Daniel J. Bernstein

Designing cryptography (deployed now: X25519, Ed25519, ChaCha20, sntrup, Classic McEliece) to proactively reduce risks. Coined phrase "post-quantum" in 2003.

Microblog (including tweet archive): https://microblog.cr.yp.to
Blog: https://blog.cr.yp.to

Last Notes

2026-06-29 11:35:34 CEST

"There is no formal membership in the IETF. Participation is open to all. This participation may be by on-line contribution, attendance at face-to-face sessions, or both." (source: IETF's official working-group procedures, https://web.archive.org/web/20251217213247/https://www.rfc-editor.org/rfc/rfc2418.html)

2026-06-29 10:16:55 CEST

NSA lost IETF's February 2026 vote on this NSA-driven document. See https://blog.cr.yp.to/20260405-votes.html for tallies. Do they admit what happened? No. They call another vote and try hard to pack the room with new pro-NSA voters. But if we show up and object, all they can do is whimper.

2026-06-29 09:40:59 CEST

Unhappy with NSA's SIGINT Enabling Project sabotaging cryptographic standards? This week you can take action to register an objection with IETF regarding an NSA-funded project to standardize ietf-tls-mlkem, a weakened version of ietf-tls-ecdhe-mlkem: https://nsa.2026.action.cr.yp.to/

2025-10-21 20:14:48 CEST

Impressed with the level of compatibility of the new memory-safe C/C++ compiler Fil-C (filcc, fil++; https://fil-c.org/) based on clang. Many libraries and applications that I've tried work under Fil-C without changes, and the exceptions haven't been hard to get working.

2025-07-17 20:10:32 CEST

Quantum computers haven't factored anything interesting yet. Peter Gutmann concludes that quantum computing is "not getting anywhere" (https://www.theregister.com/2025/07/17/quantum_cryptanalysis_criticism/). The same logic 70 years ago would have said we'll never land on the Moon. More on this analogy: https://blog.cr.yp.to/20250118-flight.html#moon

2025-04-24 11:07:22 CEST

The gcc/clang excuse for changing program behavior, often introducing bugs and security holes (see https://www.usenix.org/system/files/usenixsecurity23-xu-jianhao.pdf), is performance. But a new paper https://web.ist.utl.pt/nuno.lopes/pubs/ub-pldi25.pdf modifies clang to eliminate most (all?) such changes, and finds negligible effect on benchmarks.

2025-01-18 19:15:58 CET

New blog post https://blog.cr.yp.to/20250118-flight.html "As expensive as a plane flight: Looking at some claims that quantum computers won't work." #quantum #energy #variables #errors #rsa #secrecy

2024-12-27 19:45:27 CET

- reply

Thanks for trying it out! There's a "Compatibility" channel on https://zulip.pqconnect.net for "What works; what doesn't work yet; workarounds". If you post a description there of what you typed to set up your test, what you expected to see, and what you saw instead, then presumably we'll be able to get things working.

2024-12-27 16:07:56 CET

- reply

The software automatically avoids address conflicts. It also has an option to configure the local-network choice (e.g., pqconnect -a 192.168.15.1 -m 24) for sysadmins who prefer full control. NAT doesn't meet some conceptions of beauty in network design, but it's useful for privacy, and it's how billions of people use the Internet.

2024-12-27 14:27:33 CET

Pleased to announce PQConnect: https://www.pqconnect.net Easy-to-install software for your Linux box (more OSes coming later) to protect network applications against future quantum computers. Paper will appear at NDSS 2025. Joint work with @npub129e…eefk, Jonathan Levin, Bo-Yin Yang.

2024-09-10 16:51:15 CEST

IETF: "Pervasive Monitoring Is an Attack... The IETF Will Work to Mitigate Pervasive Monitoring". Also IETF: ~"It's perfectly fine that we had an NSA employee co-chairing IRTF's Crypto Forum Research Group, and that we now have an NSA employee as IETF Security Area Director."