript: https://securitycryptographywhatever.com/2025/12/30/iacr-helios Links: - NYT: https://www.nytimes.com/2025/11/21/world/cryptography-group-lost-election-results.html - IACR Memo: https://www.iacr.org/news/item/27138 - https://www.iacr.org/elections/ - https://vote.heliosvoting.org/faq - https://github.com/Election-Tech-Initiative/electionguard - https://www.usenix.org/legacy/events/sec08/tech/full_papers/adida/adida.pdf - https://www.iacr.org/elections/eVoting/about-helios.html - https://www.iacr.org/elections/eVoting/ - https://crypto.ethz.ch/publications/files/CrGeSc97b.pdf - https://electionguard.vote/ - https://eprint.iacr.org/2025/1901 - https://freeandfair.us/blog/open-free-election-technology/ - https://www.starvoting.org/ - https://mbernhard.com/ "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S5 · E1
    Oct 31, 2025 · 56 min

    Apple’s Memory Integrity Enforcement

    Apple announced its new suite of memory security improvements from the top of the stack all the way to the bottom, so we dug through what they did and how they did it (performantly). Watch on YouTube: https://www.youtube.com/watch?v=9FJwOI2PliU Transcript: https://securitycryptographywhatever.com/2025/10/31/apple-mie Links: - https://security.apple.com/blog/memory-integrity-enforcement/ - Secure Page Table Monitor and Trusted Execution Monitor: https://support.apple.com/guide/security/operating-system-integrity-sec8b776536b/1/web/1#secd022396fb - https://security.apple.com/blog/towards-the-next-generation-of-xnu-memory-safety/ - https://developer.apple.com/documentation/xcode/adopting-type-aware-memory-allocation - https://security.apple.com/blog/what-if-we-had-sockpuppet-in-ios16/ - https://arxiv.org/pdf/2510.09272 - https://googleprojectzero.blogspot.com/2023/11/first-handset-with-mte-on-market.html - https://developer.apple.com/documentation/xcode/adopting-type-aware-memory-allocation - https://arxiv.org/pdf/2510.09272 - https://spectreattack.com/spectre.pdf "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
  • S4 · E12
    Aug 23, 2025 · 1 hr 11 min

