Filippo Valsorda :go:

@FiloSottile elsewhere / Cryptogopher / Go crypto maintainer / Professional Open Source maintainer / RC F'13, F2'17 

https://mkcert.dev / https://age-encryption.org / https://filippo.io/newsletter

🕳️ “Gaze not into the abyss, lest you become recognized as an abyss domain expert, and they expect you keep gazing into the damn thing.” —@nickm

Public Key

npub1whzyg92c6fsvpjjcnn504z0a2pfwenctp872sgmedqg2np4drj8qwakn2m

NIP-05 Address

filippo_at_abyssdomain.expert@mostr.pub

Profile Code

nprofile1qqs8t3zyz4vdycxqefvfe6863874q5hveu9snl9gyduksy9fs6k3erspz4mhxue69uhhyetvv9ujumt0wd68ytnsw43qqxeurc

Publishing to

relay.mostr.pub

Author Public Key

npub1whzyg92c6fsvpjjcnn504z0a2pfwenctp872sgmedqg2np4drj8qwakn2m

Show more details

Last Notes

2024-08-07 16:20:29

- reply

@npub14sl…aj83 it’s an env var, so available to the user. We never ever pollute stdio.

2024-08-07 15:48:50

- reply

@npub1wt0…plml not for current Go 1 applications 🤷‍♂️

2024-08-07 15:47:24

- reply

@npub14sl…aj83 hmm, that's an interesting point. Applications can always use the GODEBUG flag if they need to force the check off to recover some data.

2024-08-07 14:28:19

- reply

@npub1kzt…vs6f custom curves require instantiating a deprecated elliptic.CurveParams.

2024-08-07 12:48:58

- reply

@npub1kzt…vs6f “this size is completely useless” is a stronger argument for the first round of breakage. We can get there.

2024-08-07 12:35:31

If you look at a crypto/rsa invocation, you can’t actually know if it’s secure or not. The key size is nowhere in the type system. This is unusual among Go crypto packages.
I propose we fix that in Go 1.24. https://github.com/golang/go/issues/68762
If we break a production application with this, it’s overwhelmingly likely that we are fixing a security issue.
I know it will break some tests, but it’s hard to justify the real world risk, and we have a robust system of GODEBUG flags now.

2024-08-05 22:35:26

- reply

@npub199l…ljf5 pq key exchange is urgent because of store-now-decrypt-later, pq auth is not, it makes sense

2024-08-05 22:19:49

- reply

@npub199l…ljf5 I’d argue PuTTY is just wrong. No one should use DSA keys, Ed448 is mostly unimplemented, and what does EdDSA even mean as a separate option.

2024-08-03 08:34:09

- reply

@npub1pfe…e2dm oh I've observed this with a Geomys maintainer, by the time we reported it they had changed the name. I would be curious to figure out what they are doing.

2024-08-01 23:29:10

One of those days where ten hours of coding amount to... 135 lines. To be fair, in the second most scary part of the Go crypto standard library: crypto/rand.
If this breaks, everything breaks. (ECDSA nonce generation is still scarier, at least this has tests.)
Rewrote most of it to be much simpler and error-free, and made rand.Read crash the program if (impossible) errors occur.
Even found a bug in the old code masked by the urandom fallback. Also, no more allocations! https://go.dev/cl/602495

2024-07-31 11:46:57

- reply

Yesterday's benchmarking session was fun! Through a series of crimes, we got to within 3.5% of the assembly on amd64, which is probably good enough.
Now I just need to productionize the horrible patches I left behind.
Recording of the livestream at https://www.youtube.com/watch?v=DpmQBNXUxms.

2024-07-30 18:59:37

- reply

Giving this another shot in two minutes!
🔴 https://twitch.tv/filosottile

2024-07-29 20:43:29

If anyone from Netflix follows me, looks like you're broken on Chrome Beta 128.0.6613.5 on macOS. Getting an assortment of errors including M7121-1331 and UI3012 on all titles including Netflix originals, regular and guest profiles. Randomly getting logged out, too. Safari works on the same machine.
Last time Netflix was broken on Chrome Beta, I thought they had some new VPN detection system... and instead led to a production rollback 😄

2024-07-29 16:43:22

- reply

@npub1duy…e0e8 yep, thermal throttled to hell, rescheduled for tomorrow 1900 UTC, sorry!

2024-07-29 16:43:10

- reply

@npub1qrp…w0xy yep, rescheduled for tomorrow 1900 UTC, sorry!

2024-07-29 16:42:22

- reply

Looks like I found the limit of my M2: livestreaming at 1080p while compiling/benchmarking Go with 38C outdoors and poor A/C. Looks like thermal throttling is making this unworkable. Go figure.
Rescheduling for tomorrow at 1900 UTC, with better cooling. Sorry everyone!

