https://cryptographycaffe.sandboxaq.com/posts/Recent content in Posts on The Cryptography Caffè ☕Hugoen-usSandboxAQWed, 03 Sep 2025 00:08:00 +0000https://cryptographycaffe.sandboxaq.com/posts/keeping-up-with-the-kems-formally-easycrypt-edition/Wed, 03 Sep 2025 00:08:00 +0000https://cryptographycaffe.sandboxaq.com/posts/keeping-up-with-the-kems-formally-easycrypt-edition/“Draw the outputs of a key encapsulation mechanism, bound together, being checked by a computer, pixel art” by DALL-E 3. Libraries Binding Hierarchy Fujisaki-Okamoto Transform ML-KEM Next Steps To enable secure and efficient communication with nearly anyone at any time, the cryptography running on our devices makes heavy use of the ability to establish short shared secrets over insecure channels and networks. For a while now, such secret establishment has, among others, been achieved by means of so-called key encapsulation mechanisms, or KEMs for short.https://cryptographycaffe.sandboxaq.com/posts/hp-crypto-vuln-disclosure/Wed, 30 Jul 2025 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/hp-crypto-vuln-disclosure/Exploring your cryptographic inventory is hard. Not only do cryptographic assets and Non-Human Identities (NHIs) hide anywhere and everywhere, but without help, their sheer quantity will overwhelm any security team. This lack of complete visibility creates a vast, unknown attack surface where your weakest link—a single forgotten asset—can trigger a cascading breach. This is precisely the scenario AQtive Guard was engineered to prevent: (1) our platform, using existing third party data (e.https://cryptographycaffe.sandboxaq.com/posts/real-world-verification-of-software-for-cryptographic-applications/Tue, 25 Mar 2025 00:00:00 -0001https://cryptographycaffe.sandboxaq.com/posts/real-world-verification-of-software-for-cryptographic-applications/“Draw an abstract image of formal methods being applied to real-world, security-critical code.” by DALL-E. In this blog post, we describe how we at SandboxAQ, together with Cryspen, formally verified key components of Sandwich—an open-source, unified API that simplifies the use of cryptographic libraries for developers, enabling crypto-agility. Formal methods have been used successfully to produce high-assurance implementations of cryptographic algorithms that have since been integrated into popular libraries like BoringSSL, NSS, and AWS LC.https://cryptographycaffe.sandboxaq.com/posts/survey-public-keys-internet/Thu, 23 Jan 2025 00:08:00 +0000https://cryptographycaffe.sandboxaq.com/posts/survey-public-keys-internet/“Draw me an abstract image of millions of cryptographic keys being gathered from across the Internet, all around the globe,” by DALL-E 4. Introduction How we did it What we found Cryptographic weaknesses we observed Debian weak keys Keys that are so small that they are broken Keys that are not future-proof Keys that were not generated using best practices Leakage of identifying information How AQtive Guard can help 🎬 YouTube A discussion with the author about these findings on SandboxAQ’s channel.https://cryptographycaffe.sandboxaq.com/posts/protecting-signal-desktop-keys/Thu, 14 Nov 2024 00:08:00 +0000https://cryptographycaffe.sandboxaq.com/posts/protecting-signal-desktop-keys/“A lone man in a desert trying to understand the inner workings of a computer in the style of Moebius”, by DALL-E. At SandboxAQ, we recently delved into Signal Desktop to identify how its key management could be improved by using security hardware. Our analysis highlights the need for robust and consistent key isolation services across desktop platforms. In this blogpost, We analyse the security of Signal Desktop’s key management in light of recent attack reports, and We show how security hardware can protect Signal Desktop’s keys with a proof of concept (PoC)—a fork of Signal Desktop—and explore the tradeoffs with this approach.https://cryptographycaffe.sandboxaq.com/posts/qrom-intro/Mon, 04 Nov 2024 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/qrom-intro/“A humorous cartoon-style depiction, inspired by Indian cartoonist R. K. Laxman, blending the Roman Empire with a clear quantum technology theme.” by DALL-E3. The National Institute of Standards and Technology (NIST) has just released the first set of Federal Information Processing Standards (FIPS) for post-quantum cryptography (PQC). So institutions worldwide, ranging from large banks to government agencies, now have a “recipe” to implement these standards in order to safeguard their IT infrastructure against threats posed by large-scale quantum computers (learn