Soatok Dreamseeker

He/him. Gay/demi dhole (Cuon Alpinus) furry.

Blogger, programmer, security engineer, cryptography nerd. 30+

Too spicy for Twitter (banned with all the prominent journalists on 2022-12-16)

I don't represent any company, individual, or community.

Pronouns: he/him
Fursona: Dhole
Orientation: Demi/Gay
Website: https://soatok.blog

Public Key

npub1wfp0azvqh9n27j7zgnej54cr9xjs5x2efztwzurjdpj34ea5vw9qdvw2m9

NIP-05 Address

soatok_at_furry.engineer@momostr.pink

Profile Code

nprofile1qqs8ysh73xqtje40f0pyfue22upjnfg2r9v539hpwpexseg6u76x8zspz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds2t9hf6

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1wfp0azvqh9n27j7zgnej54cr9xjs5x2efztwzurjdpj34ea5vw9qdvw2m9

Show more details

Last Notes

2026-07-14 15:31:22 UTC

Me, months ago: "Wow, there's nothing I feel like writing about. Work is extremely busy. I'll put it off."
Me, now: "Wow, there are so many things to write about that it's hard to choose which one to finish first. Work is extremely busy. I'll put it off."

2026-07-08 01:43:12 UTC

- reply

It used to have Macro support.

2026-06-03 06:31:53 UTC

https://www.dotfurry.org :3

2026-04-13 05:43:52 UTC

https://github.com/fedi-e2ee/public-key-directory-specification/issues/118

2026-04-10 15:25:36 UTC

I guess that whole forward secrecy plan isn't happening?
https://web.archive.org/web/20260410152505/https://getsession.org/donate
#Session

2026-03-31 10:28:20 UTC

- reply

I'd like @npub1dqd…8xy4 to do this for the hacking community, but I don't know what the logistics are like re: Las Vegas.

2026-03-31 01:06:32 UTC

If you see someone posting a photo of a sign at a furry convention that advertises HIV / STI testing while sounding offended, it's a queerphobic dogwhistle.
Spread this to your friends/families to inoculate them from bad memes.
https://soatok.blog/2024/09/30/why-are-furry-conventions-offering-hiv-testing-to-attendees/

2026-03-18 19:29:59 UTC

Moore's Law is about doubling the number of trans sisters every 18 months

2026-03-11 22:21:14 UTC

- reply

"No" is a better privacy-enhancing technology than the state-of-the-art differential privacy techniques.
It's efficient! Not collecting data requires at most O(1) bandwidth, O(1) storage, and O(1) compute.
"No" is not "Maybe later".
"No" is not "Ask me again in 3 days".
"No" is not "Maybe after a few more beers", since many of the people that *need to hear* the first part of his message likely also needs the second.

2026-03-11 22:18:17 UTC

- reply

Here's a privacy-enhancing technology for you to consider:
"No."
You don't need to know. You don't need to measure. The efficacy of advertising campaigns, market segmentation, and relevance targeting should be minimized for the good of humanity.

2026-03-11 22:15:19 UTC

At #RealWorldCrypto this year, there was a session on "privacy-enhancing technologies".
The first talk in the session was about a new encryption method for Tor.
The next two were painful examples of "a person cannot be convinced of something when their salary depends on them not knowing it".
> Advertisers wants to collect signals about populations without being individually identifying. So let's talk about differential privacy techniques to let them do that.
One example was "Meta wants to know what percentage of its teneage users blocked a contact today".
At no point did they address the elephants in the room.<li>Why do they want this data in the first place?</li><li>What are they even doing with this signal?</li><li>Have you considered telling them to fuck off and not collect it in the first place?</li>
As tempting as it might be to hand wave it, and say "well yes but their business model depends on it", I say to advertisers, "then perish".

2026-03-06 04:41:58 UTC

- reply

The brainrot "this is why we need blockchain" people tickle me.
You mean the plaintext, immutable history currency? The global state one? The one that's like tweeting your transactions publicly? The one that's trivially traced?
Most of them hit every mark I just listed.