2024-07-29 13:34:41

I want to do some benchmarking to figure out if some of the assembly used in crypto/ecdsa is carrying its weight. Would folks want to see a livestream of that?
In particular, we have 1000 lines of assembly for P-256 scalar inversion. It bundles multiple optimizations: custom addition chain, fixed modulus arithmetic, and hand-written assembly. Maybe the first one or two are enough!
How's 1600 UTC today? (Roughly, enable notifications to get the actual live notification.) https://twitch.tv/filosottile

2024-07-17 14:47:52

age has a recipient abstraction and a corresponding plugin system that lets custom recipient types be implemented in any language over an stdin/stdout protocol.
We now have both Go and Rust frameworks to easily use and implement plugins. I'm really pleased with how well the plugin protocol maps to the native interfaces, making the frameworks very natural.
You can turn a Recipient/Identity implementation into a plugin CLI with 15 lines of code.
More in today's Dispatch. https://words.filippo.io/dispatches/age-plugins/?source=Mastodon

2024-07-08 15:26:11

- reply

@npub1upk…tcwy thank you! <3

2024-07-08 15:08:23

- reply

@npub1hce…c5cz <3

2024-07-06 07:02:34

It’s an exciting time for Go cryptography and for the field at large!
I’m looking forward to delivering a Go Cryptography State of the Union at GopherCon on Wednesday ✨
And of course the big professional maintenance news on Monday 👀
#gopherconorbust
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/112/738/261/396/551/148/original/dee23ee9962d8bdc.jpeg

2024-07-05 15:33:55

I have some exciting news on the professional open source maintainer front! 👀 ✨ 🥁
Announcing it on Monday to Maintainer Dispatches (https://filippo.io/newsletter) and at GopherCon Chicago.

2024-06-26 14:32:34

Last year I wrote that “I want to use XAES-256-GCM, which has a number of nice properties and only the annoying defect of not existing.” Well, here we go.
A new extended-nonce AEAD designed for high-level APIs with random nonces and FIPS 140 compliance.
It's easy to describe and implement at a low level, but can be described at a high level as using a NIST KDF.
Complete of a C2SP spec, extensive test vectors, Go and OpenSSL reference code, and an alternatives section.
https://words.filippo.io/xaes-256-gcm/?source=Mastodon

2024-06-17 17:54:01

- reply

@npub19jm…30n3 they convinced all the experts but one. They should now staff a team to publicly refute at length that one expert with laymen… why?

2024-06-17 06:17:33

I've never witnessed an experts vs non-experts split like on Kyber/ML-KEM.
No cryptographer I know thinks ML-KEM was intentionally weakened on behest of the NSA, or knows any cryptographer who does, except the one guy.
Meanwhile, enthusiasts on issue trackers are all but certain, and Brandolini's law wins arguments.
It would be impressive if it wasn't sad and worrying.

2024-06-16 14:15:52

Just published age v1.2.0 ✨
Minor release:
· binaries built with Go 1.22.4
· plugin client API
· CLI edge case fixes
· RecipientWithLabels to make auth'd or post-quantum recipients
Very happy about the last point, it was the last hardcoded thing about scrypt recipients.
https://github.com/FiloSottile/age/releases/tag/v1.2.0

2024-06-16 13:37:22

- reply

@npub1cl5…nzfu No, these are all vulnerabilities in packages THAT AGE JUST DOESN'T IMPORT.
govulncheck also has a bias towards false positives. The other thing is just wrong.

2024-06-16 13:28:03

Trivy 0.52.1 on age v1.1.1
> Total: 31 (UNKNOWN: 2, LOW: 0, MEDIUM: 13, HIGH: 14, CRITICAL: 2)
govulncheck v1.1.2
> No vulnerabilities found.
govulncheck is correct. All the vulns reported by the other thing are provably false positives.
When I did the initial design of govulncheck, I made minimizing noise a priority, to give devs a chance to actually triage potential vulns.
I suspect I was wrong: if the tool is too good, it will find nothing most of the time, and devs will not trust it.

2024-06-16 08:15:20

- reply

@npub1j2z…9777 yep it’s on YouTube!

2024-06-03 12:21:12

Well damn, the era of compiler-introduced timing side-channels is here.
In the Kyber reference implementation, Clang notices a bitmask is just selecting between zero and a constant and turns it into an if.
Very happy the Go compiler is not that smart right now.
https://groups.google.com/a/list.nist.gov/d/msgid/pqc-forum/531ad6ca-5e94-4aa9-8242-4040b4f549f3n%40list.nist.gov

2024-06-02 21:05:31

In which I argue that we should pick P-256 + ML-KEM-768 as the one true hybrid, reducing implementer workload and attack surface.
Thing is, P-256 is actually very pleasant to implement these days. The world changed compared to ten years ago.
https://mailarchive.ietf.org/arch/msg/tls/n_jM_bRZN8DM7SnpBMGA6SqpD6Q/

2024-05-28 11:47:59

- reply

@npub1u2r…kfqs we assumed it was fully RCEable from the start :) it’s properly sandboxed.

