Thom Wiggers
LightNews LightNews
thom.wggrs.nl
Thom Wiggers
@thom.wggrs.nl
58 followers 36 following 3 posts
Post-Quantum cryptography
Posts Replies Media Videos
Reposted by Thom Wiggers
sifu.tweety.fish
cloudflare's on-duty IT staff bangs on the doors which I have padlocked from the inside as I calmly break open lava lamp after lava lamp and drink the contents
November 18, 2025 at 1:59 PM
Reposted by Thom Wiggers
signal.org
In 2023, Signal was the first mainstream messenger to enable post-quantum cryptography. We’re still ahead of the (elliptical) curve, implementing a new hybrid PQ ratchet ensuring Forward Secrecy & Post-Compromise Security even in a post-quantum world. signal.org/blog/spqr/
Signal Protocol and Post-Quantum Ratchets
We are excited to announce a significant advancement in the security of the Signal Protocol: the introduction of the Sparse Post Quantum Ratchet (SPQR). This new ratchet enhances the Signal Protocol’s...
signal.org
October 2, 2025 at 4:09 PM
Reposted by Thom Wiggers
eprint.ing.bot
Revisiting PQ WireGuard: A Comprehensive Security Analysis With a New Design Using Reinforced KEMs (Keitaro Hashimoto, Shuichi Katsumata, Guilhem Niot, Thom Wiggers) ia.cr/2025/1758
Abstract. WireGuard is a VPN based on the Noise protocol, known for its high performance, small code base, and unique security features. Recently, Hülsing et al. (IEEE S&P’21) presented post-quantum (PQ) WireGuard, replacing the Diffie-Hellman (DH) key exchange underlying the Noise protocol with key-encapsulation mechanisms (KEMs). Since WireGuard requires the handshake message to fit in one UDP packet of size roughly 1200 B, they combined Classic McEliece and a modified variant of Saber. However, as Classic McEliece public keys are notoriously large, this comes at the cost of severely increasing the server’s memory requirement. This hinders deployment, especially in environments with constraints on memory (allocation), such as a kernel-level implementations. In this work, we revisit PQ WireGuard and improve it on three fronts: design, (computational) security, and efficiency. As KEMs are semantically, but not syntactically, the same as DH key exchange, there are many (in hindsight) ad-hoc design choices being made, further amplified by the recent finding on the binding issues with PQ KEMs (Cremers et al., CCS’24). We redesign PQ WireGuard addressing these issues, and prove it secure in a new computational model by fixing and capturing new security features that were not modeled by Hülsing et al. We further propose ‘reinforced KEM’ (RKEM) as a natural building block for key exchange protocols, enabling a PQ WireGuard construction where the server no longer needs to store Classical McEliece keys, reducing public key memory by 190 to 390×. In essence, we construct a RKEM named ‘Rebar’ to compress two ML-KEM-like ciphertexts which may be of an independent interest. Image showing part 2 of abstract.
September 26, 2025 at 2:28 AM
Reposted by Thom Wiggers
eprint.ing.bot
Concrete Treatment of Signal Handshake’s Deniability: Efficient Post-Quantum Deniable Ring Signature (Shuichi Katsumata, Guilhem Niot, Ida Tucker, Thom Wiggers) ia.cr/2025/1090
Abstract. The Signal protocol relies on a handshake protocol, formerly X3DH and now PQXDH, to set up secure conversations. One of its privacy properties, of value to Signal, is deniability, allowing users to deny participation in communications. Prior analyses of deniability for these protocols, including post-quantum variants, use models highly tailored to the individual protocols and generally make ad-hoc adaptations to “standard” AKE definitions, obscuring the concrete deniability guarantees and complicating comparisons across protocols. Building on Hashimoto et al.’s abstraction for Signal handshake protocols (USENIX’25)’s abstraction for Signal handshake protocols (USENIX’25), we address this gap by presenting a unified framework for analyzing their deniability. We analyze Signal’s classically secure X3DH and harvest-now-decrypt-later-secure PQXDH, and show that PQXDH is deniable against harvest-now-judge-later attacks, where a quantum judge retrospectively assesses the participation of classical users. We further analyze post-quantum alternatives like RingXKEM, whose deniability relies on ring signatures (RS). By introducing a novel metric inspired by differential privacy, we provide relaxed, pragmatic guarantees for deniability. We also use this metric to define deniability for RS, a relaxation of anonymity, allowing us to build an efficient RS from NIST-standardized Falcon (and MAYO), which is not anonymous, but is provably deniable. Image showing part 2 of abstract.
June 12, 2025 at 12:25 PM
Reposted by Thom Wiggers
sxsw.com
Privacy isn’t about hiding—it’s about trust and control over our own information. In her #SXSW 2025 Keynote, Signal President, @meredithmeredith.bsky.social breaks down why our privacy matters.
March 8, 2025 at 7:08 PM
Reposted by Thom Wiggers
eprint.ing.bot
Constant-Time Code: The Pessimist Case (Thomas Pornin) ia.cr/2025/435
Abstract. This note discusses the problem of writing cryptographic implementations in software, free of timing-based side-channels, and many ways in which that endeavour can fail in practice. It is a pessimist view: it highlights why such failures are expected to become more common, and how constant-time coding is, or will soon become, infeasible in all generality.
March 8, 2025 at 1:37 AM
Reposted by Thom Wiggers
roeslpa.bsky.social
Join our Applied Crypto group at FAU in Nürnberg as a PhD student or spread the word: we're hiring.

Our work covers many topics in real-world crypto, especially provable security and privacy of modern messaging protocols 🔐✉️

www.jobs.fau.de/jobs/7-phd-p...
7 PhD positions (m/f/d) (salary level 13 TV-L) in Computer Science (full time) and 3 PhD position (m/f/d) (salary level 13 TV-L) in Law (part time, 75%)
www.jobs.fau.de
March 5, 2025 at 9:59 PM
Reposted by Thom Wiggers
filippo.abyssdomain.expert
For one fleeting moment, it looked like the IETF was going to do the sane thing and just specify ML-KEM keys as 64-byte seeds (words.filippo.io/ml-kem-seeds/).

But naaaah, don't worry, we are getting an ASN.1 CHOICE with three subtly incompatible options.

I couldn't resist some snark in my reply.
[lamps] Re: WG Last Call for draft-ietf-lamps-kyber-certificates-07
Search IETF mail list archives
mailarchive.ietf.org
February 28, 2025 at 10:52 PM
Reposted by Thom Wiggers
drl3c7er.bsky.social
If you are looking for a PhD or PostDoc position in Cryptographic Engineering, please check the openings of Michael Hutter at our Research Institute CODE here in beautiful Munich. Please consider and help spread the word: iacr.org/jobs/item/3908
PhDs / PostDocs in Cryptographic Engineering
iacr.org
February 24, 2025 at 5:20 PM
thom.wggrs.nl
Let’s see if this place is fun
February 23, 2025 at 1:44 PM