2026-03-06 04:16:35 UTC

I'm not gonna say it
Just read this story
It says more about my point than I ever could
https://www.404media.co/proton-mail-helped-fbi-unmask-anonymous-stop-cop-city-protestor/

2026-03-03 23:35:54 UTC

- reply

I guess I should just tap the sign whenever I encounter this sort of personality:
https://soatok.blog/2026/02/25/cryptography-engineering-has-an-intrinsic-duty-of-care/

2026-03-02 19:45:34 UTC

Loup-Vaillant [wrote this on Lobste.rs](https://lobste.rs/s/oukhsl/cryptographic_issues_matrix_s_rust#c_fff0jo ) in a dumb rant about my Matrix disclosure:
> Personally I would actively > *avoid*> the check,
Hmm. What a weird thing to say.
Loup-Vaillant wrote a cryptography library called Monocypher, which famously had an [EdDSA vulnerability](https://monocypher.org/quality-assurance/disclosures ) mostly caused by their insistence on rolling their own custom EdDSA variant to avoid SHA512.
"I wonder how Monocypher holds up in 2026?"
Who said that? Well, anyway:
https://github.com/LoupVaillant/Monocypher/issues/285

2026-02-25 16:11:36 UTC

- reply

God dammit, I'm gonna get nerdsniped, aren't I?
Sigh.

2026-02-25 16:05:20 UTC

- reply

*starts writing on the chalkboard, Bart Simpson style*
"I will NOT get nerdsniped into another cryptography side-project."

2026-02-25 15:57:48 UTC

- reply

The frustrating part about attack papers like this is **how much they step on the same rakes that were deemed hazardous for more than 20 years**.

2026-02-25 15:44:59 UTC

- reply

My heuristic from 2023 still rings true lol
https://soatok.blog/2023/01/21/how-you-respond-to-security-researchers-says-everything-about-you/#password-managers

2026-02-25 15:44:05 UTC

https://eprint.iacr.org/2026/058
Wow

2026-02-25 02:45:36 UTC

- reply

Someone finally asked him for his exploit code recently
https://research.swtch.com/nih

2026-02-25 02:42:56 UTC

Y'know what's funny?
I spend a lot of time thinking about and working on technology to make it easier for folks to have privacy in their comms,
But most of my chats are like:
"awawawawawa"
[furry sticker]
[furry sticker]
[furry sticker]
"why are compilers, man?"

2026-02-22 05:10:39 UTC

Let me just put this out here:
If you're coming to me hoping to "mediate" between Matrix or even "win Soatok over"
You're wasting your fucking time.

2026-02-20 13:36:54 UTC

If you're designing E2EE in 2026
And your expectation for the user experience is that even half your users will <li>manually verify key fingerprints, safety numbers, etc.</li><li>know what to do when these mechanisms fail</li>
Then you have not been paying attention to the research at all!
That isn't the normal behavior for how we use software.
When's the last time someone you know that doesn't know what "TCP" is inspected a website's certificate before sending it their password?

2026-02-20 07:27:08 UTC

Something vexing:
I've got a lot of ideas for improving things, but they're mostly infrastructure / ecosystem projects.
It's very difficult to connect any of them directly to the things people insist they need today.
For example:<li>Key Transparency for the Fediverse<ul><li>E2EE for ActivityPub can leverage this</li><li>AuxData is useful for other protocols</li></ul></li>
It's difficult to get most people to know or care about this!
But if you want a federated Discord replacement that can be easily self-hosted without making the host a juicy target for privacy invasions, and you don't want to require users to manually verify keys, this work is essential.

2026-02-20 04:09:01 UTC

- reply

Is it perfect? No.
If a threat scenario comes up that I didn't imagine, that means I assume, by default, that we're vulnerable until I prove otherwise.

2026-02-20 04:06:49 UTC

- reply

You wanna see a fucking threat model?
Here: https://github.com/fedi-e2ee/public-key-directory-specification/blob/main/Specification.md#threat-model
And this is for an ActivityPub service that just stores data in immutable plaintext and serves it over HTTPS!

2026-02-20 04:04:12 UTC

- reply

Now, am I saying that they're lying or *deliberately* misleading?
No. I'm describing the incentives they're operating under!
This could be entirely subconscious or even unconscious decisionmaking and/or behavior for all I know.
But it's really suspicious to insist that the specific attack I keep describing is handwaved as "outside our threat model" when their public threat model is so frustratingly incomplete that it might as well just say **Cryptography: Vibes.**
I mean, *look at it*: https://spec.matrix.org/v1.17/appendices/#security-threat-model

2026-02-20 03:58:01 UTC

- reply

An F in cryptography is aes-js / pyaes, as [this Trail of Bits blog](https://blog.trailofbits.com/2026/02/18/carelessness-versus-craftsmanship-in-cryptography/ ) by Opal Wright explains:
> Mistakes in cryptography are not a sin, even if they can have a serious impact. They’re simply a fact of life. As somebody once said, “cryptography is nightmare magic math that cares what color pen you use.” We’re all going to get stuff wrong if we stick around long enough to do something interesting, and there’s no reason to deride somebody for making a mistake.
> What matters—what separates carelessness from craftsmanship—is the response to a mistake. A careless developer will write off a mistake as no big deal or insist that it isn’t really a problem—yadda, yadda, yadda. A craftsman will respond by fixing what’s broken, examining their tools and processes, and doing what they can to prevent it from happening again.
Does this sound familiar?