more about how SandboxAQ contributed to this standardization process in our recent blogpost).https://cryptographycaffe.sandboxaq.com/posts/formal-verification-overview/Wed, 17 Jul 2024 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/formal-verification-overview/“A street graffiti style painting depicting the concept of machine-checking post-quantum cryptography” by DALL-E 3. ‘Formally verified’ or ‘machine-checked’ is the new gold standard for cryptographic implementations and security proofs. Indeed, the White House recently recognized the relevance of formal methods as a way to ensure safe code and NIST is holding a workshop this summer on the use of formal methods in security certification. However, the term ‘formally verified’ is very broad with different meanings depending on the context.https://cryptographycaffe.sandboxaq.com/posts/crypto2024/Wed, 12 Jun 2024 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/crypto2024/“An image of a cryptographer writing equations on the sand of a Californian beach in the style of Frida Kahlo” by DALL-E 3. CRYPTO is the flagship cryptography conference in North America (being the sister conference of Eurocrypt and Asiacrypt). This year’s 44th CRYPTO will be held 18-22 August 2024, as always in Santa Barbara, CA. We are proud that three papers co-authored by SandboxAQ researchers have been accepted to and will be presented at CRYPTO 2024.https://cryptographycaffe.sandboxaq.com/posts/rwpqc2024_rsa2024/Mon, 03 Jun 2024 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/rwpqc2024_rsa2024/“An art deco-style painting inspired by Archibald John Motley Jr.’s ‘Nightlife’, featuring a diverse group of people discussing cryptography” by DALL-E 3. The past few months have been a bustling time for our Cybersecurity Group. From vibrant RWPQC in Toronto to the engaging sessions at RSA in San Francisco, the team has been immersed in a whirlwind of tech innovation and tracking emerging key takeaways within the cybersecurity industry.https://cryptographycaffe.sandboxaq.com/posts/eurocrypt2024/Thu, 23 May 2024 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/eurocrypt2024/“An image in the style of J.M.W. Turner depicting a European cryptography conference in Zurich” by DALL-E 3. SandboxAQ @ Eurocrypt 2024 Next week Eurocrypt takes place in Zurich, Switzerland. Eurocrypt is the flagship cryptography conference in Europe and the sister conference of CRYPTO (North America) and Asiacrypt. SandboxAQ will have a strong presence at Eurocrypt, come chat to us if you’re there. In particular, we are involved in the following four presentations.https://cryptographycaffe.sandboxaq.com/posts/nist-5th-pqc-conf/Fri, 10 May 2024 00:00:00 -0400https://cryptographycaffe.sandboxaq.com/posts/nist-5th-pqc-conf/In light of advancements in building large-scale quantum computers and their threats to the existing public key cryptosystems, NIST is organizing multiple PQC competitions to standardize next generation, quantum-safe crypto algorithms. The algorithm submissions to this competition belong to two different categories: Post-Quantum Digital Signature Algorithms (PQC-DSA) and Post-Quantum Key Encapsulation Mechanism Scheme (PQC-KEM). NIST’s first post-quantum standards are scheduled to drop in ‘summer 2024’ (but everyone seems to agree that means late summer at best and more likely September 2024.https://cryptographycaffe.sandboxaq.com/posts/fl_networksecurity/Tue, 07 May 2024 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/fl_networksecurity/" A painted depiction of space teams from different continents exploring the Moon for water resources in federated learning settings without disclosing privacy, inspired by Belgian artist Magritte!" by DALL-E 3. Introduction Artificial Intelligence (AI) has revolutionized our approach to data in the context of AI algorithms. While this data can be valuable for mining and discovering patterns, it also introduces privacy and security risks [1]. One approach to address this issue is through the lens of Federated learning (FL) [2].https://cryptographycaffe.sandboxaq.com/posts/fido2-attestation/Tue, 09 Apr 2024 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/fido2-attestation/“A painting in the style of Salvador Dali featuring FIDO the dog, excluding any representation of TOFU the food” by DALL-E. The FIDO2 protocol is a passwordless authentication mechanism for the web which is widely adopted. In previous blog posts, we have talked about its security assurances and our post-quantum secure end-to-end open-source implementation. As part of the protocol, FIDO2 