(untitled)
From the "things that would have been too much effort before but take no time with LLMs and exe.dev" category.
Filippo Valsorda
Public posts from @filippo@abyssdomain.expert
Latest posts
(untitled)
Huh, it’s not every day that an LLM suggests on the issue tracker a low-hanging fruit change that saves 30% on X25519 handshakes. We already had a much faster edwards25519 fixed-base scalar mult, which can be used for half of ECDH with a small mapping. (The other half of X25519 is “special.”) https:// go-review.googlesource.com/c/g o/+/814601
(untitled)
Made a little nice monitoring tool for CT logs. https:// uptime.geomys.org/ct/ When queried, it submits a per-minute deterministic precert to the log, checks the SCT, fetches the STH, checks inclusion of the SCT, returns 200 if all is good. I'm generally a big fan of prod end-to-end testing. https:// groups.google.com/a/chromium.o rg/g/ct-policy/c/RcKh1_LxoB0/m/_oS4OcuOCwAJ
(untitled)
On Saturday night, one of our CT logs rejected most submissions for 30 minutes. I just published the post-mortem, and the investigation was... a lot of fun? It involves Go mutex starvation, SQLite WAL behavior, and ZFS record sizes. I got to SIGKILL a VM 200 times, implement a turnstile (TIL!), and order a Nokia flip phone. https:// groups.google.com/a/chromium.o…
(untitled)
It’s very clear by now that if LLMs are not improving your software quality it’s either a revealed preference (yours or your org’s) for more volume vs more quality, or a skill issue. The level of testing and review they are enabling in the Go cryptography standard library is amazing.
(untitled)
After a year and a quarter of operating the Tuscolo Certificate Transparency log (with a total of 8 minutes of planned downtime)... I am happy to announce the second Geomys CT log: Trastevere! It's basically identical, except it's a Dell PowerEdge R6515 racked in @ seeweb 's Frosinone, Italy datacenter. https:// groups.google.com/a/chromium.o…
(untitled)
It's not my usual beat, but I wrote a pure-Python ML-DSA verifier. pip install mldsa It's 350 lines, CC0/0BSD, single-file, no dependencies, and thoroughly tested. Signature verification handles no secrets, so it doesn't need to be constant-time. https:// words.filippo.io/mldsa-py/
(untitled)
Passkeys can be stored just like password hashes! I'm proposing an interoperable $webauthn$v=1$… format, and a Go API that uses these passkey records for authentication. I'm looking for feedback before proposing this as crypto/passkey for Go 1.28! https:// words.filippo.io/passkey-recor d/
(untitled)
"Could you support $SMALL_TWEAK? We need it for $OBSCURE_PROTOCOL. It's very small! Why not?? Do you hate us?" Here is a bunch of work to fix assembly that assumed it could overread/write the AES-GCM ciphertext because it'd be followed by 16 bytes of tag, but we regrettably support custom tag sizes. https:// go.dev/cl/801600 (Also, what I think are some pretty cool systematic page-faulting tests.)
(untitled)
Setting up Gerrit on exe.dev with X-ExeDev-Email auth took 60s! However, that doesn't make git work. I hacked together a little proxy that does a tiny amount of OAuth2, exchanging exe.dev auth in the browser for a token that works with git-credential-oauth. https:// github.com/filippo-claude/gerr it-exedev-auth-proxy
(untitled)
The endless long tail of the post-quantum transition includes: Apple Business encrypts FileVault recovery keys to a customer-generated RSA public key. There's a literal "openssl req -newkey rsa:2048" in the docs. https:// support.apple.com/guide/busine ss/filevault-configuration-axm1dd824baf/web
(untitled)
https:// securitycryptographywhatever.c om/2026/03/25/ai-bug-finding/ is very very good. If you read my vulnerabilities post, this podcast episode is much more worth listening to.
(untitled)
We all know vulnerability reports are not like ordinary issues. But why? It comes down to needing the scarce insight and temporary confidentiality to protect users. However, now that LLMs can find more or less the same bugs for everyone, none of that matters, and vulnerability reports are not special anymore. https:// words.filippo.io/vuln-reports/
(untitled)
There we go. US Government tightens post-quantum cryptography transition deadlines for high-value systems to 2030 for key exchange and 2031 for signatures. Also, speeding up the CMVP (FIPS 140 validation) processes. That’s how you know the rush is real. The quantum computers are (potentially) coming. https://www. whitehouse.gov/presidential-ac…
(untitled)
In 2020, OpenSSL had a vulnerability in handling the signature_algorithms_cert extension. https:// openssl-library.org/news/secad v/20200421.txt Palo Alto apparently "solved" this in their IPS by blocking connections with "unknown" algs in signature_algorithms_cert. Six years later, we can't add ML-DSA to signature_algorithms_cert in Go. signature_algorithms_cert is dead. Sigh. Thanks to @ cks for…
(untitled)
There's been some confusion around some BRs non-compliant X.509 chains that OpenSSL accepts but Go rejects. We're not going to introduce complexity in crypto/x509 to support them, but I realized you could always re-encode the issuer as an unsigned root to work around it. So I made a little web tool to make it easy. https:// github.com/golang/go/issues/31 440#issuecomment-4663196149
(untitled)
Can you see how to use a test vector that provides (seed, public key, message, µ, signature) to test a deterministic signing API that does (seed, message) → (signature) or a key generation API that does (seed) → (public key)? Noted cryptographer D. J. Bernstein can't, certainly in good faith. *sigh* I jest, but refuting this FUD takes real resources we could spend so, so, so much better. It'd be…
(untitled)
I am live with Alex Gaynor to talk about the Geomys model of professional open source maintenance and how it helps projects face challenges, like the recent influx of LLM vulnerability findings! Join us live on https://www. twitch.tv/filosottile right now or catch the recording soon!
(untitled)
Looks like GitHub silently corrupted some index. PR #237 definitely exists and is closed ( https:// github.com/C2SP/C2SP/pull/237 ) but is just... not in the list ( https:// github.com/C2SP/C2SP/pulls?q=i s%3Apr+is%3Aclosed ) regardless of filters. I briefly doubted my own sanity. This is bad.
(untitled)
A brief timeline of the Go FIPS 140-3 validation: - February 2024: first prospectus - March 2024: started working with lab - July 2024: first contract - September 2024: opened issue - January 2025: froze module - May 2025: submitted validation - April 2026: certificate issued
(untitled)
If you'd like, you can buy a number of services from us, including rebrands and listed Operating Environments: https:// geomys.org/fips140 However, you don't have to. Our certificate has one of the broadest list of tested environments (and algorithms) of the industry, and you can just use it with stock Go 1.24+ and GOFIPS140=v1.0.0, courtesy of Geomys. Because the point was removing this roadblock…