    Stop Using Encrypted Email with William Woodruff

    There was a bug in an OpenPGP library which finally gave us an excuse to tear encrypted email via PGP to shreds. Our special guest William Woodruff joined us to help explain the vuln and indulge our gnashing of teeth on why email was never meant to be encrypted and how other modern tools do the job much, much better. Watch on YouTube: https://www.youtube.com/watch?v=IoL3LfIozJo Transcript: https://securitycryptographywhatever.com/2025/08/22/stop-using-encrypted-email-with-william-woodruff Links: - William Woodruff: https://yossarian.net/ - https://www.latacora.com/blog/2020/02/19/stop-using-encrypted/ - https://www.rfc-editor.org/rfc/rfc4880 - https://codeanlabs.com/blog/research/cve-2025-47934-spoofing-openpgp-js-signatures/ - https://www.mailpile.is/blog/2014-10-07_Some_Thoughts_on_GnuPG.html - https://www.rfc-editor.org/rfc/rfc9580.html - https://www.tumblr.com/accidentallyquadratic - https://www.w3.org/TR/xmldsig-core/ - https://support.yubico.com/hc/en-us/articles/360013790259-Using-Your-YubiKey-with-OpenPGP - https://www.rfc-editor.org/rfc/rfc9580.html#name-signature-packet-type-id-2 - https://www.rfc-editor.org/rfc/rfc9580.html#name-key-derivation-function - https://en.wikipedia.org/wiki/S/MIME - https://delta.chat - https://signal.org/blog/the-ecosystem-is-moving/ - https://phakeobj.netlify.app/posts/gigacage/ - https://x.com/dakami -----BEGIN PGP MESSAGE----- U2FsdGVkX1/OF+EynrukxZnSAXwgksTGSIkQ6s4X9Ns7JgQ2ZymeQAp8uD09MtkJ ce5HOKcjhUkZOMbJl3I5iOcPgSxCGG8KccNXcY6msdAD3pdlmR5cWJpn6+qGwqvo KCsj+DYwFW6tltLBXP/cdnh9z8ktRXqfwQW+uhB5Zcaw28pzmNz/rA0cb0cLGiaX uxp9A0iWhwf2gFpUSiIJyXGLJAc8eeI1LXfISXi7IkowDMp4x+iDbOlrR0d6zCkp IKpNGReokcWhUrlGVONiVUrApZS2fvxQoHgaIvwLl5FM1WdrbQIV41DB+rgtZJhE NSgMkhQ0y1bBAOM25ykRjC/UUS/q0ddXz1ThGi6vRIp4/8vkqOsEXHv5M1oT9FQT UGK3zyffq0FqGBFj6kwVZ0X0JQFmtydZKhSYEPE9s4mcfvxKNQsySK7wlxMerKrf f9ZxOR7rHjE3IfqtoizX8EH+MYy2lRCoCKeLbZd0G1LcVhBhRpoXfqL2IboAWqT+ U8R2eyts7qiNuWQUtmCzKNmaJMS+1M+pVN5ZXAdSqK2OJVJZgO8Ie7q4HVZeAd3G HzP7owf+VerCguOYN41cxGle1QpeFi0xcYHNna1bgbodFZ8eGDOq5yCuvmQa04Xy J4vRv7xcp/v16CniL1rN6KhnzdW2gLky8depnYyhm8NvdMFETA6K6eIYm1roD+C2 wwOOKRxUpTI54ov+HYDDU+HUmpFykSesHQJ75o9m0w7V2kR/+E46olFMhHo8JWnL NsGd5QlD/fyedMXHAjimXuFk/YFnwa1lh4XwSwYm+c8ZnIfrS6oEEdUSwXMCwwVT 7/tMw+ab0YRsx19hBLS41oxMz+DCah+/KDMEHv0I+VxaCH8ZfaKD4tRhduSvcWkn Nat3Xp8/MAmO5xN1U8s1dFvrlnt+yqDz7Wn0kVDiax2dTJVgftetqOkoSVvGdMex 9K0ILUUMEpHYBISIaAc7NjoG4BieSeK7wuzBXdhHutVZVKp2ty+mAd8xPlrmemsX lzBhV/kcmF4rcG4eqoWcKpZQY8ZUDufwhIcNqIZEA+wQoKbmBQCR/NradwUrCAIs AQFMVhSYmr7ffA6Ty0twSWeVMDQmxdW+6gKA3EiTAJkFXPpdkhBUzuZHC7Eeph7D F0Ks8Vu/wzOhNsd2s2wYYF6Dl3xctcOj7eMw8VS1HtExszulM57TnqTDaLGPcX6o m8NORwMEtQrCbJd/fdmoNPN/cXzLPHQj3qVZ0F50iNec6zSnmBLIRX4SAYOqzN/2 icvr98Caa1oX3pUlm9W2Hcz30SXJDxOf+mqH6zL4QTAMs3/K9OkaO9nmyPelwoCw VI1q/PsMpqQhGikdM5hrzg6IcEOg5zpLB6N+wqkcGyXFzI2gSQTWYOv4thrIxPY5 G9yNi4dhU+2+KJCa6aoPyAlyc41Yd3ARTeahHEjtdj6PcueRPQdVm+qWCRp09bp3 oic7ljzMVrPRgdbRrzFyEAIhN9Fi4QZ08/yCLEt/BPG+N8j0cZixoj54SKi07uSO WRDrzGvgSegGCCIFKjAsq9ay0sBm61XLcZqdtj57NpNzd/y/yFYvjEQLyyn8VnFA RwOaM3zjrufNC+kYVkHCYzfvu+JopScZjMiuBXI9v8OTOXlj+Ai97bnftwmpQ263 5vyearRHCNATFNa96Sxd1cLjV+ECUlD4hAZQPyel8groXsyjKaMxoOkaZjG/5MDQ 8KPtes32kjTmneyLSzrUaAD0F4l/iltBXzDNiT6BHD7HJmERbdkoab7+DC1hxxC1 VuOHOX+G/U5NUNjxAercuFOY6kgAH5HM+woGjLUsoc5LESqyPdddeg== -----END PGP MESSAGE----- "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S4 · E11
    Aug 16, 2025 · 1 hr 25 min

