Simone Ragusa

One month ago, I earned my master's degree in cybersecurity. Working on my thesis was deeply rewarding, and I received a final grade that exceeded any expectations I had when I began this journey two years ago. Thank you to all the great people who make cryptography open and welcoming to anyone.

Publishing “Cryptographic Right Answers” for developers is a tradition by now. Colin Percival started in 2009, Thomas Ptacek followed up in 2015, and then Latacora carried on in 2018 and 2024. I put together a list updated for the renewed urgency of migrating to post-quantum algorithms.

I feel like if you get the title of Distinguished Engineer as a cryptographer, something has gone horribly wrong. #INDCCA

“But it happened” is definitely worth more attention. youtu.be/tlQ7EoJDTQY?...

A bit over two years after starting to work on it... Go is officially FIPS 140-3 certified 💥 csrc.nist.gov/projects/cry... I am pretty confident Go is now one of the most—if not the most—seamless and complete FIPS 140-3 compliance solutions... with a single env var, out of the box.

Two papers came out last week that suggest classical asymmetric cryptography might indeed be broken by quantum computers in just a few years. That means we need to ship post-quantum crypto now, with the tools we have: ML-KEM and ML-DSA. I didn't think PQ auth was so urgent until recently.

💥💥💥💥💥 age v1.3.0 💥💥💥💥💥 Post-quantum keys, seeking DecryptReaderAt API, age-inspect CLI tool, built-in recipients compatible with hardware plugins, non-interactive passphrase input, Go framework for implementing plugins, and sooooo many improved errors. Six years to the day after the first beta!

Using an age keyserver as a demo, this article demonstrates how to add a transparency log to a centralized service step-by-step. We use Tessera for the tlog, VRFs for privacy, and the Witness Network. It all takes just 500 lines to integrate! The result of years of work making tlogs accessible.