2026-02-20 03:55:33 UTC

- reply

> But what about "don't make perfect the enemy of good"?
If your cryptography isn't damn near-perfect, it's shit. There aren't many cryptographic solutions that get a C+ in the world. It's either an A, A-, or an F.

2026-02-20 03:52:42 UTC

- reply

Matrix has many incentives to lie or mislead. Their leadership includes the CEO of a company whose product is a Matrix client. There's active political talks about the EU investing heavily in Matrix. He's got a vested interest in looking good, even at the expense of doing or even being good.
On the other hand, I have nothing to gain. If everyone switches to Matrix tomorrow, nothing in my life changes. If Matrix self-implodes and everyone goes back to XMPP tomorrow, nothing in my lfie changes.
The only things I want are:<li>End-to-end encryption to be better.</li><li>End-to-end encryption to become ubiquitous for communication protocols and apps.</li><li>The large tech companies whose business models involve privacy violations and stealing from artists and other creative workers to burn down so gloriously that society forgets the word "billionaire" in twenty years.</li>

2026-02-20 03:46:53 UTC

I've had a few people ask why I didn't post the full Matrix email on my Fedi thread. There are two reasons:<li>It wouldn't fit in 1k characters.</li><li>Listen carefully:</li>
Y'know how "just getting caught cheating on your monogamous partner" isn't the right time to discuss exploring ethical nonmonogamy?
In a similar vein, asking for information while dismissing a report as "no practical security impact" is still dismissing the goddamn report.
I excerpted the part of their email where they dismissed my report. That was the part that initiated the immediate disclosure. The inciting turn of phrase.
It doesn't matter how much you piss on my leg, I'm not going to believe it's raining.

2026-02-19 02:02:37 UTC

RE: https://furry.engineer/@soatok/116088639302283341
So, Matrix responded with a blog post.
I added an addendum to mine to rebut theirs: https://soatok.blog/2026/02/17/cryptographic-issues-in-matrixs-rust-library-vodozemac/#matrix-response
#note1jfn…khfj

2026-02-18 16:02:43 UTC

A web developer and a speedrunner have a very different understanding of the term iframe

2026-02-18 14:30:45 UTC

Oof. Big oof.
https://blog.trailofbits.com/2026/02/18/carelessness-versus-craftsmanship-in-cryptography/

2026-02-18 04:40:26 UTC

- reply

Also, the reason I format my PoCs as unit tests rather than weaponized exploits is because tests are generally more useful to developers.

2026-02-18 02:49:44 UTC

- reply

The downside is: If I turn out to be wrong in the end, then there's a public record of my mistakes.
(Which I'm personally fine with! I make mistakes. We all do. It's how we learn.)

2026-02-18 02:47:38 UTC

- reply

There's a lobsters user who's aghast at me for sticking to my guns.
https://lobste.rs/s/oukhsl/cryptographic_issues_matrix_s_rust#c_ahlbc9
lol, ok

2026-02-18 02:46:46 UTC

RE: https://furry.engineer/@soatok/116088925054375056
I'm going to be very clear about something:
If you tell me that something I reported has "no security impact", I publish it as soon as possible.
If you're wrong in your assessment of the actual security impact, that's not my problem.
If you're citing an argument about *the wrong level of abstraction*, I will tell you you're wrong (and why) while I'm publishing.
Do you know a neat trick for avoiding this outcome?
It's called the Socratic method in fancy circles, but it's basically: Ask clarifying questions.
#note13yj…cu5s

2026-02-18 01:00:19 UTC

- reply

I want to include this excerpt from the Matrix response:
> Your PoC correctly demonstrates that the Olm 3DH implementation in vodozemac does not currently perform the all-zero DH output check. As we're sure you're aware, the check for contributory behaviour in X25519 is a contentious topic among cryptographers, with some calling for it, but others like RFC 7748[1] calling it optional or even arguing against it (e.g. Trevor Perrin[2]). We've previously considered adding it but ultimately avoided it due to the conclusion that there's no practical security impact on Matrix. In other places like SAS/ECIES we explicitly reject non-contributory outputs because those handshakes can be used in unauthenticated contexts where an all-zero DH output > *could*> directly collapse channel security.
The [2] points to https://moderncrypto.org/mail-archive/curves/2017/000896.html
Which is talking about the Diffie-Hellman primitive, not what protocols building atop ECDH should do.