    Alex Gaynor

    We chat with friend of the pod and special guest Alex Gaynor, former deputy chief technologist at the FTC and all around good Security Person™. Join for nerdery about WebAuthn, stay for accidentally melting down GitHub APIs around November 2020! Watch on YouTube: https://www.youtube.com/watch?v=gBoGvyvsSi4 Transcript: https://securitycryptographywhatever.com/2025/08/16/alex-gaynor Links: - https://knowyourmeme.com/memes/no-take-only-throw - https://alexgaynor.net/2025/jan/13/challenges-funding-open-source/ - https://alexgaynor.net/2025/apr/08/putting-a-price-tag-on-open-source/ - https://dadrian.io/blog/posts/corporate-support-xz/ - https://alex.github.io/nyt-2020-election-scraper/battleground-state-changes.html - https://github.com/alex/nyt-2020-election-scraper "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S4 · E10
    Jul 29, 2025 · 1 hr

    Vegas, Baby!

    We’re throwing a party in Vegas! Someone called it SCWPodCon last year, and the name stuck. It’s sponsored by Teleport, the infrastructure identity company. Get SSO for SSH! If Thomas was here, I’m sure he’d tell you that Fly.io uses Teleport internally. Oh also there's some thing called Black..pill? Black Pool? Something like that happening in Vegas, with crypto talks, so we chatted about them a bit, plus some other stuff SCWPodCon 2025: https://securitycryptographywhatever.com/events/blackhat Transcript: https://securitycryptographywhatever.com/2025/07/29/vegas-baby/ Links: - Fault Injection attacks on PQCS signatures: https://www.blackhat.com/us-25/briefings/schedule/index.html#bypassing-pqc-signature-verification-with-fault-injection-dilithium-xmss-sphincs-46362 - Another attack on TETRA: https://www.blackhat.com/us-25/briefings/schedule/index.html#2-cops-2-broadcasting-tetra-end-to-end-under-scrutiny-46143 - Attacks on SCADA / ICS protocols (OPC UA): https://www.blackhat.com/us-25/briefings/schedule/index.html#no-vpn-needed-cryptographic-attacks-against-the-opc-ua-protocol-44760 - Attacks on Nostr: https://www.blackhat.com/us-25/briefings/schedule/index.html#not-sealed-practical-attacks-on-nostr-a-decentralized-censorship-resistant-protocol-45726 - https://signal.org/blog/the-ecosystem-is-moving/ - https://en.wikipedia.org/wiki/Nostr - https://eurosp2025.ieee-security.org/program.html - https://cispa.de/en/research/publications/84648-attacking-and-fixing-the-android-protected-confirmation-protocol - https://hal.science/hal-05038009v2/file/main.pdf - 8-bit, abacus, and a dog: https://eprint.iacr.org/2025/1237.pdf - https://www.youtube.com/watch?v=Dlsa9EBKDGI - https://www.quantamagazine.org/computer-scientists-figure-out-how-to-prove-lies-20250709/ - https://eprint.iacr.org/2025/118 "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S4 · E9
    May 19, 2025 · 1 hr 2 min

    E2EE Storage Done Right with Matilda Backendal Jonas Hofmann and Kien Tuong Truong

