Sophie Schmieg

Leading cryptography (ISE Crypto) at Google.

Opinions my own.

Content usually badly explained mathematics

profession: cryptography engineer
hobby: Kerbal Space Program
hobby: Lego
hobby: Factory Sim Games

Public Key

npub10qaqswg07tsrztrauf69ylup6qj50kef7e4ut7t0vganygk0t2rsyr4hg8

NIP-05 Address

sophieschmieg_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqs8swsg8y8l9cp39377yazj07qaqf28mv5lv679l9hkywejyt844pcpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds6h43al

Publishing to

nostr.mom

nos.lol

relay.damus.io

Author Public Key

npub10qaqswg07tsrztrauf69ylup6qj50kef7e4ut7t0vganygk0t2rsyr4hg8

Show more details

Last Notes

2026-02-25 21:05:29 UTC

- reply

it turns out, a random number generator does not get better when you first run it through a lot of linear algebra 😏

2025-04-15 20:39:29 UTC

And all of the sudden, we have solved supply chain security.
No CVE, no vulnerabilities!

2025-03-29 14:30:41 UTC

- reply

for small to medium sized businesses that are not doing anything more adventurous than TLS when it comes to cryptography, my advice would be, if there is some free engineering capacity, to turn on 0x11EC (X25519-ML-KEM768) in their TLS config, assuming their stack supports the cipher. (The various different stacks are adding support for that currently)
That way, you can check if anything breaks, with both Chrome and Firefox negotiating that cipher by default, and Safari rolling out support for it. The main risk is with middleware breaking.
In that threat model, it may not be the most urgent task, but it's relatively simple, depending on the used TLS stack. You can also turn on the equivalent KEX in SSH (supported in OpenSSH). Otherwise, in that threat model, I wouldn't do much at all (and even these two things are mostly optional, unless there are very strict long term confidentiality concerns).
Of course, if your threat model is more adventurous, you might want to hire some cryptographers 🙂

2025-03-26 05:33:09 UTC

Days since Signal's deniable handshake has last been defeated by nobody caring about cryptographically deniable handshakes: 0

2025-03-25 08:27:43 UTC

- reply

hmm? Signal uses different colors for different people, that helps me distinguish chats fairly well.

2025-03-18 19:37:38 UTC

- reply

I don't back down from bullies. And I need to travel internationally to do my job. If that becomes infeasible, I will have to leave the US and move back to Europe. I can much more easily skip conferences in the US (a good chunk of which are organized by the federal government to begin with), then I can skip international travel. And a lot of my peers in industry and academia are in the same position.

2025-03-18 18:30:29 UTC

Feeling great about my upcoming international travel right now.
https://www.theguardian.com/us-news/2025/mar/18/germany-investigates-after-national-with-green-card-arrested-at-us-border

2025-03-18 16:39:16 UTC

- reply

look at number fields, split, ramified, and unramified primes while you're at it. IMHO easier to understand and deeper than split complex or dual numbers (although the dual number construction is extremely important for algebraic geometry).

2025-03-05 18:10:10 UTC

This was a really fun vulnerability to have the pleasure to consult on:
https://bughunters.google.com/blog/5424842357473280/zen-and-the-art-of-microcode-hacking
It turns out AES-CMAC is not second preimage resistant if you know the key (double so if the key is in an RFC), and 2048 bit numbers are quite often very easy to factor.

2025-02-11 16:23:48 UTC

- reply

be that as it may, it matters that the president cannot change the law via executive fiat. It is still illegal to bribe foreign officials. There might not be enforcement right now, and if you outrun the statute of limitations that might mean you are able to commit an illegal act without penalty. But it is still an illegal act, and you still committed a crime.

2025-02-11 16:06:28 UTC

- reply

executive orders cannot suspend laws passed by Congress.

2025-02-03 18:38:16 UTC

- reply

See this excellent blog post about a list of the problems and design issues with PGP.
And I do agree, at least some points also apply to Mastodon DMs, in general, retrofitting end to end encryption is not a simple undertaking, and usually leads to endless compromises that make the whole thing meaningless. https://www.latacora.com/blog/2019/07/16/the-pgp-problem/

2025-02-01 02:11:21 UTC

- reply

leopards, face, …

2025-01-06 22:26:11 UTC

- reply

so far, there is still no evidence of person to person transmission. So I think for the moment the pandemic part 2 risk is contained. Let's hope it stays that way.

2025-01-03 20:54:00 UTC

- reply

In case you do not know how GenAI works, here is a very abridged description:
First you train your model on some inputs. This is using some very fancy linear algebra, but can be seen as mostly being a regression of some sorts, i.e. a lower dimensional approximation of the input data.
Once training is completed, you have your model predict the next token of your output. It will do so by creating a list of possible tokens, together with a rank of how good of a fit the model considers the specific token to be. You then randomly select from that list of tokens, with a bias to higher ranked tokens. How much bias your random choice has depends on the "temperature" parameter, with a higher temperature corresponding to a less biased, i.e. more random selection.
Now obviously, this process consumes a lot of randomness, and the randomness does not need to be cryptographically secure, so you usually use a statistical random number generator like the Mersenne twister at this step.
So when they write "using a Gen AI model to produce 'true' random numbers", what they're actually doing is using a cryptographically insecure random number generator and applying a bias to the random numbers generated, making it even less secure. It's amazing that someone can trick anyone into investing into that shit.

2025-01-03 20:46:33 UTC

I was forwarded this screenshot and it just is living rent free in my head right now.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/766/372/583/509/013/original/558b18b47adc8848.jpeg

2024-12-20 00:33:13 UTC

The tradition is only known as "the holidays" to most, but it's important to remember what we are celebrating this time of year: the Herculean effort to fix the log4j vulnerability caused by needless use of JNDI.

2024-12-13 16:14:36 UTC

At this point, the IETF might require an anti-SLAPP rule, disallowing participants threatening other participants or the IETF with frivolous lawsuits from taking part in the standards process.

2024-11-23 17:50:39 UTC

@npub184f…pnjc, reviewing a resume, on a Saturday morning, while still in bed: this candidate's work experience is from September 2025 to present!
Me: you should tell them they're hired, start date is November 10th 2024, three unexcused consecutive days of absence are considered a resignation.

2024-11-07 12:17:38 UTC

Quote: "We thought the internet was for porn, but it turns out it's for certificates."

2024-10-09 22:09:02 UTC

- reply

how about:
1. Absorb the current state of the deck into SHAKE256.
2. Run Fisher-Yates, by squeezing and rejection sampling the XOF output for the "random" numbers.
Slightly complicated to run in real life, but very easily extendable to a randomized shuffle by also absorbing some randomness in the beginning!

2024-09-12 07:31:16 UTC

To correct the common misunderstanding:
Eve (they/them), Alice (she/her), and Bob (he/him) are in a consensual, BDSM relationship, featuring Eve as service top, Alice as the bratty bottom, and Bob, who just likes to watch.
Their safe word is "indistinguishability obfuscation"
Eve only "breaks" Alice's encryption because she's super into it, not to cause harm.

2024-09-09 19:11:25 UTC

Let's see if my vacation auto responder has harvested any good poems.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/109/160/658/222/725/original/2ac2b9882135dda3.png

2024-09-09 16:37:40 UTC

- reply

well, you do need proteins, but they don't know their worth, so they're all underpaid

2024-09-09 15:56:10 UTC

When you think about it, you realize that DNA is the mother of all esoteric programming languages