2026-02-17 23:47:39 UTC

https://soatok.blog/2026/02/17/cryptographic-issues-in-matrixs-rust-library-vodozemac/
#Matrix #infosec #vulnerabiltiy #cryptography #privacy

2026-02-17 23:43:06 UTC

Matrix responded to my email. They insist:
> there's no practical security impact on Matrix
So I'm publishing in a moment.

2026-02-15 20:17:23 UTC

- reply

Sure, here's a short list:<li>Start with a specification first. One with a clear threat model and list of assumptions.</li><li>Try to invent as little as possible. We have MLS as an IETF RFC, these days. We have Raft as a consensus protocol. The wheels are good enough for the problem they're solving.</li><li>Engage the cryprography and security communities early and often. Veilid is doing this right.</li><li>No sacred cows. Jettisoning support for bad crypto, even if it means breaking some clients that refuse to upgrade, is the right call.</li><li>Embrace <a href="https://soatok.blog/2024/08/28/introducing-alacrity-to-federated-cryptography/" target="_blank" rel="nofollow noopener">Cryptographic Alacrity</a>.</li>

2026-02-15 20:12:07 UTC

A friend asked me "so on an 0-10 scale how dumb are the bugs you're disclosing in Matrix soon" and I described one of them and they said "oh, definitely a 10".
(That's not a CVSS 10, to be clear, but you'll probably end up wondering how nobody spotted it sooner.)

2026-02-14 16:54:41 UTC

Is End-to-End Encryption Optional For Large Groups?
One of the recent topics in Messaging App Discourse is whether it makes sense to prioritize End-to-End Encryption when searching for an alternative to Discord. Who's Saying "No"? I'm going to quote 0xabad1dea here, because she is awesome and explains my "opposition" position better than anyone else: So You Want To Write An Open Source Discord Replacement Things you don’t need:
http://soatok.blog/2026/02/14/is-end-to-end-encryption-optional-for-large-groups/

2026-02-12 15:43:03 UTC

RE: https://furry.engineer/@soatok/116055556402436098
By the way, I'm not giving them 90 days this time.
Last time I did that, they didn't bother to actually fix anything, so they didn't actually need any of that time. So they lost that privilege.
Expect a public disclosure / write-up as soon as I feel like it.
#note1d08…mwan

2026-02-12 03:34:14 UTC

People can't help but try to evangelize Matrix in response to things I wrote, so I just disclosed a few more issues in Matrix's cryptography to their security@ email address.
This time, the issues were in their Rust library, vodozemac.
One of them was pretty fucking stupid.
I'll do a better write-up than I was initially planning when they've had time to fix it.

2026-02-11 18:01:54 UTC

On Discord Alternatives
Next month, Discord is going to start requiring age verification. The backlash from gamers everywhere has been predictable and justified. I guess their company name checks out. I've had a few people reach out to me because of my prior vulnerability disclosures and criticism of encrypted messaging apps. (Thanks, Toggart.) Unfortunately, asking a cryptography-focused security engineer for app recommendations is like asking a rocket scientist to…
http://soatok.blog/2026/02/11/on-discord-alternatives/

2026-02-08 02:51:44 UTC

RE: https://med-mastodon.com/@bicmay/116031817054715473
If you're not on PrEP, I highly recommend checking out one of the services that makes it easy to access, often at no or very little cost.
I use [MISTR](https://heymistr.com ).
#note1mrj…dk0a

2026-01-28 19:35:03 UTC

Horrible idea:
Disclose vulns in the speech bubbles of furry porn commissions

2026-01-27 23:06:03 UTC

I heard Meta, Reddit, and other corporate owned social media are blocking links to https://icelist.is
Whatever you do, don't go to https://icelist.is
Definitely don't spin up a caching reverse proxy that mirrors https://icelist.is/
Doing that would make Zuck sad

2026-01-23 15:54:11 UTC

- reply

While working on https://publickey.directory, two really annoying problems cropped up.<li>What if someone demands their data be stricken from the transparency log, as is their right under the EU's GDPR?</li><li>What if someone legitimately loses access to all their secret keys (catastrophic hardware failure) and wants their instance admin to be able to restore their ability to use E2EE?</li>
When I say "annoying problems", I do NOT mean the people that would experience them are annoying.
I mean they are annoying because they are fundamentally incompatible with the simplest possible solution.

