Daniel J. Bernstein

Designing cryptography (deployed now: X25519, Ed25519, ChaCha20, sntrup, Classic McEliece) to proactively reduce risks. Coined phrase "post-quantum" in 2003.

Microblog (including tweet archive): https://microblog.cr.yp.to
Blog: https://blog.cr.yp.to

Last Notes

2026-10-12 18:20:43 UTC

Like you, I have a job trying to solve real-world problems. Did you realize how much of our tax money goes to pure mathematicians wandering around inventing and understanding pointless theory stuff like this PDF? https://web.archive.org/web/20031205035441/https://mast.queensu.ca/~kani/papers/numgenl.pdf Oh, oops, wait: https://www.quantamagazine.org/post-quantum-cryptography-scheme-is-cracked-on-a-laptop-20220824/

2026-07-30 06:33:55 UTC

SHA-512 hash: 6674cf422ca5356e3a189eca7fb01cc511ee34194ae8f654e58491f4e01a480d095c2057a2316f479976155c752cc03029b9fab3d6ca18cc677403946c04f4e8

2026-06-29 09:35:34 UTC

"There is no formal membership in the IETF. Participation is open to all. This participation may be by on-line contribution, attendance at face-to-face sessions, or both." (source: IETF's official working-group procedures, https://web.archive.org/web/20251217213247/https://www.rfc-editor.org/rfc/rfc2418.html)

2026-06-29 08:16:55 UTC

NSA lost IETF's February 2026 vote on this NSA-driven document. See https://blog.cr.yp.to/20260405-votes.html for tallies. Do they admit what happened? No. They call another vote and try hard to pack the room with new pro-NSA voters. But if we show up and object, all they can do is whimper.

2026-06-29 07:40:59 UTC

Unhappy with NSA's SIGINT Enabling Project sabotaging cryptographic standards? This week you can take action to register an objection with IETF regarding an NSA-funded project to standardize ietf-tls-mlkem, a weakened version of ietf-tls-ecdhe-mlkem: https://nsa.2026.action.cr.yp.to/

2025-10-21 18:14:48 UTC

Impressed with the level of compatibility of the new memory-safe C/C++ compiler Fil-C (filcc, fil++; https://fil-c.org/) based on clang. Many libraries and applications that I've tried work under Fil-C without changes, and the exceptions haven't been hard to get working.

2025-07-17 18:10:32 UTC

Quantum computers haven't factored anything interesting yet. Peter Gutmann concludes that quantum computing is "not getting anywhere" (https://www.theregister.com/2025/07/17/quantum_cryptanalysis_criticism/). The same logic 70 years ago would have said we'll never land on the Moon. More on this analogy: https://blog.cr.yp.to/20250118-flight.html#moon

2025-04-24 09:07:22 UTC

The gcc/clang excuse for changing program behavior, often introducing bugs and security holes (see https://www.usenix.org/system/files/usenixsecurity23-xu-jianhao.pdf), is performance. But a new paper https://web.ist.utl.pt/nuno.lopes/pubs/ub-pldi25.pdf modifies clang to eliminate most (all?) such changes, and finds negligible effect on benchmarks.

2025-01-18 18:15:58 UTC

New blog post https://blog.cr.yp.to/20250118-flight.html "As expensive as a plane flight: Looking at some claims that quantum computers won't work." #quantum #energy #variables #errors #rsa #secrecy

2024-12-27 18:45:27 UTC

- reply

Thanks for trying it out! There's a "Compatibility" channel on https://zulip.pqconnect.net for "What works; what doesn't work yet; workarounds". If you post a description there of what you typed to set up your test, what you expected to see, and what you saw instead, then presumably we'll be able to get things working.

2024-12-27 15:07:56 UTC

- reply

The software automatically avoids address conflicts. It also has an option to configure the local-network choice (e.g., pqconnect -a 192.168.15.1 -m 24) for sysadmins who prefer full control. NAT doesn't meet some conceptions of beauty in network design, but it's useful for privacy, and it's how billions of people use the Internet.

2024-12-27 13:27:33 UTC

Pleased to announce PQConnect: https://www.pqconnect.net Easy-to-install software for your Linux box (more OSes coming later) to protect network applications against future quantum computers. Paper will appear at NDSS 2025. Joint work with @npub129e…eefk, Jonathan Levin, Bo-Yin Yang.

2024-09-10 14:51:15 UTC

IETF: "Pervasive Monitoring Is an Attack... The IETF Will Work to Mitigate Pervasive Monitoring". Also IETF: ~"It's perfectly fine that we had an NSA employee co-chairing IRTF's Crypto Forum Research Group, and that we now have an NSA employee as IETF Security Area Director."