offers different attestation mechanisms to ensure the hardware devices used to log into a web service – called ‘authenticators’– comply with certain security requirements that might have been requested by the web service (AKA relying party).https://cryptographycaffe.sandboxaq.com/posts/sandwich-turbo-charging/Mon, 26 Feb 2024 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/sandwich-turbo-charging/“An image for a blog post named “TurboTLS implementation in Sandwich”.” by DALL·E 3 Welcome back to Cryptography Caffe! In this blog post, I’ll be talking about how Thomas Bailleux and I did some transport fancy protocol manipulation using Sandwich’s (github) tunnel abstraction to reduce TLS handshake latency. You perhaps have read about TurboTLS on our blog before. In this post, I’ll walk you through some new Sandwich IO objects for the experimental protocol TurboTLS that are available to play with in Sandwich!https://cryptographycaffe.sandboxaq.com/posts/kdsp/Mon, 05 Feb 2024 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/kdsp/“A fast padlock rocket from a distance in the style of cyber punk” by DALL-E2. Introduction The $K$-Densest Lattice Problem ($K$-DSP) is one of a variety of theoretical mathematical problems that a small community of nerds have devoted the past two decades to solving. There are few papers written about $K$-DSP, and it would seem destined to remain in the farthest recesses of mathematical esoterica for eternity. However, due to developments in distant branches of technology (quantum physics), $K$-DSP and its friends have been dragged under the microscope of a group of information security researchers known as cryptographers.https://cryptographycaffe.sandboxaq.com/posts/sandwich-tutorial1/Tue, 19 Dec 2023 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/sandwich-tutorial1/“a painting of a footlong sandwich, arriving to the platform on the London underground. The Joy of Cooking Secure Tunnels in Python Welcome to the SandboxAQ blog, where we’re all about making complex concepts digestible and, dare we say, delicious! Today, we’re serving up a hearty helping of Sandwich - our very own crypto-agile library that we launched this year in August. If you’ve ever wondered what goes into making a Sandwich (library, not lunch), pull up a chair and get ready to feast on some knowledge.https://cryptographycaffe.sandboxaq.com/posts/fhe-01/Sat, 18 Nov 2023 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/fhe-01/This blog is an introduction to FHE. Rather than diving into mathematical details (which are complex but also interesting!), we aim to provide to the reader a higher level overview of what FHE can be used for and the different scenarios or setups that leverage FHE. In a future blogpost, we will dive into more details about the types of FHE (which influence the kind of computations we can perform) and finally which kind of compilers we can find to translate our programs into operations that can be computed using FHE.https://cryptographycaffe.sandboxaq.com/posts/pq-fido/Fri, 10 Nov 2023 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/pq-fido/“a painting of a friendly person pulling books from the library in Alexandria in the style of Ruth Cahn” by DALL-E. At SandboxAQ, our mission is to modernize cryptography management. That means gaining visibility into the cryptographic assets used across IT infrastructure and the agility to manage them at scale. The road to cryptographic agility is complex, as it requires ensuring the agility of many layers in the stack — check, if you don’t know it yet, our OSS Sandwich library.https://cryptographycaffe.sandboxaq.com/posts/ml-cybersecurity/Thu, 14 Sep 2023 00:00:00 -0814https://cryptographycaffe.sandboxaq.com/posts/ml-cybersecurity/“Recreate the Pink Floyd ‘burning man’ photo but with a scientist and AI shaking hands in the style of Magritte” by DALL-E. The intersection of artificial intelligence (AI) and cybersecurity has led to a new era of both promise and peril. As organizations embrace AI solutions to improve their defenses, malicious actors are uncovering novel techniques to exploit the vulnerabilities of such systems. In this article, we delve into the intricate relationship between AI and cybersecurity, analyzing the benefits and drawbacks that arise when these two domains converge.https://cryptographycaffe.sandboxaq.com/posts/alteq/Thu, 31 Aug 2023 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/alteq/“a painting of two rubik cubes made from loaves of bread in the style of Georgia O’Keeffe” by DALL-E 2. Three is a shroud! Post-quantum signatures from trilinear forms. Given two square matrices $A$ and $B$, can we tell if there is an invertible square matrix $X$ such that $XAX^{-1}=B?