    It seems like everyone that tries to deploy end-to-end encrypted cloud storage seems to mess it up, often in new and creative ways. Our special guests Matilda Backendal, Jonas Hofmann, and Kien Tuong Truong give us a tour through the breakage and discuss a new formal model of how to actually build a secure E2EE storage system. Watch on YouTube: https://youtu.be/sizLiK_byCw Transcript: https://securitycryptographywhatever.com/2025/05/19/e2ee-storage/ Links: - https://brokencloudstorage.info - https://eprint.iacr.org/2024/1616.pdf - https://www.sync.com - https://www.pcloud.com - https://icedrive.net - https://seafile.com - https://tresorit.com - https://eprint.iacr.org/2024/989.pdf "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
  • S4 · E11
    Mar 24, 2025 · 14 min

    Picking Quantum Resistant Algorithms

    Migrating the US government to quantum-resistant cryptography is hard, luckily the gamer presidents are on it. This episode is extremely not safe for work, nor does it reflect the political opinions of, well, anybody. "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
  • S4 · E10
    Feb 25, 2025 · 48 min

    Apple Pulls Advanced Data Protection in the UK with Matt Green and Joe Hall

    Apple has pulled the availability of their opt-in iCloud end-to-end encryption feature, called Advanced Data Protection, in the UK. This doesn't only affect UK Apple users, however. To help us make sense of this surprising move from the fruit company, we got Matt Green, Associate Professor at Johns Hopkins, and Joe Hall, Distinguished Technologist at the Internet Society, on the horn. Recorded Saturday February 22nd, 2025. Transcript: https://securitycryptographywhatever.com/2025/02/24/apple-pulls-adp-in-uk/ Watch episode on YouTube: https://youtu.be/LAn_yOGUkR0 Links: - https://www.lawfaremedia.org/article/apples-cloud-key-vault-and-secure-law-enforcement-access - https://www.androidcentral.com/how-googles-backup-encryption-works-good-bad-and-ugly - https://gdpr.eu/right-to-be-forgotten/ - https://www.legislation.gov.uk/id/ukpga/2024/9 - https://www.nytimes.com/2021/05/17/technology/apple-china-censorship-data.html - https://en.wikipedia.org/wiki/Salt_Typhoon - Salt Typhoon: https://www.cisa.gov/news-events/news/strengthening-americas-resilience-against-prc-cyber-threats - https://www.bloomberg.com/news/articles/2025-02-21/apple-removes-end-to-end-encryption-feature-from-uk-after-backdoor-order - https://support.apple.com/en-us/102651 "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S4 · E8
    Jan 28, 2025 · 1 hr 20 min

    Cryptanalyzing LLMs with Nicholas Carlini

    'Let us model our large language model as a hash function—' Sold. Our special guest Nicholas Carlini joins us to discuss differential cryptanalysis on LLMs and other attacks, just as the ones that made OpenAI turn off some features, hehehehe. Watch episode on YouTube: https://youtu.be/vZ64xPI2Rc0 Transcript: https://securitycryptographywhatever.com/2025/01/28/cryptanalyzing-llms-with-nicholas-carlini/ Links: - https://nicholas.carlini.com - “Stealing Part of a Production Language Model”: https://arxiv.org/pdf/2403.06634 - ‘Why I attack"’: https://nicholas.carlini.com/writing/2024/why-i-attack.html - “Cryptanalytic Extraction of Neural Network Models”, CRYPTO 2020: https://arxiv.org/abs/2003.04884 - “Stochastic Parrots”: https://dl.acm.org/doi/10.1145/3442188.3445922 - https://help.openai.com/en/articles/5247780-using-logit-bias-to-alter-token-probability-with-the-openai-api - https://community.openai.com/t/temperature-top-p-and-top-k-for-chatbot-responses/295542 - https://opensource.org/license/mit - https://github.com/madler/zlib - https://ai.meta.com/blog/yann-lecun-ai-model-i-jepa/ - https://nicholas.carlini.com/writing/2024/how-i-use-ai.html "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S4 · E7
    Jan 21, 2025 · 57 min

