Sign in

Nick Sullivan

@nicksullivan.org
968 followers 882 following 107 posts

Asymmetries in action

PostsRepliesMedia
Nick Sullivan @nicksullivan.org · 04/09/2026
We've extended the deadline by a week. You've got until 11 September. The submissions have been amazing so far, it should be a great event. You can choose whether we publish your paper or proposal in the proceedings or keep it for the in-person conversation. www.ietf.org/blog/iab-pq-...
ietf.org
Post-Quantum Authentication: Up Next
Post-quantum key establishment has moved from standards into deployment. Post-quantum authentication has not moved nearly as far, and specification work is no longer the only constraint. The IAB is ho...
020
Nick Sullivan @nicksullivan.org · 21/08/2026
The IAB is running a workshop on deploying post-quantum authentication, the harder, lagging half of the PQ transition: certs, HSMs, identity, firmware & software signing. Prague, Oct 11–12, co-located with OpenSSL. CFP + how to submit (by Sep 4): datatracker.ietf.org/group/pqws/a...
datatracker.ietf.org
IAB Workshop on Accelerating the Deployment of Post-Quantum Authentication (pqws)
030
Reposted by Nick Sullivan
Mark X @markmx.bsky.social · 30/07/2026
Great news! Germ DM is now quantum secure! We’re deploying post-quantum cryptography (PQC) in 3.0.9, available today. 1/7
22810
Nick Sullivan @nicksullivan.org · 24/07/2026
If you weren't aware, I had a small part in helping design TLS 1.3 back in the day. Today, I presented some new work at the TLS working group meeting in Vienna to upgrade its the key schedule from SHA-2 (the workhorse) to Keccak, the algorithm behind SHA-3. www.ietf.org/archive/id/d...
ietf.org
XOF-based key schedules for TLS 1.3
TLS 1.3 runs its entire key schedule on HKDF over SHA-2. This document defines an extension that replaces that schedule with one built on an extendable-output function (XOF): the negotiated KDF gove...
0111
Nick Sullivan @nicksullivan.org · 11/07/2026
Second: a concrete instantiations document specifying secure parameters and test vectors for the most requested combinations for use in internet protocols (x25519, NIST EC curves) × ML-KEM. www.ietf.org/archive/id/d...
ietf.org
Concrete Hybrid PQ/T Key Encapsulation Mechanisms
PQ/T Hybrid Key Encapsulation Mechanisms (KEMs) combine "post-quantum" cryptographic algorithms, which are safe from attack by a quantum computer, with "traditional" algorithms, which are not. CFRG h...
020
Nick Sullivan @nicksullivan.org · 11/07/2026
This last call includes two documents: First: a generic combiners document that defines a general framework for combining supported by peer-reviewed research. Two combiners are defined: one universal, one optimized for KEMs with specific, strong binding properties. www.ietf.org/archive/id/d...
ietf.org
Hybrid PQ/T Key Encapsulation Mechanisms
This document defines generic constructions for hybrid Key Encapsulation Mechanisms (KEMs) based on combining a post-quantum (PQ) KEM with a traditional cryptographic component. Hybrid KEMs built usin...
110
Nick Sullivan @nicksullivan.org · 11/07/2026
The CFRG is holding a last call for two documents on hybrid KEMs: a mechanism that lets you safely combine a post-quantum KEM and a classical algorithm into a single construction. mailarchive.ietf.org/arch/msg/cfr... Reply on-list if you agree this should be published or have technical concerns.
mailarchive.ietf.org
[CFRG] RG Last Call on draft-irtf-cfrg-hybrid-kems-12 and draft-irtf-cfrg-concrete-hybrid-kems-04
Search IETF mail list archives
231
Nick Sullivan @nicksullivan.org · 08/07/2026
Agreed. The argument that the distinctions are somehow unknowable by implementers (“all we need is an RFC”) is more potent than the argument that the ISE vs IETF distinction is knowable (“gost bad”) but the informational/standards track distinction is not is what I’m complaining about. RTFM.
