Security Cryptography Whatever

AI’s growing mathematical prowess has crypto watchers spiraling, but does it really threaten public-key systems? The discussion explores AI as a search tool, the difference between elliptic curves, Diffie–Hellman, and RSA, and where practical cryptanalysis might advance first. Along the way: mathematical credit, flawed complexity assumptions, quantum algorithms, and the right way to disclose a catastrophic breakthrough.

The robots are at it again, and this time they’re solving, and breaking(?), math and cryptography! Things have been happening in the lattice corner including new leapfrogging complexity results in the closest vector problem (CVP), AND a possible poly-time quantum attack against the dihedral coset problem (DCP) that made everyone freak out for about a week (UPDATE: looks like it’s busted: https://eprint.iacr.org/2026/1693). ALSO, there was an important distinguisher attack against Classic McEliece, which on its face doesn’t sound like a big deal, unless you’re familiar with the track record of efficient distinguishers in the history of code-based cryptography… 😱To help us make sense  of all this we are joined again by OG friend of the pod Chris Peikert! We had trouble with his audio but tried our best to fix it, apologies.Transcript: https://securitycryptographywhatever.com/2026/08/26/ai-lattice-proofs-with-chris-peikert/Links:- https://openai.com/index/ten-advances-in-mathematics/- https://cdn.openai.com/pdf/ten-proofs-oai.pdf- https://x.com/ChrisPeikert/status/2083534770403750025- https://bsky.app/profile/chrispeikert.bsky.social/post/3msp3boueis2z- https://en.wikipedia.org/wiki/Boolean_satisfiability_problem- https://knowyourmeme.com/memes/wordcel-shape-rotator-mathcel- Chen 2024: https://eprint.iacr.org/2024/555- https://eprint.iacr.org/2026/1630- https://eprint.iacr.org/2026/1693- CVP within n^(1/2-ɛ) -  : https://eprint.iacr.org/2026/1655"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

Mark Schultz-Wu, lattice cryptographer known for work on fully homomorphic encryption and public-key constructions. He walks through lattice history and practical trade-offs. Short, clear takes on NTRU, LWE and ring/module variants. Discussion covers parameter choices, real-world deployments, and why certain algebraic choices matter for security and efficiency.

Rapid US timelines for post-quantum cryptography migration and what that means for federal systems. New hardware and improved ECC attacks that pushed vendors to move faster. Hard choices around FIPS vs CNSA2 parameters and painful certification processes. Real-world impacts on TLS, SSH, PKI, and certificate transparency scalability.

A wide-ranging chat about AI-driven vulnerability discovery and whether fuzzers are still essential. They explore automation bottlenecks like triage and getting fixes deployed. Discussion covers how LLMs change vulnerability supply, operational strain from more reports, and practical defenses such as constrained agents and hot patching. The conversation ends on future projects and a book about practical electronics.

Nicholas Carlini, a vulnerability researcher who studies machine learning and security, explains how LLMs can find real-world bugs. He describes using Claude to crash browsers, automate fuzzing, and discover logic and concurrency flaws. The conversation covers scaling scans across big codebases, automated triage, and risks from mass automated scanning.

A lively debate on standardizing pure post-quantum cryptography and what still needs to be done for TLS. They dissect hybrid versus pure PQC approaches and why pure deployments matter. Political undercurrents and trust in algorithm origins come up. Standards process frustrations and whether re-running consensus would change anything are playfully examined.

The Python cryptography module, pyca/cryptography, has mostly been a sane wrapper around a pile of C, so that users get performant cryptography on the many, many platforms Python targets. Therefore its maintainers, Alex Gaynor and Paul Kehrer, have become intimately familiar with OpenSSL. Recently, they declared that after many years of trying to make it work, they announced pyca/cryptography would be moving away from OpenSSL when supporting new functionality and exploring adding other backends instead. We invited them on to tell us about what has happened to OpenSSL, even after the investments and improvements following Heartbleed. No guests on this pod represent anyone besides themselves.Watch on YouTube: https://www.youtube.com/watch?v=dEKBHI3rodYTranscript: https://securitycryptographywhatever.com/2026/02/01/python-cryptography-breaks-up-with-opensslLinks:- https://cryptography.io/en/latest/statements/state-of-openssl/- Py Cryptography: https://cryptography.io- https://archive.openssl-conference.org/2025/presentations/Alex_Gaynor_Paul_Kehrer_The_Python_Cryptographic_Authoritys_OpenSSL_Experience.pdf- https://securitycryptographywhatever.com/2025/08/16/alex-gaynor/- https://packages.gentoo.org/packages/media-libs/libsdl- https://www.youtube.com/watch?v=RUIguklWwx0- https://datatracker.ietf.org/doc/rfc9180/- https://docs.openssl.org/3.3/man3/OSSL_PARAM/- https://openssl.foundation/- https://github.com/openssl/openssl/issues/17064- https://www.feistyduck.com/newsletter/issue_132_openssl_performance_still_under_scrutiny- https://github.com/topazproject/topaz- https://github.com/actions/runner/issues/1069- https://crystalhotsauce.com/- https://openssl-library.org/news/vulnerabilities/#CVE-2025-15467- https://en.wikipedia.org/wiki/Ship_of_Theseus- https://boringssl.googlesource.com/boringssl/+/aa202db1d7091b88b80f0a58c630c5c1aefc817d- https://www.ibm.com/products/open-sdk-for-rust-aix- https://dadrian.io/blog/posts/corporate-support-xz/- https://peps.python.org/- https://cryptography.io/en/latest/hazmat/primitives/asymmetric/ed448/- https://go.dev/blog/fips140- https://dadrian.io/blog/posts/roll-your-own-crypto/"Security Cryptography Whatever" is hosted by Deirdre Connolly (@durumcrustulum), Thomas Ptacek (@tqbf), and David Adrian (@dadrian)

In this episode, Matt Bernhard, a researcher in secure voting systems, dives into the hilarious debacle of the IACR Helios election, where key decryption material went missing, rendering the election results unusable. He explains the complexities of Helios's homomorphic encryption and discusses its limitations and verifiability concerns. Additionally, Matt highlights the practical challenges of internet voting, contrasts digital systems with paper ballots, and introduces ElectionGuard, a modern solution aimed at enhancing election integrity.

Dive into Apple’s latest memory security advancements! Discover how vertical integration allows for effective low-level security solutions. The hosts explore type-aware allocators and their role in preventing vulnerabilities like type confusion. Learn about Memory Tagging Extension (MTE) and its trade-offs, as well as real-world applications and challenges faced by modern browsers. They delve into new protective features that enhance performance while keeping data safe, all thanks to Apple’s innovative engineering choices.