2026-01-23 15:50:37 UTC

- reply

On the topic of "political problems", sometimes you have attack vectors that **nobody in the C-Suite considers an attack vector**, like the FBI demanding the BitLocker disk encryption keys for Windows users.
https://www.forbes.com/sites/thomasbrewster/2026/01/22/microsoft-gave-fbi-keys-to-unlock-bitlocker-encrypted-data/
Cryptographers have been complaining about this for decades. [@matthew_d_green](https://ioc.exchange/@matthew_d_green ) coined the term "Mud Puddle Test" to talk about it.
https://blog.cryptographyengineering.com/2012/04/05/icloud-who-holds-key/

2026-01-23 15:47:30 UTC

- reply

Every time you talk seriously about security-in-practice you will find yourself circling around this point:
https://infosec.exchange/@dymaxion/109344795644687902

2026-01-23 15:46:24 UTC

- reply

There's another dimension to this.
Attackers don't always choose the same targets that you think are highest value.
Why attack your hardened authentication gateway when the marketing team has an unpatched WordPress 3.1 blog sitting right there talking to your production MySQL database?

2026-01-23 15:40:58 UTC

- reply

There's been a lot of "excitement" from business types about using LLMs to find vulnerabilities in source code.
Naturally, the goal is to cheapen labor and extract more value for themselves. But I do suspect they're going to fall on their own sword with this one.
Not every vulnerability is obvious. Something can look fine and be the Achilles' heel that wrecks your shit. Something can look incredibly dangerous but end up being a NOP.
If people think their stochastic parrot can do a better job than humans, point them at OpenSSL or libgcrypt, and then **have someone with relevant experience interrogate the "findings" before you waste the developers' time**. I can guarantee almost everything they complain about will be a false positive with even the shallowest scrutiny.

2026-01-23 15:32:33 UTC

- reply

A while ago, @npub1tx8…x0yc started writing [Decent Security](https://decentsecurity.com/about ), about personal computers and mobile device security.
Appsec (writing secure software) is less friendly because everything you learned about programming becomes suspect.
> Why can't I just combine user data into this SQL query string > *if I'm careful enough*> ? I know about Bobby Tables. I'll sanitize my inputs!!!
Bam, SQL injection because integers can be used to reference column names in some injected queries.

2026-01-23 15:27:48 UTC

- reply

The security nerds haven't commented yet because this pattern-matches to way too many vulns to know which one I'm talking about yet

2026-01-23 15:26:39 UTC

- reply

common programming habit + LGTM + unit tests pass + static analysis is good + (optional) the fucking thing compiles = oops I got your private key

2026-01-23 15:24:36 UTC

harmless design decision + obvious thing to do by default + sensible trade-off that minimizes support burden for dev teams + obvious thing to do = CVSS 10

2026-01-22 17:32:28 UTC

JWT {"alg": "let-me-innnnn"} vuln
https://pentesterlab.com/blog/cve-2026-23993-harbourjwt-unknown-alg-jwt-bypass

2026-01-14 23:53:56 UTC

This is a must-read.
https://cryptography.io/en/latest/statements/state-of-openssl/
#python #cryptography #crypto #openssl #opensource

2026-01-06 14:09:52 UTC

- reply

If you want an indieweb to thrive, and for communications to be private:
Corporations are your adversary.
The US Government is your adversary. (Cloud Act, etc.)
The EU Government is your adversary. (Chat Control, etc.)
The coalitions you want to form are among queer / nerd subcultures.
You want kinksters. You want furries. You want bronies. You want Warhammer 40K players. You want otaku. You want therians. You want juggalos. You want Sonic the Hedgehog fans. You want the cringe TikTokers. You want D&D players and LARPers. You want people who attend Renaissance Festivals. You want people that attend Cowboy Fast Draw events.
You can have all those without the Nazis.
You can have all those without any government's permission.
Without corporate gentrification and rent-seeking.
Both corporations and authoritarianism benefit from centralization.
DNS is ultimately under government or corporate control.

2026-01-06 13:58:45 UTC

- reply

By "rely on DNS" I mean "doesn't add its own data to DNS records" like some proposals do.
I know Web PKI implicitly relies on DNS to map domain names to IP addresses. I wasn't talking about that.

2026-01-06 13:57:55 UTC

One thing I don't really talk about much is that most of my designs work within HTTP and do not rely on DNS.
There are two reasons for this:<li>I want to support Onion Services and Tor users in general.</li><li>DNSSEC evangelism sucks.</li>

2026-01-05 20:20:12 UTC

Me: We all know PGP is bad because it forces you to support legacy bullshit like 1024-bit RSA keys, but I'm specifically going to write a blog post about email encryption as not just a technical challenge.
@npub17gp…nrxn: *subtoots my blog post*
Their source code: Disables TLS security to support legacy 1024-bit RSA.
https://github.com/chatmail/core/blob/9d7db202256ee334260c7ebccc3ab6403ee59a6c/src/net/tls.rs#L27-L40

2026-01-04 22:02:25 UTC

Everything You Need to Know About Email Encryption in 2026
If you think about emails as if they're anything but the digital equivalent of a postcard--that is to say, they provide zero confidentiality--then someone lied to you and I'm sorry you had to find out from a furry blog that sometimes talks about applied cryptography. CMYKat At the end of 2025, at the 39th Chaos Communications Congress in Hamburg, Germany, a team of security researchers posted some devastating…
http://soatok.blog/2026/01/04/everything-you-need-to-know-about-email-encryption-in-2026/

2025-12-30 15:53:59 UTC

It might not make much difference, but every time I see a news headline that describes a Republican politician raping children as "had sex with", I email the editors to correct their misuse of language.
I know it will probably fall on deaf ears, but the more people do this, the greater the chances they'll listen.