000
Nick Sullivan @nicksullivan.org · 07/07/2026
It feels disingenuous to recognize the difference between an informational RFC published by the IETF and the Independent Submission stream, but not recognize the difference between standards track and informational RFCs. Is an RFC and RFC, or do you care about the Category: and Stream: at the top?
110
Nick Sullivan @nicksullivan.org · 28/04/2026
The next step is not just deploying ECH. It is making sure ECH can actually start. cdt.org/insights/dis...
cdt.org
Distributing the Keys for Private Access to the Web
Breaking the DNS Dependencych-22" class="toc-anchor">ECH’s Catch-22thing-strange-in-the-dns" href="#something-strange-in-the-dns" class="toc-anchor">Something Strange in the DNS use it. That’s the fun...
050
Nick Sullivan @nicksullivan.org · 28/04/2026
ECH is one of the most important privacy improvements happening in the web platform. But if we want it to work for the people most likely to face network interference, configuration delivery has to be treated as a first-class part of the problem.
140
Nick Sullivan @nicksullivan.org · 28/04/2026
Well-known endpoints, cached configurations, CDN distribution, key transparency mechanisms, and signed ECH configurations are all part of that design space. This is not a reason to give up on ECH. It is a reason to make ECH more deployable under pressure.
100
Nick Sullivan @nicksullivan.org · 28/04/2026
The natural question is whether ECH configurations need to be tied so tightly to DNS. DNS currently handles both distribution and authentication. If those functions can be separated, ECH configs could be distributed through other paths and still verified.
100
Nick Sullivan @nicksullivan.org · 28/04/2026
This is a recurring lesson of Internet security. Cryptography is necessary, but it is not the whole system. Discovery, distribution, caching, fallback behavior, and downgrade resistance are part of the security architecture too.
152
Nick Sullivan @nicksullivan.org · 28/04/2026
That matters for ECH because a censor does not need to break the TLS handshake if it can prevent the client from obtaining the ECH configuration in the first place. The failure happens before the privacy property turns on.
100
Nick Sullivan @nicksullivan.org · 28/04/2026
DNS-over-TLS can be blocked outright. DNS-over-HTTPS is harder to block cleanly because it runs over HTTPS, but it can still be identified and degraded. The result is often not a crisp failure. It is flakiness, temporary blocking, and users giving up.
100
Nick Sullivan @nicksullivan.org · 28/04/2026
China is the clearest example. The Great Firewall has a long history of DNS injection and poisoning. Encrypted DNS changes the mechanics, but not the basic incentive to control the discovery path.
100
Nick Sullivan @nicksullivan.org · 28/04/2026
Today, that configuration usually comes from DNS. In normal network conditions, that is a clean design. In censorship environments, it is an obvious pressure point.
100
Nick Sullivan @nicksullivan.org · 28/04/2026
ECH is designed to close one of the last major metadata leaks in HTTPS: the website name exposed in the TLS ClientHello. But before a browser can encrypt that part of the handshake, it needs the server’s ECH configuration.
100
Nick Sullivan @nicksullivan.org · 28/04/2026
Every lock needs a key. The hard part is not always designing the lock. Sometimes it is getting the key to the person who needs it. That is the problem I look at in the third post in my CDT series on Encrypted Client Hello. cdt.org/insights/dis...
cdt.org
Distributing the Keys for Private Access to the Web
Breaking the DNS Dependencych-22" class="toc-anchor">ECH’s Catch-22thing-strange-in-the-dns" href="#something-strange-in-the-dns" class="toc-anchor">Something Strange in the DNS use it. That’s the fun...
161
Nick Sullivan @nicksullivan.org · 14/04/2026
I'm in Toronto discussing how websites can specify their preferences regarding how their content is used by search engines and AI crawlers. Here's what we have so far:
090
Nick Sullivan @nicksullivan.org · 09/04/2026
Want to help shape the cryptography that ends up in Internet standards? CFRG is looking for Crypto Review Panel members. Self-nominations welcome. Two-year renewable term. Send nominations by April 20: cfrg-chairs@ietf.org wiki.ietf.org/group/cfrg/C...
wiki.ietf.org
Crypto Review Panel
023
Nick Sullivan @nicksullivan.org · 07/04/2026
Also: new draft work on authenticated ECH config distribution and rotation with Dennis Jackson and Alessandro Ghedini, plus interop work here: www.ietf.org/archive/id/d... github.com/grittygrease...
github.com
GitHub - grittygrease/ech-auth-interop
Contribute to grittygrease/ech-auth-interop development by creating an account on GitHub.