$ Yes, quickly! Such an $X$ exists if and only if $A$ and $B$ are similar and there are efficiently computable invariants that precisely characterize similarity.https://cryptographycaffe.sandboxaq.com/posts/sandwich-release/Tue, 08 Aug 2023 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/sandwich-release/“a still life painting of a sandwich on a table in the style of Paul Cézanne. Sandwich: An Open-Source Modern Cryptography Library At SandboxAQ, many of our products are centered around the core belief that crypto-agility is the future of modern cryptography management. To help the community achieve this goal, developers need a single cryptography framework, for any leading language, that, at the same time, makes their applications crypto-agile. In this blogpost, we’ll describe how our new open source library accomplishes this goal.https://cryptographycaffe.sandboxaq.com/posts/rwpqc-workshop-announcement/Thu, 29 Jun 2023 00:00:00 -0500https://cryptographycaffe.sandboxaq.com/posts/rwpqc-workshop-announcement/At the end of March, SandboxAQ and MITRE held the first-ever Real World PQC Workshop in Tokyo. The workshop was affiliated with the IACR’s annual Real World Crypto event. Together, we curated an agenda that covered the latest happenings in the world of post-quantum cryptography (PQC) and recruited a roster of world-renowned industry experts, with sponsorship from QuintessenceLabs, EvolutionQ and Google. You can watch the full event online, which covers:https://cryptographycaffe.sandboxaq.com/posts/ntt-02/Fri, 23 Jun 2023 09:00:00 -0700https://cryptographycaffe.sandboxaq.com/posts/ntt-02/“A Monet painting of convolution” by DALL-E 2. The Number Theoretic Transform Previously, we took a look at the problem of polynomial multiplication. Specifically, we saw that we can view polynomial multiplications as a form of convolution. To make things easier to compute, we often define a polynomial modulus, making it into a ring. The modulus defining the ring in our context is often special, making the convolution either circular or negative wrapped.https://cryptographycaffe.sandboxaq.com/posts/batch-signing/Tue, 02 May 2023 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/batch-signing/“a researcher signing a merkle tree root in the style of Tamara De Lempicka” by DALL-E 2. Batch Signatures, Revisited The Post-Quantum (PQ) signature schemes chosen for standardization by NIST all suffer from performance issues; they are computationally slower and consume much more bandwidth than the current standards we use today, such as ECDSA. Thus, for some applications and protocols such as TLS, switching to PQ signatures has the potential to severely increase latency and reduce throughput.https://cryptographycaffe.sandboxaq.com/posts/sdith-blog/Tue, 25 Apr 2023 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/sdith-blog/“Binary codes in the head of human in the style of pop art” by DALL-E2. Context: a new scheme Digital signature algorithms are a cornerstone of modern information security. The padlock in your toolbar when reading this blog post indicates that your computer has authenticated the identity of the www.sandboxaq.com server via TLS. Such authentication is ubiquitous in communication protocols throughout the internet networking stack and crucially relies on digital signatures.https://cryptographycaffe.sandboxaq.com/posts/turbo-tls/Wed, 19 Apr 2023 00:00:00 +0000https://cryptographycaffe.sandboxaq.com/posts/turbo-tls/“A fast padlock rocket from a distance in the style of cyber punk” by DALL-E2. Expert readers already familiar with transport and security protocols should skip to Summary for Expert Readers, at the bottom. TurboTLS: TLS connection establishment with 1 less round trip What proportion of network data is encrypted? Today it stands at a little over 95%, by the best estimates. A decade ago, Google estimated it was less than 50%.https://cryptographycaffe.sandboxaq.com/posts/adversarial-chatgpt/Tue, 11 Apr 2023 00:00:00 -0923https://cryptographycaffe.sandboxaq.com/posts/adversarial-chatgpt/“A painting of a group of AI robots shielding themselves from a group of humans in the style of Magritte” by DALL-E. Multiple Large Language Models (LLM) have emerged in recent years, quickly scaling up the number of parameters from BERT [1] with 340 million in 2018 to GPT-3 [2] and its 175 billion in 2022. Most recently, language models have been trained using more than 500 billion