2025-12-19 20:41:26 UTC

- reply

Not sure, but:<li>Specification: <a href="https://github.com/fedi-e2ee/public-key-directory-specification" target="_blank" rel="nofollow noopener" translate="no">https://github.com/fedi-e2ee/public-key-directory-specification</a></li><li>Implementation: <a href="https://github.com/fedi-e2ee/pkd-server-php" target="_blank" rel="nofollow noopener" translate="no">https://github.com/fedi-e2ee/pkd-server-php</a></li><li>Announcement: <a href="https://soatok.blog/2025/12/15/announcing-key-transparency-fediverse/" target="_blank" rel="nofollow noopener" translate="no">https://soatok.blog/2025/12/15/announcing-key-transparency-fediverse/</a></li>
The AuxData thing should also be useful for folks that want to build atop my feature to add transparency to other types of public keys (or any other public commitments of static data, such as security researchers publishing hashes of vulnerabilities being disclosed).

2025-12-18 13:44:57 UTC

This "UK watchdog" can eat shit.
https://www.techradar.com/vpn/vpn-privacy-security/creating-apps-like-signal-or-whatsapp-could-be-hostile-activity-claims-uk-watchdog

2025-12-15 14:46:50 UTC

Announcing Key Transparency for the Fediverse
I'm pleased to announce the immediate availability of a reference implementation for the Public Key Directory server. This software implements the Key Transparency specification I've been working on since last year, and is an important stepping stone towards secure end-to-end encryption for the Fediverse. You can find the software publicly available on GitHub: PHP Server software: PHP SDK (client-side):
https://soatok.blog/2025/12/15/announcing-key-transparency-fediverse/

2025-12-10 20:29:09 UTC

- reply

> Why not retire and have a cushy life?
High-assurance software is needlessly inconvenient. How am I supposed to relax when shit's not fixed?

2025-12-10 20:25:30 UTC

If I ever strike it rich, I'm probably going to spend a good 6-8 months working on open source stuff that will make devs' lives easier and improve security overall.

2025-12-08 22:44:58 UTC

lmao oops someone sent me a follow req and I hit the wrong button on Tusky

2025-12-03 10:02:38 UTC

Re: https://old.reddit.com/r/crypto/comments/1pca3r8/introducing_constanttime_support_for_llvm_to/nrzywmp/?context=2
It is simultaneously true that:<li>Most data breaches do not require any cryptographic wizardry</li><li>Of the ones that involve cryptography, side-channels (timing, power, etc.) are not an attacker's first choice</li><li>The inability to have guarantees that the compiler will not make code variable-time as part of an "optimization" is a massive pain point in writing secure implementations of cryptography</li>
And, sure, the LLVM work won't stop app developers from fucking up something on the OWASP Top 10 list for a given year. Nor will it stop phishing from being hella effective against most users and services.
But it does reduce compiler doom and various forms of auditor bikeshedding, which makes applied cryptography work a little easier to get done.
And the best mitigation we have for phishing attacks today is WebAuthn... which uses cryptography. :P
Sometimes, naysaying is actually counterproductive.

2025-12-01 19:01:13 UTC

Don't mind me, just wood-burning the long-term nuclear waste warning messages around glory-holes.

2025-11-26 22:59:08 UTC

I saw someone a while ago quip something to the tune of "furries only have one joke, and it's their sex life".
And, yeah, but there's a very good reason why that is.
Most people when they join the fandom from a less accepting environment. There's a lot of internalized shame, especially if you were in the closet about your gender or sexual orientation. One way that people cope with adjustments is through humor.
Furry sex jokes are often thinly veiled self-deprecation.
"Haha, look how down bad I am." -> decoder ring -> "I could have never even joked about being a thirsty slut before I found this space, and I'm still not fully comfortable with that."
Not always. But sometines.