010
Nick Sullivan @nicksullivan.org · 07/04/2026
That is why signed ECH config updates are interesting. The goal is not just "more crypto." The goal is to remove the deployment constraint that created a stable fingerprint in the first place.
111
Nick Sullivan @nicksullivan.org · 07/04/2026
This is the deployment lesson: privacy is not just about cryptographic correctness. It is about operational indistinguishability too. Rollout paths, retry paths, and recovery paths all matter.
111
Nick Sullivan @nicksullivan.org · 07/04/2026
That meant protected traffic still had a cheap classification handle. In other words: ECH stopped sticking out at one layer, and started sticking out at another.
110
Nick Sullivan @nicksullivan.org · 07/04/2026
But real deployments still created a visible pattern. The issue was not the ECH extension. It was config update and recovery behavior, which pushed clients toward a common outer name in the clear.
111
Nick Sullivan @nicksullivan.org · 07/04/2026
GREASE did part of that job. It made ECH-shaped traffic common, so the syntax itself did not stand out.
100
Nick Sullivan @nicksullivan.org · 07/04/2026
ECH's design goal is "do not stick out." The basic idea is simple: if encrypted connections all look similar, it is harder to classify, monitor, and block them.
120
Nick Sullivan @nicksullivan.org · 07/04/2026
ECH exposed a hard truth about privacy technology: you can win at the protocol layer and still lose at the deployment layer. I wrote about it here: cdt.org/insights/do-...
cdt.org
Do Not Stick Out: The Dynamics of the ECH Rollout
Lessons Learned-ech-traffic-stuck-out" href="#why-ech-traffic-stuck-out" class="toc-anchor">Why ECH Traffic Stuck Out">The Paradox of Privacy Adoption: Standing Out to Disappearss="toc-anchor">Case St...
285
Nick Sullivan @nicksullivan.org · 17/03/2026
www.platformer.news/instagram-en...
platformer.news
Why Meta is retreating from encryption
In 2019, Mark Zuckerberg called privacy the future of social networking. Not anymore
010
Nick Sullivan @nicksullivan.org · 11/03/2026
I had a wonderful time at RWC again this year. What a lovely group of people.
040
Reposted by Nick Sullivan
Real World Crypto Symposium @rwc.iacr.org · 10/03/2026
The room gets philosophical. Cryptography & Society chaired by Nick Sullivan ( @nicksullivan.org ): what is crypto hiding from itself? Security vs. interoperability? CRA policy? Proofs that aren't enough? And Nadim Kobeissi on teaching crypto in post-crisis Lebanon. #realworldcrypto
184
Nick Sullivan @nicksullivan.org · 08/03/2026
I’m back in Taipei for Real World Crypto, then Tokyo next week for IETF by proxy. Let me know if you’re around!
030
Nick Sullivan @nicksullivan.org · 04/03/2026
Encrypted Client Hello is now RFC 9849 This RFC defines an extension to Transport Layer Security that improves privacy for web users. Huge team effort and a win for the internet at large. Now to get deployment up... Some words I wrote about this for @cdt.org: cdt.org/insights/enc...
cdt.org
Encrypted Client Hello: Closing the SNI Metadata Gap
Referencesent-deployment-and-adoption" href="#current-deployment-and-adoption" class="toc-anchor">Current Deployment and Adoptionor">Trial by Firewall-security-systems" href="#adapting-network-securit...
03010
Nick Sullivan @nicksullivan.org · 01/03/2026
I put together a job site for cryptography roles. It's in alpha, so please send me your bugs! jobs.cryptography.consulting
jobs.cryptography.consulting
CryptoJobs - Cryptography Career Opportunities
The definitive job board for cryptography professionals. Find opportunities in post-quantum cryptography, zero-knowledge proofs, HSM, TLS/PKI, and applied cryptographic research.