2024-05-26 16:14:34

- reply

@npub1tqu…pw2x it's absolutely open to senior folks, and a very enjoyable experience. I did it twice, once as junior once as senior. Experience of Recursers ranges from weeks to decades.

2024-05-26 11:30:10

- reply

Always happy to answer questions about RC if anyone has them. DMs are open.
To be clear I am not affiliated with the faculty, I am a (returning) alum. I always recommended attending RC, now I engaged them on the hiring side, too, and can strongly recommend hiring from them as well.

2024-05-26 11:29:40

- reply

It looks like there aren't a lot of companies hiring for security/cryptography roles from Recurse right now, which is a hell of an opportunity. Every batch has folks doing Cryptopals and CTFs!
You know how in security hiring what matters is finding the sharp curious folks, especially at the junior level? Exactly.

2024-05-26 11:29:01

You might know I am a recurse.com alum.
I love that community. Full of smart, kind, passionate folks.
For the first time this year I was on the hiring side of their recruiting services, and it *still* beat my expectations.
The RC-sourced applicant pool was amazing.
I moved forward 57% of RC applications (and even the ones I rejected were great, just not good fits), versus 18% of non-RC appls.
Way more diverse pool, too.
tl;dr: if you need to hire nice, smart folks quick, reach out to RC.

2024-05-22 16:14:06

- reply

@npub1qu5…qel2 maybe a https://en.m.wikipedia.org/wiki/Laser_turntable

2024-05-22 16:07:18

- reply

@npub1u2r…kfqs uppercase letters are encoded as !x to match the filesystem path, which can’t be case sensitive. It’s documented :)

2024-05-18 14:44:35

- reply

Live now! Integrating the new Kyber post-quantum key exchange in Go’s crypto/tls package.
https://twitch.tv/filosottile

2024-05-18 12:57:57

Thinking of doing a livecoding session to integrate the new Kyber/ML-KEM post-quantum key exchange in Go’s crypto/tls. https://github.com/golang/go/issues/67061
Anyone interested? Would probably start in about an hour, say 1400 UTC. https://twitch.tv/filosottile

2024-05-18 12:56:41

Thinking of doing a livecoding session to integrate the new Kyber/ML-KEM post-quantum key exchange in Go’s crypto/tls. github.com/golang/go/is...
Anyone interested? Would probably start in about an hour, say 1400 UTC. twitch.tv/filosottile

2024-05-02 17:29:52

In Go 1.22 we fixed a common security footgun by replacing the math/rand[/v2] default generator with a new secure one based on ChaCha8.
Details on the Go blog by @npub13a6…03tx and me (and full reusable specification in C2SP).
https://go.dev/blog/chacha8rand

2024-04-27 23:34:08

- reply

@npub1r9s…xge4 File formats are protocols!

2024-04-22 08:26:10

https://www.youtube.com/watch?v=lkEH3V3PkS0

2024-04-19 19:50:13

We're getting hedged signing and domain separation in all NIST post-quantum signature algorithms!!!
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/JKMh0D0pa30/m/vbflXolxAQAJ
Also, derandomized testable APIs for all of the NIST PQC algorithms.
https://groups.google.com/a/list.nist.gov/g/pqc-forum/c/Mf2kemwwreY/m/KArjoIhxAQAJ
It's basically Christmas 🎁 🤩

2024-04-17 23:01:47

- reply

Hypothetically, if an application went out of their way to misuse FilesystemStore by not using its New API and stuffing attacker-controlled data in Session.ID (which is documented as not being safe), they could hit this.
That's *not* what happened to Palo Alto. They wrote their own Store that takes the session ID from a cookie in New without authentication.

2024-04-17 22:59:25

A PSA since there's some confusion on this...
There is no vulnerability in Gorilla Sessions.
The vulnerability is in Palo Alto's internal SessDiskStore, which looks similar to FilesystemStore. Early analysis came to the mistaken conclusion that the vulnerable path was in FilesystemStore, but it's not. FilesystemStore authenticates the Session.ID with securecookie, SessDiskStore does not.

2024-04-15 22:36:53

My take on this is that weird parameters like P-521 are less secure than their “weaker” alternatives.
Less used, more likely to have bugs.
521 is not even a multiple of 8! Handling that requires the single most dangerous line in Go crypto, in the same function that PuTTY got wrong.
Still, this is the spec’s fault: if ECDSA defined how to turn random bytes + key + msg into a signature, PuTTY wouldn’t have had to invent it, and could have checked test vectors.
https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/vuln-p521-bias.html

2024-04-13 16:54:31

- reply

@npub1v4r…086v absolutely, feel free to reuse it. Actually, I’ll add a CC BY 4.0 license to it.