parameters in LLMs, such as PaLM [3] and GPT-4 [4].https://cryptographycaffe.sandboxaq.com/posts/ntt-01/Wed, 22 Mar 2023 23:46:00 -0800https://cryptographycaffe.sandboxaq.com/posts/ntt-01/“A Monet painting of convolution” by DALL-E. Polynomial Multiplications as Convolutions Polynomials are everywhere. In fact, in Computer Science, they are really just fancy lists of numbers that have a particular way of doing arithmetic. For example, adding two polynomials is as simple as just summing up their coefficients. Multiplying a polynomial by a constant is just multiplying every coefficient by that constant. However, when we want to multiply polynomials, things get slightly more complicated.https://cryptographycaffe.sandboxaq.com/posts/kyber-sca/Fri, 10 Mar 2023 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/kyber-sca/“A thief listening to a computer with a stethoscope, in the style of Rembrant” by DALL-E. In response to the threat that quantum computers pose to public key cryptography, NIST is conducting a standardization process for post-quantum secure public key encryption and encapsulation schemes. Kyber, so far, is the only one recommended for standardization (besides the other three algorithms that have been selected for digital signatures). Side-channel attack claims (1,2) on Kyber have prompted news outlets and social media to raise alarms regarding Kyber’s security (4).https://cryptographycaffe.sandboxaq.com/posts/cryptoagility-meets-cybersec/Tue, 10 Jan 2023 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/cryptoagility-meets-cybersec/“An oil painting of a hacker trying to steal data from a company” by DALL-E. Cryptography is an essential element in the protection of data and communications in any modern company. What type of cryptography to use and how easy it is to adapt it to new algorithmic developments, new architectures or new products necessities is a challenge that must be tackled relentlessly. We summarize this concern and opportunity with the term crypto-agility.https://cryptographycaffe.sandboxaq.com/posts/kyber-01/Wed, 30 Nov 2022 18:46:42 -0800https://cryptographycaffe.sandboxaq.com/posts/kyber-01/“A picasso drawing of Alice delivering a shared secret to Bob using CRYSTALS-Kyber cryptosystem” by DALL-E. 0. Preface CRYSTALS-Kyber, or simply Kyber, is a key encapsulation mechanism (KEM) selected by NIST as its first KEM standard for resistance against a powerful, quantum adversary, an area generally referred to as Post-Quantum Cryptography (PQC). In this series of blog posts, we will look into how Kyber works under the hood and use Python to build Kyber from the ground up.https://cryptographycaffe.sandboxaq.com/posts/fido2/Tue, 22 Nov 2022 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/fido2/“an oil painting of a scientist logging into a website” by DALL-E. Weak passwords are a major security vulnerability in today’s Internet. To tackle this issue, the Fast IDentity Online (FIDO) Alliance set out to define a secure protocol for passwordless identity authentication using ‘security devices’, such as smartphones or dedicated USB or NFC hardware tokens. With over forty key companies, including Amazon, Apple, Google, Intel, Microsoft, RSA, VISA, and Yubico, the FIDO Alliance has improved secure log in for the wider public, enterprise employees, and government members.https://cryptographycaffe.sandboxaq.com/posts/lighting-the-signal/Fri, 23 Sep 2022 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/lighting-the-signal/“drawing of a female scientist breaking code by lighting the signal as Van Gogh” by DALL-E. Key exchange is one of the fundamental building blocks that Internet security is built upon. The goal of key exchange is for two parties – often called Alice and Bob – to do computations such that at the end they agree on a shared secret key. This key is then used to encrypt messages using symmetric encryption.https://cryptographycaffe.sandboxaq.com/posts/pqc-attacks/Tue, 20 Sep 2022 00:00:00 -0800https://cryptographycaffe.sandboxaq.com/posts/pqc-attacks/“An oil drawing of a cryptographer breaking codes for SIKE and Rainbow” by DALL-E. Since the NIST PQC standardization effort began in 2017, there have been numerous attacks on the potential cryptography standards. Amongst the 82 initial submissions, 69 were accepted by NIST for being ‘complete and proper’. Of the schemes that were not accepted to Round 1, some were withdrawn by the authors, and some were attacked quite devastatingly; for example, the ciphertext in one encryption scheme candidate could be decoded without knowing the secret key!