    Biden’s Cyber-Everything Bagel with Carole House

    Just a few days before turning off the lights, the Biden administration dropped a huge cybersecurity executive order including a lot of good stuff, that hopefully [cross your fingers, knock wood, spin around three times and spit] will last into future administrations. We snagged some time with Carole House, outgoing Special Advisor and Acting Senior Director for Cybersecurity and Critical Infrastructure Policy, National Security Council in the Biden-Harris White House, to give us a brain dump. And now due to popular demand, with video of our actual human¹ faces! https://youtu.be/Pqw0W2crQiM Transcript: https://securitycryptographywhatever.com/2025/01/20/bidens-cyber-everything-bagel-carole-house/ Links: - https://www.federalregister.gov/d/2025-01470 - https://www.wired.com/story/biden-executive-order-cybersecurity-ai-and-more/ - 2022 EO: https://archive.ph/hvzWd - 2023 EO: https://www.whitehouse.gov/wp-content/uploads/2023/06/M-23-16-Update-to-M-22-18-Enhancing-Software-Security-1.pdf - 2021 EO: https://www.federalregister.gov/documents/2021/05/17/2021-10460/improving-the-nations-cybersecurity - NIST SSDF: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf - https://www.federalregister.gov/documents/2015/04/02/2015-07788/blocking-the-property-of-certain-persons-engaging-in-significant-malicious-cyber-enabled-activities - IEEPA: https://www.govinfo.gov/content/pkg/USCODE-2023-title50/pdf/USCODE-2023-title50-chap35-sec1701.pdf ¹ Actual human faces not guaranteed in all cases "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
  • S4 · E6
    Dec 18, 2024 · 53 min

    Quantum Willow with John Schanck and Samuel Jacques

    THE QUANTUM COMPUTERS ARE COMING...right? We got Samuel Jacques and John Schanck at short notice to answer that question plus a bunch of other about error correcting codes, logical qubits, T-gates, and more about Google's new quantum computer Willow. Transcript: https://securitycryptographywhatever.com/2024/12/18/quantum-willow Links: - https://blog.google/technology/research/google-willow-quantum-chip/ - https://research.google/blog/making-quantum-error-correction-work/ - https://blog.google/technology/google-deepmind/alphaqubit-quantum-error-correction/ - https://www.nature.com/articles/s41586-024-08449-y - Sam’s ‘Landscape of Quantum Computing’ chart: https://sam-jaques.appspot.com/quantum\_landscape\_2024 - The above, originally published in 2021: https://sam-jaques.appspot.com/quantum\_landscape - https://sam-jaques.appspot.com - https://jmschanck.info/ "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S4 · E5
    Dec 7, 2024 · 1 hr 7 min