2024-04-12 22:05:06

- reply

@npub1mtd…jlxf both from the pin and the connector pad, but good point!

2024-04-12 20:54:28

Electronics Mastodon, I isolated a fault in my helmet intercom to the leftmost contact of this PCB, which doesn’t have continuity to its pin.
Indeed I see the hole at the bottom of it is white, unlike the other ones.
How do I fix this with mediocre soldering tools and skills?
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/112/260/235/720/688/561/original/b6d62bf7326e591b.jpeg
https://cdn.masto.host/abyssdomainexpert/media_attachments/files/112/260/236/248/963/877/original/6a121cde3af74d43.jpeg

2024-04-08 08:53:07

My #RealWorldCrypto talk on transparency logs is online! 🔐
It explores the abstractions we can build around tlogs to make them a broadly reusable tool, and the deployment techniques we developed over the past ten years.
Also, spicy signatures 🌶️
https://www.youtube.com/watch?v=SOfOe_z37jQ

2024-04-06 14:16:34

I wrote a document describing how I maintain open source projects, and linked it from my global CODE_OF_CONDUCT, CONTRIBUTING, and SECURITY files.
It talks about how I prefer issues to PRs, how I work in batches, and how I'm trigger-happy with bans.
Feedback welcome!
https://github.com/FiloSottile/FiloSottile/blob/main/maintenance.md#security-issues

2024-04-05 01:13:56

- reply

@npub1f6a…pnql were you aware of https://github.com/jcsalterego/pngpaste?
I use it to paste into zbarimg to extract QR code bodies.

2024-03-31 15:18:39

- reply

@npub19zs…5azk excellent, noted

2024-03-31 11:36:09

- reply

@npub1j0c…cxw5 gated I mean it takes the attacker’s private key to use, unreplayable means that even if we observe an attack against one host, we can’t reuse it against another host.

2024-03-30 21:41:16

- reply

@npub10cq…6nm3 that’s the current impression, yes

2024-03-30 17:31:18

I'm watching some folks reverse engineer the xz backdoor, sharing some *preliminary* analysis with permission.
The hooked RSA_public_decrypt verifies a signature on the server's host key by a fixed Ed448 key, and then passes a payload to system().
It's RCE, not auth bypass, and gated/unreplayable.
More details in this thread: https://bsky.app/profile/did:plc:x2nsupeeo52oznrmplwapppl/post/3kowjkx2njy2b

2024-03-29 22:20:33

- reply

@npub1r9s…xge4 C/D are aisle and A/F window by convention on narrow bodies.

2024-03-27 22:48:17

- reply

@npub1yz4…9pxr no one ever mentioned that, so might be unlikely, but if you can show me a couple examples I’d be curious!

2024-03-21 07:42:53

- reply

@npub17xj…0938 I generally agree with you on GenAI. I am seeing much different takes from people who I expected to also generally agree.

2024-03-21 07:40:55

- reply

@npub1cg0…mptp Pretty much. The idea is that this might actually be usable enough to replace phishable bearer tokens, which nothing else succeeded at replacing so far. Usability has value.

2024-03-21 07:32:25

- reply

@npub17xj…0938 There's just so much cognitive dissonance between the GenAI responses and the SSPL responses.
"Big companies must not be allowed to use my code" vs "a project must allow big companies to use their code to be open source".

2024-03-21 07:21:31

- reply

@npub1h4v…8alz 💖

2024-03-21 07:21:09

Did anyone really believe in information being free and permissive licenses and funding open source?
Because I’m seeing more “copying is theft” and “relicensing is bad” takes than I ever thought I would in some circles.
I may have to log off for the day.

2024-03-20 23:59:22

The first thought I had when I saw people complain about GitHub private repos being used to train AI was…
“I bet those were archived while previously public and that part is lost in the confirmation bias of AI bad Microsoft bad”
Sure enough. https://fedi.simonwillison.net/@simon/112130028394563476
Reality matters. Or at least it should. Especially if there are real, valid concerns.

2024-03-20 18:56:08

Kind of ridiculous that the best paid ebook UX is “purchase from wherever, then copy-paste the ISBN to https://annas-archive.org to download a usable file”…

2024-02-17 14:17:19

- reply

@npub13w3…9k68 I don’t remember calls for Threads or Tumblr federation to be opt-in. Did I miss it?

2024-02-17 13:53:24

I have so far seen no compelling arguments for why a bridge is fundamentally different from any other instance, and instance federation is opt-out by design.
If an instance is too big, block it. If it’s too unmoderated, block it. If you don’t approve of its implementation, block it. If you don’t like it, block it.
It’s pretty core to how the Fediverse works.
No one opted-in to interact with abyssdomain.expert.