0123
Nick Sullivan @nicksullivan.org · 27/01/2026
USENIX Enigma has published its CFP for 2026: www.usenix.org/conference/u... Submissions are due March 31, 2026. Looking forward to seeing many of you this year.
usenix.org
USENIX Security '26 Enigma Track Call for Participation
USENIX Security brings together researchers, practitioners, system programmers, and others to share and explore the latest advances in the security and privacy of computer systems and networks.
013
Nick Sullivan @nicksullivan.org · 27/01/2026
I’m happy to be joining the USENIX Security ’26 Enigma organizing committee this year, after having the chance to speak at Enigma three times. It has a long history as a home for early, practice-driven security ideas, often where work first gets aired before it’s fully polished or widely deployed.
110
Nick Sullivan @nicksullivan.org · 15/01/2026
Software has eaten the world. Banks, hospitals, power grids, planes. If the ground liquefies, everything built on it sinks. We're not talking about bad code anymore. We're talking about infrastructure failure at scale.
000
Nick Sullivan @nicksullivan.org · 15/01/2026
Liquefaction is what happens when shaking meets saturated ground. The soil loses structure and behaves like liquid. Buildings sink. In software: unverified code + relentless velocity + strained review = a codebase that can't hold weight.
120
Nick Sullivan @nicksullivan.org · 15/01/2026
And verification doesn't scale for free. 38% say reviewing AI code takes *more* effort than human code. Werner Vogels calls this verification debt. It compounds silently until something breaks. 🔗 buildwithaws.substack.com/p/werner-vog...
100
Nick Sullivan @nicksullivan.org · 15/01/2026
Same survey: 96% of devs don't fully trust AI output. But only 48% say they always verify before committing. That gap is where bugs live. That gap is where security dies. 🔗 www.sonarsource.com/company/pres...
210
Nick Sullivan @nicksullivan.org · 15/01/2026
Here's where it gets uncomfortable. Devs now say ~42% of their code is AI-generated. Projected to hit 65% by 2027. The codebase is becoming porous. 🔗 www.sonarsource.com/company/pres...
100
Nick Sullivan @nicksullivan.org · 15/01/2026
AI isn't coming; it's already in the pipes. Over 1.1M public repos now depend on an LLM SDK. Almost 700K of those appeared in the last 12 months alone. +178% YoY. 🔗 github.blog/news-insight...
100
Nick Sullivan @nicksullivan.org · 15/01/2026
Forget counting lines. Watch the flow. GitHub saw 518M pull requests merged in 2025, up 29% from the year before. That's not growth, that's a flood. 🔗 github.blog/news-insight...
100
Nick Sullivan @nicksullivan.org · 15/01/2026
Software Heritage archived over 22 billion unique source files by end of 2024. That's just public code they could find. The real number is unknowable, and growing faster than anyone can track. 🔗 annex.softwareheritage.org/public/annua...
100
Nick Sullivan @nicksullivan.org · 15/01/2026
Here's the scale we're dealing with: roughly 2.8 trillion lines of code written in the last 20 years. A huge chunk of that? Just the last two. The acceleration is the story. 🔗 medium.com/modern-stack...
100
Nick Sullivan @nicksullivan.org · 15/01/2026
AI coding is an earthquake for software security. Not a tremor. The kind that liquefies the ground beneath your feet. We're mid-shake and most people are still debating if it's real. 🔗 github.blog/news-insight...
141
Reposted by Nick Sullivan
Real World Crypto Symposium @rwc.iacr.org · 09/01/2026
Registration for Real World Crypto 2026 is now open! rwc.iacr.org/2026/registr...
rwc.iacr.org
RWC 2026 registration
Real World Crypto Symposium
183
Nick Sullivan @nicksullivan.org · 09/01/2026
Also, sign up for my upcoming mailing list! Occasional, high-signal updates: tally.so/r/2EBz4D
tally.so
Mailing List Subscribe
Made with Tally, the simplest way to create forms.
000