2025-11-25 16:38:19 UTC

Fuck. https://www.yesigiveafig.com/p/part-1-my-life-is-a-lie

2025-11-25 12:44:05 UTC

Yo, check this out.
https://blog.trailofbits.com/2025/12/02/introducing-constant-time-support-for-llvm-to-protect-cryptographic-code/

2025-11-19 23:49:35 UTC

Moving Beyond the NPM elliptic Package
If you're in a hurry, head on over to soatok/elliptic-to-noble and follow the instructions in the README in order to remove the elliptic package from your project and all dependencies in node_modules. Art: CMYKat Why replace the elliptic package? Yesterday, the Trail of Bits blog published an intern's post about finding cryptographic bugs in the elliptic library (a Javascript package on NPM) by using the Wycheproof.
http://soatok.blog/2025/11/19/moving-beyond-the-npm-elliptic-package/
#npm #crypto #cryptography #elliptic #security #infosec #cve #mitigation #appsec #javascript #js #npm #npmsecurity #npmpackages

2025-11-18 16:02:07 UTC

2015: "Not using AWS or CloudFlare is an availability risk, because DDoS"
2025: "Using AWS or CloudFlare is an availability risk, because surprise outages"

2025-10-30 03:19:23 UTC

- reply

No, Ed25519 isn't post-quantum. (Neither is RSA or ECDSA.)
But signatures are less urgent to migrate before Q-Day (when a Cryptography Relevant Quantum Computer exists) than encryption is:
There is no "store now, decrypt later" for signing, like there is with encryption.

2025-10-30 03:14:20 UTC

- reply

Further reading:<li>RSA: <a href="https://blog.trailofbits.com/2019/07/08/fuck-rsa/" target="_blank" rel="nofollow noopener" translate="no">https://blog.trailofbits.com/2019/07/08/fuck-rsa/</a></li><li>Elliptic curves for signing: <a href="https://soatok.blog/2022/05/19/guidance-for-choosing-an-elliptic-curve-signature-algorithm-in-2022/" target="_blank" rel="nofollow noopener" translate="no">https://soatok.blog/2022/05/19/guidance-for-choosing-an-elliptic-curve-signature-algorithm-in-2022/</a></li><li><a href="https://fullcirclesecurity.org/2024/11/26/nist-announces-the-end-of-rsa-and-ecdsa/" target="_blank" rel="nofollow noopener" translate="no">https://fullcirclesecurity.org/2024/11/26/nist-announces-the-end-of-rsa-and-ecdsa/</a></li>

2025-10-30 03:09:02 UTC

I know it will take time, but the Fediverse developers should strongly consider making the following opinionated technical decisions:<li>Use RFC 9421 instead of the earlier HTTP Signature spec.</li><li>Make Ed25519 the default algorithm, not 2048-bit RSA.</li>
Ed25519 has a lot of advantages over RSA and ECDSA.
Over 2048-bit RSA:<li>Shorter signatures</li><li>Shorter keys (both secret and public), less storage/bandwidth overhead</li><li>More security (112-bit vs 126-bit)</li>
Over ECDSA:<li>It's much faster than ECDSA</li><li>You don't have to worry about biased nonces leaking your secret key through lattice reduction</li><li>Tuned for security (no weird parameters)</li>
Over **both RSA and ECDSA**:<li>EdDSA is constructed to provide Exclusive Ownership, which is a stronger notion of security</li><li>Easier to implement in constant-time</li>
Bonus:<li>Ed25519 is approved for use in FedRAMP systems (FIPS 186-5), which Common Criteria sometimes cares about.</li>
See more here: https://ianix.com/pub/ed25519-deployment.html and https://www.keylength.com/en/4/

2025-10-29 20:21:01 UTC

- reply

See https://github.com/C2SP/C2SP/pull/164 for my DKG work (because "Trusted Dealer" isn't good enough for me)

2025-10-29 20:20:25 UTC

- reply

Additionally, I've been working on https://github.com/soatok/freeon to bring Threshold Signatures to the FOSS community.
Setting aside that DKG is annoying for all threshold crypto (but I'm working on it):
Threshold EdDSA via FROST: Easy, good, simple.
Threshold ECDSA: Cursed.

2025-10-29 20:19:29 UTC

- reply

RSA: https://blog.trailofbits.com/2019/07/08/fuck-rsa/
ECDSA: https://soatok.blog/2022/05/19/guidance-for-choosing-an-elliptic-curve-signature-algorithm-in-2022/

2025-10-29 20:17:09 UTC

- reply

Messages sent to the Public Key Directory must be signed by an Ed25519 keypair. This is pertaining to RFC 9421 HTTP Message Signatures.
I refuse to support RSA or ECDSA. :P
This ensures only your instance (which holds the private key) can sign Protocol Messages on behalf of a given Actor.
This means the transparency log doesn't need to reason about authz or permissions; it can rely on "did it get a valid HTTP Message Signature?" for those decisions, and the instance server can make those decisions.