    Dual_EC_DRBG with Justin Schuh and Matthew Green

    Nothing we have ever recorded on SCW has brought so much joy to David. However, at several points during the episode, we may have witnessed Matthew Green's soul leave his body. Our esteemed guests Justin Schuh and Matt Green joined us to debate whether `Dual_EC_DRBG` was intentionally backdoored by the NSA or 'just' a major fuckup. Transcript: https://securitycryptographywhatever.com/2024/12/07/dual-ec-drbg Links: - Dicky George at InfiltrateCon 2014, 'Life at Both Ends of the Barrel - An NSA Targeting Retrospective': [https://youtu.be/qq-LCyRp6bU?si=MyTBKomkIVaxSy1Q](https://youtu.be/qq-LCyRp6bU?si=MyTBKomkIVaxSy1Q) - Dicky George: [https://www.nsa.gov/Press-Room/Digital-Media-Center/Biographies/Biography-View-Page/Article/3330261/richard-dickie-george/](https://www.nsa.gov/Press-Room/Digital-Media-Center/Biographies/Biography-View-Page/Article/3330261/richard-dickie-george/) - NYTimes on Sigint Enabling Project: [https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html](https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html) - On the Practical Exploitability of Dual EC in TLS Implementations: [https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-checkoway.pdf](https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-checkoway.pdf) - Wired - Researchers Solve Juniper Backdoor Mystery; Signs Point to NSA [https://www.wired.com/2015/12/researchers-solve-the-juniper-mystery-and-they-say-its-partially-the-nsas-fault/](https://www.wired.com/2015/12/researchers-solve-the-juniper-mystery-and-they-say-its-partially-the-nsas-fault/) - ProPublica - Revealed: The NSA's Secret Campaign to Crack, Undermine Internet Security [https://www.propublica.org/article/the-nsas-secret-campaign-to-crack-undermine-internet-encryption](https://www.propublica.org/article/the-nsas-secret-campaign-to-crack-undermine-internet-encryption) - DDoSecrets - Sigint Enabling Project: [https://data.ddosecrets.com/Snowden%20archive/sigint-enabling-project.pdf](https://data.ddosecrets.com/Snowden%20archive/sigint-enabling-project.pdf) - IAD: [https://www.iad.gov/](https://www.iad.gov/) - Ars Technica - “Unauthorized code” in Juniper firewalls decrypts encrypted VPN traffic: [https://web.archive.org/web/20151222023311/http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/](https://web.archive.org/web/20151222023311/http://arstechnica.com/security/2015/12/unauthorized-code-in-juniper-firewalls-decrypts-encrypted-vpn-traffic/) - 2015 IMPORTANT JUNIPER SECURITY ANNOUNCEMENT: [https://web.archive.org/web/20151221171526/http://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554](https://web.archive.org/web/20151221171526/http://forums.juniper.net/t5/Security-Incident-Response/Important-Announcement-about-ScreenOS/ba-p/285554) - Extended Random Values for TLS: [https://datatracker.ietf.org/doc/html/draft-rescorla-tls-extended-random-00](https://datatracker.ietf.org/doc/html/draft-rescorla-tls-extended-random-00) - The Art of Software Security Assessment: [https://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities/dp/0321444426](https://www.amazon.com/Art-Software-Security-Assessment-Vulnerabilities/dp/0321444426) "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
  • S4 · E4
    Oct 15, 2024 · 1 hr 13 min

    A Little Bit of Rust Goes a Long Way with Android's Jeff Vander Stoep

    You may not be rewriting the world in Rust, but if you follow the findings of the Android team and our guest Jeff Vander Stoep, you'll drive down your memory-unsafety vulnerabilities more than 2X below the industry average over time! 🎉 Transcript: https://securitycryptographywhatever.com/2024/10/15/a-little-bit-of-rust-goes-a-long-way/ Links: - https://security.googleblog.com/2024/09/eliminating-memory-safety-vulnerabilities-Android.html - “Safe Coding”: https://dl.acm.org/doi/10.1145/3651621 - “effectiveness of security design”: https://docs.google.com/presentation/d/16LZ6T-tcjgp3T8_N3m0pa5kNA1DwIsuMcQYDhpMU7uU/edit#slide=id.g3e7cac054a_0_89 - https://security.googleblog.com/2024/02/improving-interoperability-between-rust-and-c.html - https://github.com/google/crubit - https://github.com/google/autocxx - https://en.wikipedia.org/wiki/Stagefright_(bug) - https://security.googleblog.com/2021/04/rust-in-android-platform.html - https://chromium.googlesource.com/chromium/src/+/master/docs/security/rule-of-2.md - https://www.usenix.org/conference/usenixsecurity22/presentation/alexopoulos -https://kb.meinbergglobal.com/kb/time_sync/ntp/ntp_vulnerabilities_reported_2023-04 - https://blog.isosceles.com/the-legacy-of-stagefright/ - https://research.google/pubs/secure-by-design-googles-perspective-on-memory-safety/ - https://www.youtube.com/watch?v=QrrH2lcl9ew - https://source.android.com/docs/setup/build/rust/building-rust-modules/overview - https://github.com/rust-lang/rust-bindgen - https://security.googleblog.com/2021/06/rustc-interop-in-android-platform.html "Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

    • Transcript
    • Chapters
Showing 1–20 of 21 episodes