2025-10-29 20:14:51 UTC

Does anyone have an Ed25519 public key configured to show up via WebFinger for their Fedi account?
I know Mastodon stupidly only supports RSA. That's a thing I plan to fix eventually.

2025-10-25 02:28:54 UTC

- reply

https://soatok.blog/category/technology/open-source/fediverse-e2ee-project/
https://soatok.blog/2025/10/15/the-dreamseekers-vision-of-tomorrow/
I've been regularly blogging about my progress and next steps

2025-10-25 02:27:28 UTC

- reply

I actually never stopped. XD

2025-10-24 12:13:02 UTC

If you're curious about thee state of #FediE2EE.
I've been implementing the cryptography protocols used in building Key Transparency for Fedi.
https://github.com/fedi-e2ee/pkd-crypto
With this in hand, I'm writing a reference implementation of the server software as defined in the specification.
https://github.com/fedi-e2ee/public-key-directory-specification
Once this is implemented, I'm going to update the specification with anything I learned while writing the server osftware.
One thing I already learned: I need to be specific about how HPKE ciphertexts are serialized. The current spec draft doesn't tell implementors what to do here.
Once the spec + implementation are in a good place, I'll deploy a test instance and release a PHP client (using the same crypto library).
Separately, a Rust client is being developed. https://github.com/Waelwindows/pkd-client
The main idea here is to FFI the Rust implementation in other languages (Ruby, etc.).
Once *all this* is done, we get to go through a few cycles of peer review until we calcify the spec with a major version 1.0 release

2025-10-17 17:49:12 UTC

Oh btw
I grabbed the domain name, fedipurse.com, before my latest blog post went live.
Wouldn't want some asshat tech bro to squat it for a crypto scam, after all.
https://soatok.blog/2025/10/15/the-dreamseekers-vision-of-tomorrow/

2025-10-15 12:50:57 UTC

The Dreamseeker’s Vision of Tomorrow
Since I have your attention for the moment, I'd like you to ask yourself a question: What is it that drives you in life? Do you yearn for the feeling of safety? By seeking power, status, wealth, and fame? Is it cravings for pleasure that motivate your actions? Does a sense of obligation to others, or even your past self, that informs your decisions?
http://soatok.blog/2025/10/15/the-dreamseekers-vision-of-tomorrow/

2025-10-14 01:25:04 UTC

- reply

Despite its early, somewhat hacky status, I made sure there were mutation testing, fuzz testing, and two different static analysis tools in the CI pipeline.
Unfortunately, I couldn't get an additional tool (Duvet) working. I'll figure it out later.
Duvet basically lets you ensure that a specification is implemented, and that the parts that implement it are adequately tested. It's a neat idea.
https://github.com/fedi-e2ee/pkd-server-go/issues/4

2025-10-14 01:21:59 UTC

- reply

The primary purpose of a reference implementation is to make it easier to reason about what the specification... actually specifies.
Our last commit was 7 months ago. It being entirely intangible makes it harder to review. Now, it should be easier to provide actionable feedback.
https://github.com/fedi-e2ee/public-key-directory-specification

2025-10-14 01:20:48 UTC

I pushed the initial draft of the **reference implementation** for the Public Key Directory server-side software on GitHub tonight: https://github.com/fedi-e2ee/pkd-server-go
This is still a very early draft. It's a rapid cleanup of a messier codebase that tried to adhere to the spec. It's not perfect. Don't deploy it yet.
For now, I want to call attention to exactly one thing:
The [security disclosure policy prioritizes "full disclosure"](https://github.com/fedi-e2ee/pkd-server-go/blob/main/SECURITY.md ).

2025-10-03 01:56:36 UTC

- reply

If y'all can get it to 100% by Monday I'll write a special post roasting the hot takes in the Hacker News thread for Signal PQ ratchets
https://news.ycombinator.com/item?id=45451527

2025-10-02 16:45:02 UTC

- reply

Hot damn, y'all are awesome. The running total is now over halfway to @npub1ch5…jxkl's Ko-Fi goal.

2025-10-02 09:43:10 UTC

I know things are tough for most people, so don't worry if you can't chip in right now.
**A good friend of mine could use your support.**
@npub1ch5…jxkl has been developing free and open source software for a heck of a long time. If you've ever used Internet Radio before, there's a damn good chance you've used [AzuraCast](https://github.com/AzuraCast/AzuraCast ).
They have a Ko-Fi goal of $2500. If any of you can chip in even $3 to help them, it is difficult to overstate the immense burden you'll be alleviating.
https://ko-fi.com/silvereagle
I've tossed in $100 to get this started. Can we get them to their goal?